{ "type": "URL", "indicator": "https://www.google-analytics.com/ga.js", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.google-analytics.com/ga.js", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #81", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain google-analytics.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain google-analytics.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3205952818, "indicator": "https://www.google-analytics.com/ga.js", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "691e2279ac1ef8b9dbfbc2b3", "name": "Mirai \u2022 Neurotox Institute", "description": "Found in peripheral. Lazarus. Related tomOperation Endgame. Strangely related to the entertainment industry. \nRelated to treatments facilities where a target I\u2019ve been researching received \u2018care\u2019. Also links to Major Entertainment conglomerate : not surprisingly Hall Render and Foundry.\nPage was stated to expire 11/21 | expired after I was able to capture a live screenshot (not updated for years) \n\n[The Neurotoxin Institute (NTI) is a multidisciplinary organization created to serve as a comprehensive independent source of information related to the basic science and the clinical applications of neurotoxins. The Institute fosters the learning and teaching of both theory and practical techniques, and encourages further research in support of these goals.\nExperimental Biology (EB)\nwww.aapmr.org]", "modified": "2025-12-19T19:00:18.927000", "created": "2025-11-19T20:03:05.195000", "tags": [ "united", "link", "virtool", "meta", "atom", "pragma", "dynamicloader", "msie", "windows nt", "tls handshake", "failure", "tlsv1", "forbidden", "ogoogle trust", "encrypt", "possible", "write", "malware", "consumed", "netherlands", "united kingdom", "read c", "sality", "delphi", "win32", "strings", "xserver", "post http", "post method", "cryptexportkey", "ocloudflare", "cryptgenkey", "calgrc4", "persistence", "execution", "div div", "script script", "span a", "a li", "unknown ns", "span", "april", "passive dns", "hosting", "reverse dns", "hostname add", "files ip", "asn as32475", "address domain", "mirai", "united states", "facebook", "twitter", "youtube", "ck ids", "mh may", "t1204 technique", "user execution", "suggested", "port", "destination", "telnet login", "high", "tcp syn", "infectednight", "resolverror", "suspicious path", "ids detections", "yara detections", "sinkhole cookie", "file score", "detections sf", "value snkz", "forbidden tls", "et trojan", "value", "et info", "et", "present oct", "domain", "title", "present sep", "moved", "server", "next associated", "ipv4 add", "urls", "files", "trojan", "cookie", "predict70 sep", "next http", "scans record", "forbidden date", "gmt content", "type", "unix", "namecheap url", "forward elf", "md5 add", "less see", "contacted", "pulse pulses", "av detections", "analysis date", "virus", "ee fc", "unknown", "yara rule", "ff d5", "search", "show", "suspicious", "fbq object", "ide value", "source level", "url text", "line", "allow attribute", "mootools", "class function", "chain", "options", "elements", "garbage", "drag", "xhr function", "ajax", "itemid14", "kb image", "kb script", "b image", "b stylesheet", "b script", "kb stylesheet", "stylesheet", "redirect chain", "path size", "type mimetype", "resource", "general full", "montreal", "canada", "asn16276", "debian", "url http", "hash", "main", "cookie object", "dns any", "date", "entries", "url https", "Foundry", "Lazarus", "Endgame", "Neurotoxin Institute", "Hall Render", "Brian Sabey", "UC Health", "Britney Spears Official" ], "references": [ "https://www.neurotoxininstitute.com/", "Backdoor.Win32.Pushdo.s Checkin", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "http://appelfarm.org", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "Interesting Strings : 13.79.87.163", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "https://britneyspears.com/", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/" ], "public": 1, "adversary": "Lazarus", "targeted_countries": [ "United States of America", "Japan", "France", "Germany", "Canada", "Netherlands", "United Kingdom of Great Britain and Northern Ireland", "New Zealand", "Italy", "Aruba", "Poland", "Singapore", "T\u00fcrkiye", "Indonesia", "Spain", "Hong Kong" ], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Netherlands", "display_name": "Netherlands", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null }, { "id": "Virus:Win32/Krepper.30760", "display_name": "Virus:Win32/Krepper.30760", "target": "/malware/Virus:Win32/Krepper.30760" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "target": null }, { "id": "Suggested", "display_name": "Suggested", "target": null }, { "id": "VirTool:Win32/VBInject.gen!MH", "display_name": "VirTool:Win32/VBInject.gen!MH", "target": "/malware/VirTool:Win32/VBInject.gen!MH" }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Softcnapp", "display_name": "Softcnapp", "target": null }, { "id": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "display_name": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "target": null }, { "id": "Win32:Zbot-RUV", "display_name": "Win32:Zbot-RUV", "target": null }, { "id": "Win32:Evo-gen", "display_name": "Win32:Evo-gen", "target": null }, { "id": "Win32:Kryptik", "display_name": "Win32:Kryptik", "target": null }, { "id": "Trojan:Win32/Bulta", "display_name": "Trojan:Win32/Bulta", "target": "/malware/Trojan:Win32/Bulta" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 511, "hostname": 198, "domain": 471, "FileHash-SHA256": 1442, "FileHash-MD5": 183, "FileHash-SHA1": 79, "email": 5, "SSLCertFingerprint": 63 }, "indicator_count": 2952, "is_author": false, "is_subscribing": null, "subscriber_count": 148, "modified_text": "164 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ca35f7202c88b2bf667c66", "name": "Ploprolo | Unix.Trojan.DarkNexus-7679166-0 | U.S. Department of Defense", "description": "Why not question suspect instead of threaten smear name in all types distasteful content. US DoD auto populated as did all tags. Link found in Adult website documented in court records. Investigate victim? Bryan Counts of upper management in Concentra telling victim Jeffrey Scott Reimer was a professional assaulter, believes there are other victims and he could be a killer. Counts back pedals they kept Reimer employed but from treating females, stating everything checked out. They are very sorry. Asked victim for hacked w'away recordings and told her 'Thank you for not pursuing our therapist.' 'You are no longer able to receive care here. I'm a public figure and I can't have this. My best friend is going to be the Sheriff. Hey yourselves a bunch of lawyers and hide. Surround yourself with people you can trust.' Mark Montano MD.\n@Kailula4 has an emptied graph of same custom Trojan. I have trouble believing it's the actual US Government. If it is, it's very sad.", "modified": "2024-09-23T18:04:30.948000", "created": "2024-08-24T19:35:19.416000", "tags": [ "asn as16625", "akamai", "link", "a domains", "as20940", "aaaa", "meta", "script", "input", "passive dns", "general", "united states", "as2914 ntt", "as721 dod", "as3257 gtt", "domain", "as2828 verizon", "as16625 akamai", "united", "as15169 google", "as44273 host", "search otx", "read c", "create c", "high", "memcommit", "delete", "write c", "module load", "dock", "write", "execution", "sample hash", "Injection", "inject", "analyzer threat", "ip summary", "detection list", "cisco umbrella", "alexa top", "million", "safe site", "cl0p ransomware", "maltiverse safe", "zbot", "malware", "ip address", "secretary", "defense", "defense lloyd", "strong", "support", "value", "joint chiefs", "minister", "ukraine", "service", "live", "honor", "department", "america", "defense og", "defense meta", "joint chief", "military", "government", "trackers", "external_resources", "third_party_cookies", "iframes", "today", "document file", "v2 document", "canada unknown", "canada", "invalid url", "scan endpoints", "all scoreblue", "ipv4", "url analysis", "creation date", "entries", "hostname", "date", "hostnames", "urls http", "mail spammer", "autorunmacro.d", "penalties", "army", "afghanistan", "journal julyaug", "stovl promises", "uas road", "cheers", "way ahead", "mor pdf", "armed forces", "copy", "format", "core", "createdate", "producer gimp", "navy", "title navy", "filehash", "av detections", "ids detections", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "xszcgdvlhymmww", "exploit", "win64", "null", "suspicious", "hotkey", "yara detections", "alerts", "analysis date", "file score", "brian sabey" ], "references": [ "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "AutorunMacro.D", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "Tell your dog I said 'hi'" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "Malware-gen\\ [Trj]", "display_name": "Malware-gen\\ [Trj]", "target": null }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4572, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 448, "FileHash-MD5": 935, "URL": 267, "domain": 176, "FileHash-SHA256": 1504, "FileHash-SHA1": 616, "email": 3, "CVE": 1 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "616 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66c9bb42dd32d415f9aaa06c", "name": "Botnet exchange | NORAD Tracking | Mirai | Injection | Spyware | Remote executions", "description": "North American Aerospace Defense Command NORAD - http://superanalbizflowforum.com/tsara-lynn-brashears (really?)\nwww.norad.mil , www.northcom.mil, dodcio.defense.gov, www.defense.gov\nwww.dodig.mil, www.foia.gov , prhome.defense.gov\n, www.ourmilitary.com, www.noradsanta.org , www.web.dma.mil \nIt's hard to tell or believe military and DoD conduct business this way. I tend to think scam abuse. Exception: target, escorted by security to appt in a DHS secured b,dg. She was then told to leave after receptionist received a call stating target was a threat. Entire floor was secured off. TB beyond upset w/ my carelessness of veteran & other comments. Targets Father, brother uncles, cousins, all served honorably w/some now terminally affected &mothers passed on from Camp Lejeune related complications. Father, an engineer & veteran worked on AEGIS weapons system test team for 3 now potentially decommissioned military Destroyers. \nI apologize prefusly for comment, MIL involvement was prevalent; it remains cloudy.", "modified": "2024-09-23T09:03:54.724000", "created": "2024-08-24T10:51:46.907000", "tags": [ "server", "whois lookup", "domain name", "llc sponsoring", "registrar iana", "referral url", "tsara brashears", "referrer", "porn", "networks", "botnet campaign", "pyinstaller", "apple", "password", "cybercrime", "it consultant", "metro", "skynet", "analyzer paste", "iocs", "hostnames", "urls http", "cyber threat", "cnc server", "ibm xforce", "exchange", "covid19", "tracker", "exchange botnet", "command", "control server", "keybase", "citadel", "stealer", "zeus", "radamant", "kovter", "zbot", "suppobox", "simda", "virut", "kraken", "amonetize", "msil", "phishing", "malicious", "feodo", "united", "germany unknown", "as133775 xiamen", "unknown", "china unknown", "passive dns", "domain", "search", "cisco umbrella", "site", "alexa top", "million", "safe site", "malware site", "malicious site", "malware", "malicious url", "files domain", "files related", "related tags", "none md5", "as35908 krypt", "status hostname", "query type", "address first", "seen last", "seen asn", "country unknown", "status", "record value", "all scoreblue", "meta", "trend today", "link", "japan unknown", "script urls", "script script", "name servers", "script domains", "accept", "encrypt", "gmt content", "gmt etag", "ipv4", "url analysis", "pragma", "scan endpoints", "pulse submit", "urls", "body", "date", "hostname", "pulse pulses", "react app", "verizon feed", "bq aug", "typeof e", "object", "wds socket", "error", "path max", "path", "cookie", "suspicious", "virtool", "info", "trace", "moved", "aaaa nxdomain", "files", "a domains", "as9371 sakura", "service", "servers", "xml title", "dnssec", "showing", "next", "xserver", "title", "file", "type texthtml", "sha256", "read c", "write c", "kryptik", "tls sni", "style ssl", "cert", "amazon profile", "show", "cobaltstrike", "trojan", "copy", "write", "win32", "persistence", "execution", "media", "autorun", "delete c", "trojanspy", "entries", "bytes", "jpeg image", "ole control", "menu", "dock zone", "delphi", "dcom", "form", "canvas", "nxdomain", "ds nxdomain", "mirai variant", "useragent", "hello", "apache", "world", "inbound", "outbound", "hackingtrio ua", "activity mirai", "http traffic", "malware beacon", "mirai", "exploit", "shell", "aaaa", "as14061", "trojanclicker", "expl", "kr5a head", "abuse", "agent", "virgin islands", "as19905", "expiration date", "organization", "as4134 chinanet", "as4837 china", "type get", "as48447 sectigo", "united kingdom", "content type", "arial", "secure server", "as20940", "as2914 ntt", "as3257 gtt", "as2828 verizon", "general", ".mil", "brian sabey", "brian sabey" ], "references": [ "North American Aerospace Defense Command NORAD", "superanalbizflowforum.com | www.networksolutions.com", "http://superanalbizflowforum.com/tsara-lynn-brashears", "ELF:Mirai-GH\\ [Trj] Trojan:Win32/Cenjonsla.D!bit Trojan:Win32/SmokeLoader TrojanSpy:Win32/Small VirTool:Win32/Injector.gen!BQ", "https://www.virustotal.com/gui/search/engines:trojan%20AND%20engines:dropper%20AND%20engines:razy%20AND%20engines:copak", "ELF:Mirai-GH\\ [Trj] : FileHash-SHA256 866dfa8f3e4f4f26b70fd046fa6dcbc16eea1abc3bfaddb099d675e77ce26942 trojan", "Trojan:Win32/SmokeLoader : FileHash-SHA256 29d85b4c2d52a8bcb081aa40e3d4334a864e988e1fe17933f903b4114be8e56e", "TrojanSpy:Win32/Small : FileHash-SHA256 afec8925c79d6bb948ce08df54753268f63b4cb770456e6b623d9985fb1499cd", "Trojan:Win32/Cenjonsla.D!bit : FileHash-SHA256 8d5fe61f75602c85c9cd196e7accc17e119191655d4ecd56da498663f5a8c92b", "VirTool:Win32/Injector.gen!BQ : FileHash-SHA256 a23846fe9a306c84eb1fb2b6b0b2b3a5fdbd958f747a10ccdb435d97e35de6f9", "Malware Hosting: http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "Malware : http://gomyron.com/MTgzNjk=/2/6433/ronnoagraug/ - Huawei HG532 RCE Vulnerability", "Malware Hosting: 162.43.116.132 | 183.181.98.116", "CVE-2017-17215 - Huawei HG532 RCE Vulnerability / Huawei Remote Command Execution - Outbound / Huawei Remote Command Execution", "CVE-2017-8759 -\t\".NET Framework Remote Code Execution Vulnerability.\" CVE-2018-8453 - \"Win32k Elevation of Privilege Vulnerability.'", "dev.dancerage.com - Unknown\tdev.sportshelves.com\tA\t199.59.242.153| dev.sportshelves.com | www.imarkdev.com \u00d7 45.76.62.78 | ASN AS20473 the constant company llc", "Exploit source: 138.197.103.178", "https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Ransomware: FileHash-SHA256 557f1759be4fdf6b9dff732c8e8aa369f4d7f9fe61a0c462c0dc8d30c2973812" ], "public": 1, "adversary": "IDK", "targeted_countries": [ "Japan", "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/SmokeLoader", "display_name": "Trojan:Win32/SmokeLoader", "target": "/malware/Trojan:Win32/SmokeLoader" }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" }, { "id": "TrojanSpy:Win32/Small", "display_name": "TrojanSpy:Win32/Small", "target": "/malware/TrojanSpy:Win32/Small" }, { "id": "Trojan:Win32/Cenjonsla.D!bit", "display_name": "Trojan:Win32/Cenjonsla.D!bit", "target": "/malware/Trojan:Win32/Cenjonsla.D!bit" }, { "id": "ELF:Mirai-GH\\ [Trj]", "display_name": "ELF:Mirai-GH\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "domain": 1213, "hostname": 773, "FileHash-SHA256": 1513, "FileHash-MD5": 887, "FileHash-SHA1": 729, "CVE": 4, "email": 10, "SSLCertFingerprint": 5 }, "indicator_count": 5601, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "617 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "962 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "TrojanSpy:Win32/Small : FileHash-SHA256 afec8925c79d6bb948ce08df54753268f63b4cb770456e6b623d9985fb1499cd", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "CVE-2017-8759 -\t\".NET Framework Remote Code Execution Vulnerability.\" CVE-2018-8453 - \"Win32k Elevation of Privilege Vulnerability.'", "Malware Hosting: http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "https://www.neurotoxininstitute.com/", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "Ransomware: FileHash-SHA256 557f1759be4fdf6b9dff732c8e8aa369f4d7f9fe61a0c462c0dc8d30c2973812", "North American Aerospace Defense Command NORAD", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5", "http://superanalbizflowforum.com/tsara-lynn-brashears", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "Malware : http://gomyron.com/MTgzNjk=/2/6433/ronnoagraug/ - Huawei HG532 RCE Vulnerability", "dev.dancerage.com - Unknown\tdev.sportshelves.com\tA\t199.59.242.153| dev.sportshelves.com | www.imarkdev.com \u00d7 45.76.62.78 | ASN AS20473 the constant company llc", "Exploit source: 138.197.103.178", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "CVE-2017-17215 - Huawei HG532 RCE Vulnerability / Huawei Remote Command Execution - Outbound / Huawei Remote Command Execution", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "superanalbizflowforum.com | www.networksolutions.com", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "ELF:Mirai-GH\\ [Trj] Trojan:Win32/Cenjonsla.D!bit Trojan:Win32/SmokeLoader TrojanSpy:Win32/Small VirTool:Win32/Injector.gen!BQ", "Trojan:Win32/Cenjonsla.D!bit : FileHash-SHA256 8d5fe61f75602c85c9cd196e7accc17e119191655d4ecd56da498663f5a8c92b", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "ELF:Mirai-GH\\ [Trj] : FileHash-SHA256 866dfa8f3e4f4f26b70fd046fa6dcbc16eea1abc3bfaddb099d675e77ce26942 trojan", "Trojan:Win32/SmokeLoader : FileHash-SHA256 29d85b4c2d52a8bcb081aa40e3d4334a864e988e1fe17933f903b4114be8e56e", "Malware Hosting: 162.43.116.132 | 183.181.98.116", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "http://appelfarm.org", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "Backdoor.Win32.Pushdo.s Checkin", "https://britneyspears.com/", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "Tell your dog I said 'hi'", "VirTool:Win32/Injector.gen!BQ : FileHash-SHA256 a23846fe9a306c84eb1fb2b6b0b2b3a5fdbd958f747a10ccdb435d97e35de6f9", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "https://www.virustotal.com/gui/search/engines:trojan%20AND%20engines:dropper%20AND%20engines:razy%20AND%20engines:copak", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "AutorunMacro.D", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "Interesting Strings : 13.79.87.163", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Lazarus", "IDK" ], "malware_families": [ "Elf:mirai-gh\\ [trj]", "Trojan:win32/cenjonsla.d!bit", "Virus:win32/krepper.30760", "Trojandownloader:win32/cutwail", "Virtool:win32/vbinject.gen!mh", "Win32:zbot-ruv", "Alf:rpf:peattr_sigattr:predict:70", "Suggested", "Et", "Win32:evo-gen", "Win32:kryptik", "Alf:trojandownloader:powershell/ploprolo.db", "Trojan:win32/smokeloader", "Malware-gen\\ [trj]", "Unix.trojan.darknexus-7679166-0", "Virtool:win32/injector.gen!bq", "Sality", "Softcnapp", "Trojan:win32/bulta", "Netherlands", "Alf:heraklezeval:backdoor:linux/mirai.a!rf", "Trojanspy:win32/small", "Mirai" ], "industries": [], "unique_indicators": 70776 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/google-analytics.com", "whois": "http://whois.domaintools.com/google-analytics.com", "domain": "google-analytics.com", "hostname": "www.google-analytics.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "691e2279ac1ef8b9dbfbc2b3", "name": "Mirai \u2022 Neurotox Institute", "description": "Found in peripheral. Lazarus. Related tomOperation Endgame. Strangely related to the entertainment industry. \nRelated to treatments facilities where a target I\u2019ve been researching received \u2018care\u2019. Also links to Major Entertainment conglomerate : not surprisingly Hall Render and Foundry.\nPage was stated to expire 11/21 | expired after I was able to capture a live screenshot (not updated for years) \n\n[The Neurotoxin Institute (NTI) is a multidisciplinary organization created to serve as a comprehensive independent source of information related to the basic science and the clinical applications of neurotoxins. The Institute fosters the learning and teaching of both theory and practical techniques, and encourages further research in support of these goals.\nExperimental Biology (EB)\nwww.aapmr.org]", "modified": "2025-12-19T19:00:18.927000", "created": "2025-11-19T20:03:05.195000", "tags": [ "united", "link", "virtool", "meta", "atom", "pragma", "dynamicloader", "msie", "windows nt", "tls handshake", "failure", "tlsv1", "forbidden", "ogoogle trust", "encrypt", "possible", "write", "malware", "consumed", "netherlands", "united kingdom", "read c", "sality", "delphi", "win32", "strings", "xserver", "post http", "post method", "cryptexportkey", "ocloudflare", "cryptgenkey", "calgrc4", "persistence", "execution", "div div", "script script", "span a", "a li", "unknown ns", "span", "april", "passive dns", "hosting", "reverse dns", "hostname add", "files ip", "asn as32475", "address domain", "mirai", "united states", "facebook", "twitter", "youtube", "ck ids", "mh may", "t1204 technique", "user execution", "suggested", "port", "destination", "telnet login", "high", "tcp syn", "infectednight", "resolverror", "suspicious path", "ids detections", "yara detections", "sinkhole cookie", "file score", "detections sf", "value snkz", "forbidden tls", "et trojan", "value", "et info", "et", "present oct", "domain", "title", "present sep", "moved", "server", "next associated", "ipv4 add", "urls", "files", "trojan", "cookie", "predict70 sep", "next http", "scans record", "forbidden date", "gmt content", "type", "unix", "namecheap url", "forward elf", "md5 add", "less see", "contacted", "pulse pulses", "av detections", "analysis date", "virus", "ee fc", "unknown", "yara rule", "ff d5", "search", "show", "suspicious", "fbq object", "ide value", "source level", "url text", "line", "allow attribute", "mootools", "class function", "chain", "options", "elements", "garbage", "drag", "xhr function", "ajax", "itemid14", "kb image", "kb script", "b image", "b stylesheet", "b script", "kb stylesheet", "stylesheet", "redirect chain", "path size", "type mimetype", "resource", "general full", "montreal", "canada", "asn16276", "debian", "url http", "hash", "main", "cookie object", "dns any", "date", "entries", "url https", "Foundry", "Lazarus", "Endgame", "Neurotoxin Institute", "Hall Render", "Brian Sabey", "UC Health", "Britney Spears Official" ], "references": [ "https://www.neurotoxininstitute.com/", "Backdoor.Win32.Pushdo.s Checkin", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "http://appelfarm.org", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "Interesting Strings : 13.79.87.163", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "https://britneyspears.com/", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/" ], "public": 1, "adversary": "Lazarus", "targeted_countries": [ "United States of America", "Japan", "France", "Germany", "Canada", "Netherlands", "United Kingdom of Great Britain and Northern Ireland", "New Zealand", "Italy", "Aruba", "Poland", "Singapore", "T\u00fcrkiye", "Indonesia", "Spain", "Hong Kong" ], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Netherlands", "display_name": "Netherlands", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null }, { "id": "Virus:Win32/Krepper.30760", "display_name": "Virus:Win32/Krepper.30760", "target": "/malware/Virus:Win32/Krepper.30760" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "target": null }, { "id": "Suggested", "display_name": "Suggested", "target": null }, { "id": "VirTool:Win32/VBInject.gen!MH", "display_name": "VirTool:Win32/VBInject.gen!MH", "target": "/malware/VirTool:Win32/VBInject.gen!MH" }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Softcnapp", "display_name": "Softcnapp", "target": null }, { "id": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "display_name": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "target": null }, { "id": "Win32:Zbot-RUV", "display_name": "Win32:Zbot-RUV", "target": null }, { "id": "Win32:Evo-gen", "display_name": "Win32:Evo-gen", "target": null }, { "id": "Win32:Kryptik", "display_name": "Win32:Kryptik", "target": null }, { "id": "Trojan:Win32/Bulta", "display_name": "Trojan:Win32/Bulta", "target": "/malware/Trojan:Win32/Bulta" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 511, "hostname": 198, "domain": 471, "FileHash-SHA256": 1442, "FileHash-MD5": 183, "FileHash-SHA1": 79, "email": 5, "SSLCertFingerprint": 63 }, "indicator_count": 2952, "is_author": false, "is_subscribing": null, "subscriber_count": 148, "modified_text": "164 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66ca35f7202c88b2bf667c66", "name": "Ploprolo | Unix.Trojan.DarkNexus-7679166-0 | U.S. Department of Defense", "description": "Why not question suspect instead of threaten smear name in all types distasteful content. US DoD auto populated as did all tags. Link found in Adult website documented in court records. Investigate victim? Bryan Counts of upper management in Concentra telling victim Jeffrey Scott Reimer was a professional assaulter, believes there are other victims and he could be a killer. Counts back pedals they kept Reimer employed but from treating females, stating everything checked out. They are very sorry. Asked victim for hacked w'away recordings and told her 'Thank you for not pursuing our therapist.' 'You are no longer able to receive care here. I'm a public figure and I can't have this. My best friend is going to be the Sheriff. Hey yourselves a bunch of lawyers and hide. Surround yourself with people you can trust.' Mark Montano MD.\n@Kailula4 has an emptied graph of same custom Trojan. I have trouble believing it's the actual US Government. If it is, it's very sad.", "modified": "2024-09-23T18:04:30.948000", "created": "2024-08-24T19:35:19.416000", "tags": [ "asn as16625", "akamai", "link", "a domains", "as20940", "aaaa", "meta", "script", "input", "passive dns", "general", "united states", "as2914 ntt", "as721 dod", "as3257 gtt", "domain", "as2828 verizon", "as16625 akamai", "united", "as15169 google", "as44273 host", "search otx", "read c", "create c", "high", "memcommit", "delete", "write c", "module load", "dock", "write", "execution", "sample hash", "Injection", "inject", "analyzer threat", "ip summary", "detection list", "cisco umbrella", "alexa top", "million", "safe site", "cl0p ransomware", "maltiverse safe", "zbot", "malware", "ip address", "secretary", "defense", "defense lloyd", "strong", "support", "value", "joint chiefs", "minister", "ukraine", "service", "live", "honor", "department", "america", "defense og", "defense meta", "joint chief", "military", "government", "trackers", "external_resources", "third_party_cookies", "iframes", "today", "document file", "v2 document", "canada unknown", "canada", "invalid url", "scan endpoints", "all scoreblue", "ipv4", "url analysis", "creation date", "entries", "hostname", "date", "hostnames", "urls http", "mail spammer", "autorunmacro.d", "penalties", "army", "afghanistan", "journal julyaug", "stovl promises", "uas road", "cheers", "way ahead", "mor pdf", "armed forces", "copy", "format", "core", "createdate", "producer gimp", "navy", "title navy", "filehash", "av detections", "ids detections", "nxscspu", "zsextbzusbrvsk", "pxnzj", "jwxkrhdlrivprs", "qxrfnjuodik", "mncau", "csqvrkwsqka", "testpath path", "else", "xszcgdvlhymmww", "exploit", "win64", "null", "suspicious", "hotkey", "yara detections", "alerts", "analysis date", "file score", "brian sabey" ], "references": [ "http://analytics.com/track?id=54 | http://analytics.com/track?id=55", "IP\u2019s Contacted 104.123.122.11 204.79.197.200 | Domains Contacted www.defense.gov www.bing.com", "'http'://www.defense.gov/?date=2019-11-21 | http'://www.defense.gov ?", "Executed Commands: iexplore.exe \"C:\\Program Files (x86)\\Internet Explorer\\iexplore.exe\" http://www.defense.gov/?date=2019-11-21", "https://otx.alienvault.com/otxapi/indicators/file/screenshot/0d34445978515452930712687a2b969955852dbbeb91011b3382e0efc1e4b13a", "AutorunMacro.D", "Yara Detections is__elf , LZMA , ELFHighEntropy , elf_empty_sections", "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process", "@Kailula4 Pulse wiped? https://otx.alienvault.com/pulse/61b8f5afd7c432928006610d", "Prolexic (Parent organization?): Akamai Technologies: prolexicprotected.com | akaetp.net | akamai-trials.com | prolexic.net", "Unknown frontdoor.com A | test.unsubscribe.tapp.dpgmedia.cloud", "Tell your dog I said 'hi'" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "Unix.Trojan.DarkNexus-7679166-0", "display_name": "Unix.Trojan.DarkNexus-7679166-0", "target": null }, { "id": "Malware-gen\\ [Trj]", "display_name": "Malware-gen\\ [Trj]", "target": null }, { "id": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "display_name": "ALF:TrojanDownloader:PowerShell/Ploprolo.DB", "target": null } ], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4572, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 448, "FileHash-MD5": 935, "URL": 267, "domain": 176, "FileHash-SHA256": 1504, "FileHash-SHA1": 616, "email": 3, "CVE": 1 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "616 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66c9bb42dd32d415f9aaa06c", "name": "Botnet exchange | NORAD Tracking | Mirai | Injection | Spyware | Remote executions", "description": "North American Aerospace Defense Command NORAD - http://superanalbizflowforum.com/tsara-lynn-brashears (really?)\nwww.norad.mil , www.northcom.mil, dodcio.defense.gov, www.defense.gov\nwww.dodig.mil, www.foia.gov , prhome.defense.gov\n, www.ourmilitary.com, www.noradsanta.org , www.web.dma.mil \nIt's hard to tell or believe military and DoD conduct business this way. I tend to think scam abuse. Exception: target, escorted by security to appt in a DHS secured b,dg. She was then told to leave after receptionist received a call stating target was a threat. Entire floor was secured off. TB beyond upset w/ my carelessness of veteran & other comments. Targets Father, brother uncles, cousins, all served honorably w/some now terminally affected &mothers passed on from Camp Lejeune related complications. Father, an engineer & veteran worked on AEGIS weapons system test team for 3 now potentially decommissioned military Destroyers. \nI apologize prefusly for comment, MIL involvement was prevalent; it remains cloudy.", "modified": "2024-09-23T09:03:54.724000", "created": "2024-08-24T10:51:46.907000", "tags": [ "server", "whois lookup", "domain name", "llc sponsoring", "registrar iana", "referral url", "tsara brashears", "referrer", "porn", "networks", "botnet campaign", "pyinstaller", "apple", "password", "cybercrime", "it consultant", "metro", "skynet", "analyzer paste", "iocs", "hostnames", "urls http", "cyber threat", "cnc server", "ibm xforce", "exchange", "covid19", "tracker", "exchange botnet", "command", "control server", "keybase", "citadel", "stealer", "zeus", "radamant", "kovter", "zbot", "suppobox", "simda", "virut", "kraken", "amonetize", "msil", "phishing", "malicious", "feodo", "united", "germany unknown", "as133775 xiamen", "unknown", "china unknown", "passive dns", "domain", "search", "cisco umbrella", "site", "alexa top", "million", "safe site", "malware site", "malicious site", "malware", "malicious url", "files domain", "files related", "related tags", "none md5", "as35908 krypt", "status hostname", "query type", "address first", "seen last", "seen asn", "country unknown", "status", "record value", "all scoreblue", "meta", "trend today", "link", "japan unknown", "script urls", "script script", "name servers", "script domains", "accept", "encrypt", "gmt content", "gmt etag", "ipv4", "url analysis", "pragma", "scan endpoints", "pulse submit", "urls", "body", "date", "hostname", "pulse pulses", "react app", "verizon feed", "bq aug", "typeof e", "object", "wds socket", "error", "path max", "path", "cookie", "suspicious", "virtool", "info", "trace", "moved", "aaaa nxdomain", "files", "a domains", "as9371 sakura", "service", "servers", "xml title", "dnssec", "showing", "next", "xserver", "title", "file", "type texthtml", "sha256", "read c", "write c", "kryptik", "tls sni", "style ssl", "cert", "amazon profile", "show", "cobaltstrike", "trojan", "copy", "write", "win32", "persistence", "execution", "media", "autorun", "delete c", "trojanspy", "entries", "bytes", "jpeg image", "ole control", "menu", "dock zone", "delphi", "dcom", "form", "canvas", "nxdomain", "ds nxdomain", "mirai variant", "useragent", "hello", "apache", "world", "inbound", "outbound", "hackingtrio ua", "activity mirai", "http traffic", "malware beacon", "mirai", "exploit", "shell", "aaaa", "as14061", "trojanclicker", "expl", "kr5a head", "abuse", "agent", "virgin islands", "as19905", "expiration date", "organization", "as4134 chinanet", "as4837 china", "type get", "as48447 sectigo", "united kingdom", "content type", "arial", "secure server", "as20940", "as2914 ntt", "as3257 gtt", "as2828 verizon", "general", ".mil", "brian sabey", "brian sabey" ], "references": [ "North American Aerospace Defense Command NORAD", "superanalbizflowforum.com | www.networksolutions.com", "http://superanalbizflowforum.com/tsara-lynn-brashears", "ELF:Mirai-GH\\ [Trj] Trojan:Win32/Cenjonsla.D!bit Trojan:Win32/SmokeLoader TrojanSpy:Win32/Small VirTool:Win32/Injector.gen!BQ", "https://www.virustotal.com/gui/search/engines:trojan%20AND%20engines:dropper%20AND%20engines:razy%20AND%20engines:copak", "ELF:Mirai-GH\\ [Trj] : FileHash-SHA256 866dfa8f3e4f4f26b70fd046fa6dcbc16eea1abc3bfaddb099d675e77ce26942 trojan", "Trojan:Win32/SmokeLoader : FileHash-SHA256 29d85b4c2d52a8bcb081aa40e3d4334a864e988e1fe17933f903b4114be8e56e", "TrojanSpy:Win32/Small : FileHash-SHA256 afec8925c79d6bb948ce08df54753268f63b4cb770456e6b623d9985fb1499cd", "Trojan:Win32/Cenjonsla.D!bit : FileHash-SHA256 8d5fe61f75602c85c9cd196e7accc17e119191655d4ecd56da498663f5a8c92b", "VirTool:Win32/Injector.gen!BQ : FileHash-SHA256 a23846fe9a306c84eb1fb2b6b0b2b3a5fdbd958f747a10ccdb435d97e35de6f9", "Malware Hosting: http://virii.es/U/Using%20Entropy%20Analysis%20to%20Find%20Encrypted%20and%20Packed%20Malware.pdf", "Malware : http://gomyron.com/MTgzNjk=/2/6433/ronnoagraug/ - Huawei HG532 RCE Vulnerability", "Malware Hosting: 162.43.116.132 | 183.181.98.116", "CVE-2017-17215 - Huawei HG532 RCE Vulnerability / Huawei Remote Command Execution - Outbound / Huawei Remote Command Execution", "CVE-2017-8759 -\t\".NET Framework Remote Code Execution Vulnerability.\" CVE-2018-8453 - \"Win32k Elevation of Privilege Vulnerability.'", "dev.dancerage.com - Unknown\tdev.sportshelves.com\tA\t199.59.242.153| dev.sportshelves.com | www.imarkdev.com \u00d7 45.76.62.78 | ASN AS20473 the constant company llc", "Exploit source: 138.197.103.178", "https://www.sweetheartvideo.com/tsara-brashears/ | www.sweetheartvideo.com", "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian", "Ransomware: FileHash-SHA256 557f1759be4fdf6b9dff732c8e8aa369f4d7f9fe61a0c462c0dc8d30c2973812" ], "public": 1, "adversary": "IDK", "targeted_countries": [ "Japan", "United States of America" ], "malware_families": [ { "id": "Trojan:Win32/SmokeLoader", "display_name": "Trojan:Win32/SmokeLoader", "target": "/malware/Trojan:Win32/SmokeLoader" }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" }, { "id": "TrojanSpy:Win32/Small", "display_name": "TrojanSpy:Win32/Small", "target": "/malware/TrojanSpy:Win32/Small" }, { "id": "Trojan:Win32/Cenjonsla.D!bit", "display_name": "Trojan:Win32/Cenjonsla.D!bit", "target": "/malware/Trojan:Win32/Cenjonsla.D!bit" }, { "id": "ELF:Mirai-GH\\ [Trj]", "display_name": "ELF:Mirai-GH\\ [Trj]", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 467, "domain": 1213, "hostname": 773, "FileHash-SHA256": 1513, "FileHash-MD5": 887, "FileHash-SHA1": 729, "CVE": 4, "email": 10, "SSLCertFingerprint": 5 }, "indicator_count": 5601, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "617 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "962 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.google-analytics.com/ga.js", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.google-analytics.com/ga.js", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780414222.283701 }