{ "type": "URL", "indicator": "https://www.cube-soft.jp/cubewidget/setting.v2.json", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.cube-soft.jp/cubewidget/setting.v2.json", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3753528713, "indicator": "https://www.cube-soft.jp/cubewidget/setting.v2.json", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "659fa1fad840744f75eb2d14", "name": "Worm:Win32/Benjamin IoC's", "description": "https://otx.alienvault.com/malware/Worm:Win32%2FBenjamin/samples | \nFiles Matching Antivirus Detection - 296,250 \nNetwork Icmp\nPersistence Autorun\nNetwork Http\nDynamic Function Loading\nProcmem Yara\nInjection Rwx\nPowershell Request\nDead Connect\nSuricata Alert\nPe Features\nPacker Entropy\nAntivm Memory Available\nAllocates Rwx\nCreates Exe\nPacker Polymorphic\nNids Alert\nDead Host\nNolookup Communication", "modified": "2024-02-10T07:03:55.140000", "created": "2024-01-11T08:08:26.689000", "tags": [ "worm", "win32", "benjamin", "passive dns", "as47846", "germany unknown", "urls", "next", "scan endpoints", "all octoseek", "unknown", "threat roundup", "ssl certificate", "whois record", "august", "april", "execution", "october", "july", "march", "contacted", "june", "emotet", "quasar", "core", "hacktool", "goldfinder", "sibot", "ryuk", "drxk0gdg2s06f8p", "cfom2jtlf", "k60zzli http", "whois whois", "historical ssl", "resolutions", "referrer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 144, "FileHash-SHA1": 145, "FileHash-SHA256": 2888, "hostname": 1075, "domain": 1007, "URL": 4964, "CVE": 1 }, "indicator_count": 10224, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "841 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "658481716d9034bb0d52212d", "name": "Apple Attack | Floxif Spyware | Threat Network | Virus Network", "description": "Threat Network affecting and/or originating from Apple server. Malware attacks apple airpods, tv, apple store\napple trade, apple tv\napple watch, apple card, apple og?, apple server.\nSystemUpdate.dll issue. Device may partially attempt, device will show latest update, com[promised devices may have throttled update on attempt.\n\nFloxif:\nShort bio\nTrojan.Floxif is Malwarebytes\u2019 detection name for a file-changing Trojanthat targets Windows systems.\n\nSymptoms\nTrojan.Floxif can change legitimate files into infected files. Then the infected files act as a backdoor, giving the threat actor control over the machine.\n\nStaged data. Floxif primarily target Windows, Apple is less vulnerable to buy can be experience a Floxif attack.", "modified": "2024-01-20T14:03:29.247000", "created": "2023-12-21T18:18:25.746000", "tags": [ "bitrep", "learn", "apple card", "apple", "apple store", "apple tv", "watch vision", "airpods tv", "apple watch", "buy apple", "apple trade", "footer", "media", "find", "cisco umbrella", "site", "safe site", "alexa top", "million", "malicious site", "hostname", "hostnames", "detection list", "blacklist", "malware", "alexa", "ip address", "whois record", "ssl certificate", "iocs", "whois whois", "historical ssl", "communicating", "threat network", "ioc search", "new ioc", "teams api", "contact", "attack", "probe", "search", "threat", "paste", "contacted", "april", "threat roundup", "pe resource", "lcid1033", "smlen", "spn647", "bv6fet56ww", "february", "core", "name verdict", "falcon sandbox", "threat analyzer", "samples", "generic malware", "tag count", "malware generic", "tue dec", "threat report", "summary", "first", "http response", "final url", "status code", "body length", "kb body", "sha256", "self", "server apple", "connection", "html info", "title apple", "meta tags", "indextab og", "apple og", "spyware", "plugins", "cab", "fraud urls", "data collection", "staged data", "privilege escalation", "defense evasion", "evasive", "stealthy", "serial number", "symantec time", "stamping", "algorithm", "thumbprint", "from", "symantec sha256", "sha256 code", "signing ca", "class", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "vs2008", "rticon english", "vs2005", "chi2", "contained", "info compiler", "products", "header target", "machine intel", "utc entry", "floxif", "serving ip", "address", "headers nel", "dynamic expires", "gmt server", "file sharing", "personal data" ], "references": [ "https://www.apple.com/qtactivex/qtplugin.cab", "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad", "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]", "http://www.screensaver.com/ruxitbeacon", "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]", "http://dns1.whitelist.camect.com [interesting]", "https://www.jbits.courts.state.co [interesting]", "http://www.sos.state.co/ [interesting]", "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary", "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary", "Crowdsourced YARA Rulesets", "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems", "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security", "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth", "https://www.malwarebytes.com/blog/detections/trojan-floxif", "20.190.160.2 Microsoft [exploit_source]", "20.190.160.67 Microsoft [exploit_source]", "20.190.160.73 Microsoft [exploit_source]", "watson.events.data.microsoft.com [traffic manager]", "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181. [stack hash]", "watson.telemetry.microsoft.us [Data traffic manager]", "www.anyxxxtube.net [tracking]", "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Apple", "display_name": "Apple", "target": null } ], "attack_ids": [ { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 609, "FileHash-SHA1": 361, "FileHash-SHA256": 1977, "domain": 460, "hostname": 992, "URL": 3115 }, "indicator_count": 7514, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "862 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533ed2685e0fc66ac0628bd", "name": "Network capture | Gather Victim Network Information | C2", "description": "Botnet. Spammer. BN campaigners. Victim name used for marketing BN and porn. This website contains age-restricted material and contains explicit depictions of sexual activity, but does not ask for permission to access or access any of the site's materials. \u00c2\u00a9 Mile High Distribution Inc", "modified": "2023-11-20T11:03:09.867000", "created": "2023-10-21T15:24:22.377000", "tags": [ "mile high", "logos", "trademarks", "aylo premium", "click", "record keeping", "statement", "all rights", "reserved", "vendo", "ssl certificate", "contacted", "whois record", "tsara brashears", "historical ssl", "apple", "password", "porn", "networks", "botnet campaign", "crypto", "installer", "attacker", "metro", "brazzers", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "maxage86400", "path", "html info", "title page", "found meta", "milehigh", "watch", "milfs", "trackers google", "analytics na", "name verdict", "falcon sandbox", "reports no", "specific", "pattern match", "file", "ascii text", "windows nt", "jpeg image", "united", "appdata", "jfif", "mitre att", "date", "unknown", "hybrid", "accept", "general", "local", "strings", "class", "critical", "error", "server", "email", "code", "whois privacy", "domain status", "registrar abuse", "registrar url", "registrar", "registry domain", "C2", "organization", "threat level", "windir", "getpost", "name server", "openurl c" ], "references": [ "https://www.milehighmedia.com/legal/2257 exploit_source [Metro T-Mobile attacker. Brazzers | T]", "https://www.sweetheartvideo.com/tsara-brashears/ [Botnet tracking campaign, referrer]", "https://www.sweetheartvideo.com/tsara-brashears [Network ID]", "https://www.sweetheartvideo.com [Pattern match, Brashears]", "m1.sweetheartvideo.com [mailer!]", "mba3.sweetheartvideo.com [Server]", "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e [Research Tool]", "Other", "browser.events.data.msn.com [sandbox and archive browser events]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4377, "FileHash-MD5": 128, "FileHash-SHA1": 127, "FileHash-SHA256": 2861, "domain": 829, "hostname": 1452, "CVE": 1, "email": 6 }, "indicator_count": 9781, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "923 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1d4a989642696d13b34c", "name": "Network capture | Gather Victim Network Information | C2", "description": "", "modified": "2023-11-20T11:03:09.867000", "created": "2023-10-30T03:04:42.175000", "tags": [ "mile high", "logos", "trademarks", "aylo premium", "click", "record keeping", "statement", "all rights", "reserved", "vendo", "ssl certificate", "contacted", "whois record", "tsara brashears", "historical ssl", "apple", "password", "porn", "networks", "botnet campaign", "crypto", "installer", "attacker", "metro", "brazzers", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "maxage86400", "path", "html info", "title page", "found meta", "milehigh", "watch", "milfs", "trackers google", "analytics na", "name verdict", "falcon sandbox", "reports no", "specific", "pattern match", "file", "ascii text", "windows nt", "jpeg image", "united", "appdata", "jfif", "mitre att", "date", "unknown", "hybrid", "accept", "general", "local", "strings", "class", "critical", "error", "server", "email", "code", "whois privacy", "domain status", "registrar abuse", "registrar url", "registrar", "registry domain", "C2", "organization", "threat level", "windir", "getpost", "name server", "openurl c" ], "references": [ "https://www.milehighmedia.com/legal/2257 exploit_source [Metro T-Mobile attacker. Brazzers | T]", "https://www.sweetheartvideo.com/tsara-brashears/ [Botnet tracking campaign, referrer]", "https://www.sweetheartvideo.com/tsara-brashears [Network ID]", "https://www.sweetheartvideo.com [Pattern match, Brashears]", "m1.sweetheartvideo.com [mailer!]", "mba3.sweetheartvideo.com [Server]", "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e [Research Tool]", "Other", "browser.events.data.msn.com [sandbox and archive browser events]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" } ], "industries": [], "TLP": "white", "cloned_from": "6533ed2685e0fc66ac0628bd", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4377, "FileHash-MD5": 128, "FileHash-SHA1": 127, "FileHash-SHA256": 2861, "domain": 829, "hostname": 1452, "CVE": 1, "email": 6 }, "indicator_count": 9781, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "923 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]", "20.190.160.73 Microsoft [exploit_source]", "watson.telemetry.microsoft.us [Data traffic manager]", "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]", "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security", "https://www.apple.com/qtactivex/qtplugin.cab", "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181. [stack hash]", "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth", "Crowdsourced YARA Rulesets", "https://www.sweetheartvideo.com [Pattern match, Brashears]", "https://www.malwarebytes.com/blog/detections/trojan-floxif", "http://dns1.whitelist.camect.com [interesting]", "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad", "https://www.milehighmedia.com/legal/2257 exploit_source [Metro T-Mobile attacker. Brazzers | T]", "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e [Research Tool]", "browser.events.data.msn.com [sandbox and archive browser events]", "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary", "Other", "http://www.screensaver.com/ruxitbeacon", "20.190.160.2 Microsoft [exploit_source]", "watson.events.data.microsoft.com [traffic manager]", "www.anyxxxtube.net [tracking]", "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]", "m1.sweetheartvideo.com [mailer!]", "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary", "https://www.jbits.courts.state.co [interesting]", "https://www.sweetheartvideo.com/tsara-brashears/ [Botnet tracking campaign, referrer]", "20.190.160.67 Microsoft [exploit_source]", "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems", "https://www.sweetheartvideo.com/tsara-brashears [Network ID]", "mba3.sweetheartvideo.com [Server]", "http://www.sos.state.co/ [interesting]" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Tulach", "Apple", "Malware" ], "industries": [], "unique_indicators": 27351 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/cube-soft.jp", "whois": "http://whois.domaintools.com/cube-soft.jp", "domain": "cube-soft.jp", "hostname": "www.cube-soft.jp" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "659fa1fad840744f75eb2d14", "name": "Worm:Win32/Benjamin IoC's", "description": "https://otx.alienvault.com/malware/Worm:Win32%2FBenjamin/samples | \nFiles Matching Antivirus Detection - 296,250 \nNetwork Icmp\nPersistence Autorun\nNetwork Http\nDynamic Function Loading\nProcmem Yara\nInjection Rwx\nPowershell Request\nDead Connect\nSuricata Alert\nPe Features\nPacker Entropy\nAntivm Memory Available\nAllocates Rwx\nCreates Exe\nPacker Polymorphic\nNids Alert\nDead Host\nNolookup Communication", "modified": "2024-02-10T07:03:55.140000", "created": "2024-01-11T08:08:26.689000", "tags": [ "worm", "win32", "benjamin", "passive dns", "as47846", "germany unknown", "urls", "next", "scan endpoints", "all octoseek", "unknown", "threat roundup", "ssl certificate", "whois record", "august", "april", "execution", "october", "july", "march", "contacted", "june", "emotet", "quasar", "core", "hacktool", "goldfinder", "sibot", "ryuk", "drxk0gdg2s06f8p", "cfom2jtlf", "k60zzli http", "whois whois", "historical ssl", "resolutions", "referrer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 144, "FileHash-SHA1": 145, "FileHash-SHA256": 2888, "hostname": 1075, "domain": 1007, "URL": 4964, "CVE": 1 }, "indicator_count": 10224, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "841 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "658481716d9034bb0d52212d", "name": "Apple Attack | Floxif Spyware | Threat Network | Virus Network", "description": "Threat Network affecting and/or originating from Apple server. Malware attacks apple airpods, tv, apple store\napple trade, apple tv\napple watch, apple card, apple og?, apple server.\nSystemUpdate.dll issue. Device may partially attempt, device will show latest update, com[promised devices may have throttled update on attempt.\n\nFloxif:\nShort bio\nTrojan.Floxif is Malwarebytes\u2019 detection name for a file-changing Trojanthat targets Windows systems.\n\nSymptoms\nTrojan.Floxif can change legitimate files into infected files. Then the infected files act as a backdoor, giving the threat actor control over the machine.\n\nStaged data. Floxif primarily target Windows, Apple is less vulnerable to buy can be experience a Floxif attack.", "modified": "2024-01-20T14:03:29.247000", "created": "2023-12-21T18:18:25.746000", "tags": [ "bitrep", "learn", "apple card", "apple", "apple store", "apple tv", "watch vision", "airpods tv", "apple watch", "buy apple", "apple trade", "footer", "media", "find", "cisco umbrella", "site", "safe site", "alexa top", "million", "malicious site", "hostname", "hostnames", "detection list", "blacklist", "malware", "alexa", "ip address", "whois record", "ssl certificate", "iocs", "whois whois", "historical ssl", "communicating", "threat network", "ioc search", "new ioc", "teams api", "contact", "attack", "probe", "search", "threat", "paste", "contacted", "april", "threat roundup", "pe resource", "lcid1033", "smlen", "spn647", "bv6fet56ww", "february", "core", "name verdict", "falcon sandbox", "threat analyzer", "samples", "generic malware", "tag count", "malware generic", "tue dec", "threat report", "summary", "first", "http response", "final url", "status code", "body length", "kb body", "sha256", "self", "server apple", "connection", "html info", "title apple", "meta tags", "indextab og", "apple og", "spyware", "plugins", "cab", "fraud urls", "data collection", "staged data", "privilege escalation", "defense evasion", "evasive", "stealthy", "serial number", "symantec time", "stamping", "algorithm", "thumbprint", "from", "symantec sha256", "sha256 code", "signing ca", "class", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "vs2008", "rticon english", "vs2005", "chi2", "contained", "info compiler", "products", "header target", "machine intel", "utc entry", "floxif", "serving ip", "address", "headers nel", "dynamic expires", "gmt server", "file sharing", "personal data" ], "references": [ "https://www.apple.com/qtactivex/qtplugin.cab", "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad", "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]", "http://www.screensaver.com/ruxitbeacon", "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]", "http://dns1.whitelist.camect.com [interesting]", "https://www.jbits.courts.state.co [interesting]", "http://www.sos.state.co/ [interesting]", "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary", "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary", "Crowdsourced YARA Rulesets", "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems", "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security", "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth", "https://www.malwarebytes.com/blog/detections/trojan-floxif", "20.190.160.2 Microsoft [exploit_source]", "20.190.160.67 Microsoft [exploit_source]", "20.190.160.73 Microsoft [exploit_source]", "watson.events.data.microsoft.com [traffic manager]", "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181. [stack hash]", "watson.telemetry.microsoft.us [Data traffic manager]", "www.anyxxxtube.net [tracking]", "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "Apple", "display_name": "Apple", "target": null } ], "attack_ids": [ { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 609, "FileHash-SHA1": 361, "FileHash-SHA256": 1977, "domain": 460, "hostname": 992, "URL": 3115 }, "indicator_count": 7514, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "862 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6533ed2685e0fc66ac0628bd", "name": "Network capture | Gather Victim Network Information | C2", "description": "Botnet. Spammer. BN campaigners. Victim name used for marketing BN and porn. This website contains age-restricted material and contains explicit depictions of sexual activity, but does not ask for permission to access or access any of the site's materials. \u00c2\u00a9 Mile High Distribution Inc", "modified": "2023-11-20T11:03:09.867000", "created": "2023-10-21T15:24:22.377000", "tags": [ "mile high", "logos", "trademarks", "aylo premium", "click", "record keeping", "statement", "all rights", "reserved", "vendo", "ssl certificate", "contacted", "whois record", "tsara brashears", "historical ssl", "apple", "password", "porn", "networks", "botnet campaign", "crypto", "installer", "attacker", "metro", "brazzers", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "maxage86400", "path", "html info", "title page", "found meta", "milehigh", "watch", "milfs", "trackers google", "analytics na", "name verdict", "falcon sandbox", "reports no", "specific", "pattern match", "file", "ascii text", "windows nt", "jpeg image", "united", "appdata", "jfif", "mitre att", "date", "unknown", "hybrid", "accept", "general", "local", "strings", "class", "critical", "error", "server", "email", "code", "whois privacy", "domain status", "registrar abuse", "registrar url", "registrar", "registry domain", "C2", "organization", "threat level", "windir", "getpost", "name server", "openurl c" ], "references": [ "https://www.milehighmedia.com/legal/2257 exploit_source [Metro T-Mobile attacker. Brazzers | T]", "https://www.sweetheartvideo.com/tsara-brashears/ [Botnet tracking campaign, referrer]", "https://www.sweetheartvideo.com/tsara-brashears [Network ID]", "https://www.sweetheartvideo.com [Pattern match, Brashears]", "m1.sweetheartvideo.com [mailer!]", "mba3.sweetheartvideo.com [Server]", "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e [Research Tool]", "Other", "browser.events.data.msn.com [sandbox and archive browser events]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4377, "FileHash-MD5": 128, "FileHash-SHA1": 127, "FileHash-SHA256": 2861, "domain": 829, "hostname": 1452, "CVE": 1, "email": 6 }, "indicator_count": 9781, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "923 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1d4a989642696d13b34c", "name": "Network capture | Gather Victim Network Information | C2", "description": "", "modified": "2023-11-20T11:03:09.867000", "created": "2023-10-30T03:04:42.175000", "tags": [ "mile high", "logos", "trademarks", "aylo premium", "click", "record keeping", "statement", "all rights", "reserved", "vendo", "ssl certificate", "contacted", "whois record", "tsara brashears", "historical ssl", "apple", "password", "porn", "networks", "botnet campaign", "crypto", "installer", "attacker", "metro", "brazzers", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "headers", "maxage86400", "path", "html info", "title page", "found meta", "milehigh", "watch", "milfs", "trackers google", "analytics na", "name verdict", "falcon sandbox", "reports no", "specific", "pattern match", "file", "ascii text", "windows nt", "jpeg image", "united", "appdata", "jfif", "mitre att", "date", "unknown", "hybrid", "accept", "general", "local", "strings", "class", "critical", "error", "server", "email", "code", "whois privacy", "domain status", "registrar abuse", "registrar url", "registrar", "registry domain", "C2", "organization", "threat level", "windir", "getpost", "name server", "openurl c" ], "references": [ "https://www.milehighmedia.com/legal/2257 exploit_source [Metro T-Mobile attacker. Brazzers | T]", "https://www.sweetheartvideo.com/tsara-brashears/ [Botnet tracking campaign, referrer]", "https://www.sweetheartvideo.com/tsara-brashears [Network ID]", "https://www.sweetheartvideo.com [Pattern match, Brashears]", "m1.sweetheartvideo.com [mailer!]", "mba3.sweetheartvideo.com [Server]", "https://www.hybrid-analysis.com/sample/a478360da159c358a804f1340f142fa2a0d689e02d743b71509e5e3921877a3e [Research Tool]", "Other", "browser.events.data.msn.com [sandbox and archive browser events]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1583.004", "name": "Server", "display_name": "T1583.004 - Server" } ], "industries": [], "TLP": "white", "cloned_from": "6533ed2685e0fc66ac0628bd", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4377, "FileHash-MD5": 128, "FileHash-SHA1": 127, "FileHash-SHA256": 2861, "domain": 829, "hostname": 1452, "CVE": 1, "email": 6 }, "indicator_count": 9781, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "923 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.cube-soft.jp/cubewidget/setting.v2.json", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.cube-soft.jp/cubewidget/setting.v2.json", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780277720.8114088 }