{ "type": "URL", "indicator": "https://www.googleapis.com/auth/drive.apps", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.googleapis.com/auth/drive.apps", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #5790", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain googleapis.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain googleapis.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3742605162, "indicator": "https://www.googleapis.com/auth/drive.apps", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "69f99f0b14707306f5cb7a96", "name": "KidsProtect - A Near-Total Surveillance Toolkit", "description": "Stalkerware developers are facing increasing legal pressure, with several high-profile platforms shut down by court order in recent years.\n\nCerto has discovered a new Android surveillance tool being openly advertised on the clear web that gives an operator near-total secret control of a victim\u2019s phone. It can\u2019t be removed without the attacker\u2019s permission. And for a fee, anyone can buy it, brand it, and start selling it as their own.\n\nThe tool, branded KidsProtect, is an Android Remote Access Trojan (RAT) that, once installed on a target device, operates entirely in the background without the owner\u2019s knowledge.\nFrom a web-based dashboard, an operator can secretly record calls, stream live audio from the device\u2019s microphone, track GPS location in real time, read SMS messages and notifications from apps including WhatsApp and Viber, log keystrokes, access contacts and photos, and remotely trigger the front and rear cameras.", "modified": "2026-05-05T07:40:59.536000", "created": "2026-05-05T07:40:59.536000", "tags": [ "capture", "kidsprotect", "android", "certo", "gps location", "whatsapp", "viber", "wifiservice", "protect", "remote access", "trojan", "parental", "stealth", "stream", "telegram", "service installer", "classes2.dex", "dalvik dex", "android", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "low risk", "open th", "virustotal api", "comments", "iocs", "data upload", "extraction", "se boypes" ], "references": [ "The New Hacking Tool That Lets Anyone Launch Their Own Spyware Company | Article By Sophia Taylor a Senior Cybersecurity Writer at Certo", "https://www.certosoftware.com/insights/the-new-hacking-tool-that-lets-anyone-launch-their-own-spyware-company/", "Android Permissions Below:", "ACCESS_BACKGROUND_LOCATION, RECORD_AUDIO, CAMERA,", "PROCESS_OUTGOING_CALLS, READ_CONTACTS, PACKAGE_USAGE_STATS,", "MANAGE_EXTERNAL_STORAGE READ_SMS, READ_CALL_LOG,", "The app\u2019s package name \u2014 com.example.parentguard", "App requests SYSTEM_ALERT_WINDOW and REQUEST_IGNORE_BATTERY_OPTIMIZATIONS permissions", "A BootReceiver component ensures the spyware restarts automatically every time the device is rebooted.", "com.example.parentguard", "The software is sold on a subscription basis starting from $60.", "Sophia Taylor a Senior Cybersecurity Writer at Certo, digital security, privacy, and emerging threats expert .", "Additional research by Q.Vashti" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "ALF:AndroidOSSuspiciousPerms.A", "display_name": "ALF:AndroidOSSuspiciousPerms.A", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 5, "URL": 49, "domain": 3, "hostname": 5, "email": 1 }, "indicator_count": 73, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a464c07b076a6022abbe", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-12-06T16:42:12.952000", "created": "2023-12-06T16:42:12.952000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0c0b966ec5b823d2ae7", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer", "description": "", "modified": "2023-12-06T16:26:40.335000", "created": "2023-12-06T16:26:40.335000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05bc6152413ed0fdbaa", "name": "Social Engineering -Striven Anonymizer", "description": "", "modified": "2023-12-06T16:24:59.615000", "created": "2023-12-06T16:24:59.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e26c454e86439fd9462541", "name": "Social Engineering -Striven Anonymizer", "description": "Optin Example: Affected (device w/vulnerabilities or in BotNetwork, etc) clocks on a ' Sponsored Ad' that fits search query. Will view webpage and Optin to be contacted by email and/or telephone. Both methods will likely be required by attacker. Bad actor will call immediately, quality of call can be surprisingly poor (obnoxiously noisy), BA takes assessment, quotes prices much higher than should be. You are desperate because no one else can help. Actor will demand email, will send various attachments, all malicious. Will not look suspicious, (strategy, video introduction, proposal, etc). Once you don't respond you may receive email contact from different email, more attachments. Follow ups...by now bad actor has full use of device. Spyware. Apps auto download, blocked from removal. Incredible cycle.\n\n\nLogin.aspx192.118.8.10 = 192.118.8.10\niphones.orange.co.il\nhttps://www.partner.co.il/n/login?utm_source=sm", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-20T19:40:53.299000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e7c73087130803d20066ef", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer ", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-24T21:10:08.493000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6500a47dd316d0ea5616044d", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-09-12T17:48:45.349000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "MANAGE_EXTERNAL_STORAGE READ_SMS, READ_CALL_LOG,", "The app\u2019s package name \u2014 com.example.parentguard", "Sophia Taylor a Senior Cybersecurity Writer at Certo, digital security, privacy, and emerging threats expert .", "PROCESS_OUTGOING_CALLS, READ_CONTACTS, PACKAGE_USAGE_STATS,", "ACCESS_BACKGROUND_LOCATION, RECORD_AUDIO, CAMERA,", "A BootReceiver component ensures the spyware restarts automatically every time the device is rebooted.", "The software is sold on a subscription basis starting from $60.", "App requests SYSTEM_ALERT_WINDOW and REQUEST_IGNORE_BATTERY_OPTIMIZATIONS permissions", "https://www.certosoftware.com/insights/the-new-hacking-tool-that-lets-anyone-launch-their-own-spyware-company/", "com.example.parentguard", "https://login.striven.com/Security/Login.aspx192.118.8.10", "The New Hacking Tool That Lets Anyone Launch Their Own Spyware Company | Article By Sophia Taylor a Senior Cybersecurity Writer at Certo", "Additional research by Q.Vashti", "MilesIT", "Android Permissions Below:" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Striven" ], "malware_families": [ "Alf:monitoringtool:androidos/finspy", "Remote access", "Alf:androidossuspiciousperms.a", "Black basta (elf)" ], "industries": [ "Cyber security" ], "unique_indicators": 1230 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/googleapis.com", "whois": "http://whois.domaintools.com/googleapis.com", "domain": "googleapis.com", "hostname": "www.googleapis.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "69f99f0b14707306f5cb7a96", "name": "KidsProtect - A Near-Total Surveillance Toolkit", "description": "Stalkerware developers are facing increasing legal pressure, with several high-profile platforms shut down by court order in recent years.\n\nCerto has discovered a new Android surveillance tool being openly advertised on the clear web that gives an operator near-total secret control of a victim\u2019s phone. It can\u2019t be removed without the attacker\u2019s permission. And for a fee, anyone can buy it, brand it, and start selling it as their own.\n\nThe tool, branded KidsProtect, is an Android Remote Access Trojan (RAT) that, once installed on a target device, operates entirely in the background without the owner\u2019s knowledge.\nFrom a web-based dashboard, an operator can secretly record calls, stream live audio from the device\u2019s microphone, track GPS location in real time, read SMS messages and notifications from apps including WhatsApp and Viber, log keystrokes, access contacts and photos, and remotely trigger the front and rear cameras.", "modified": "2026-05-05T07:40:59.536000", "created": "2026-05-05T07:40:59.536000", "tags": [ "capture", "kidsprotect", "android", "certo", "gps location", "whatsapp", "viber", "wifiservice", "protect", "remote access", "trojan", "parental", "stealth", "stream", "telegram", "service installer", "classes2.dex", "dalvik dex", "android", "yara detections", "filehash", "av detections", "ids detections", "alerts", "analysis date", "file score", "low risk", "open th", "virustotal api", "comments", "iocs", "data upload", "extraction", "se boypes" ], "references": [ "The New Hacking Tool That Lets Anyone Launch Their Own Spyware Company | Article By Sophia Taylor a Senior Cybersecurity Writer at Certo", "https://www.certosoftware.com/insights/the-new-hacking-tool-that-lets-anyone-launch-their-own-spyware-company/", "Android Permissions Below:", "ACCESS_BACKGROUND_LOCATION, RECORD_AUDIO, CAMERA,", "PROCESS_OUTGOING_CALLS, READ_CONTACTS, PACKAGE_USAGE_STATS,", "MANAGE_EXTERNAL_STORAGE READ_SMS, READ_CALL_LOG,", "The app\u2019s package name \u2014 com.example.parentguard", "App requests SYSTEM_ALERT_WINDOW and REQUEST_IGNORE_BATTERY_OPTIMIZATIONS permissions", "A BootReceiver component ensures the spyware restarts automatically every time the device is rebooted.", "com.example.parentguard", "The software is sold on a subscription basis starting from $60.", "Sophia Taylor a Senior Cybersecurity Writer at Certo, digital security, privacy, and emerging threats expert .", "Additional research by Q.Vashti" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Remote Access", "display_name": "Remote Access", "target": null }, { "id": "ALF:AndroidOSSuspiciousPerms.A", "display_name": "ALF:AndroidOSSuspiciousPerms.A", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 5, "URL": 49, "domain": 3, "hostname": 5, "email": 1 }, "indicator_count": 73, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a464c07b076a6022abbe", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-12-06T16:42:12.952000", "created": "2023-12-06T16:42:12.952000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0c0b966ec5b823d2ae7", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer", "description": "", "modified": "2023-12-06T16:26:40.335000", "created": "2023-12-06T16:26:40.335000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05bc6152413ed0fdbaa", "name": "Social Engineering -Striven Anonymizer", "description": "", "modified": "2023-12-06T16:24:59.615000", "created": "2023-12-06T16:24:59.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e26c454e86439fd9462541", "name": "Social Engineering -Striven Anonymizer", "description": "Optin Example: Affected (device w/vulnerabilities or in BotNetwork, etc) clocks on a ' Sponsored Ad' that fits search query. Will view webpage and Optin to be contacted by email and/or telephone. Both methods will likely be required by attacker. Bad actor will call immediately, quality of call can be surprisingly poor (obnoxiously noisy), BA takes assessment, quotes prices much higher than should be. You are desperate because no one else can help. Actor will demand email, will send various attachments, all malicious. Will not look suspicious, (strategy, video introduction, proposal, etc). Once you don't respond you may receive email contact from different email, more attachments. Follow ups...by now bad actor has full use of device. Spyware. Apps auto download, blocked from removal. Incredible cycle.\n\n\nLogin.aspx192.118.8.10 = 192.118.8.10\niphones.orange.co.il\nhttps://www.partner.co.il/n/login?utm_source=sm", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-20T19:40:53.299000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e7c73087130803d20066ef", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer ", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-24T21:10:08.493000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6500a47dd316d0ea5616044d", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-09-12T17:48:45.349000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.googleapis.com/auth/drive.apps", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.googleapis.com/auth/drive.apps", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780211877.4649534 }