{ "type": "URL", "indicator": "https://www.nandos.com.au/gift", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.nandos.com.au/gift", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3532076514, "indicator": "https://www.nandos.com.au/gift", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6585b183175afafb5e3bfff5", "name": "Potential Poodle Attack against a server | Injection | Threat Network", "description": "", "modified": "2024-01-21T15:01:52.390000", "created": "2023-12-22T15:55:47.977000", "tags": [ "whois record", "ssl certificate", "threat roundup", "december", "whois whois", "historical ssl", "referrer", "problems", "november", "tsara brashears", "startpage", "core", "hacktool", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "no data", "tag count", "ioc search", "new ioc", "teams api", "contact", "search", "iocs", "sample summary", "as54113", "united", "xamzexpires300", "unknown", "a domains", "passive dns", "entries", "github pages", "request id", "sea x", "virtool", "accept", "cache", "hit x", "date hash", "avast avg", "files show", "execution", "contacted", "threat analyzer", "threat", "paste", "hostnames", "urls http", "noname057", "generic malware", "threat report", "ip summary", "url summary", "summary", "generic", "inject", "!#AddsCopyToStartup", "SLF:Exploit:Win32/UACPathBypass.A", "SSL excessive fatal alerts (possible POODLE attack against serve", "injector", "185.199.108.133", "malware infection", "link", "name servers", "date", "title", "urls", "domain robot", "for privacy", "redacted for", "expiration date", "emotet", "upx", "msil", "trojan", "malware", "apple", "data collection", "privilege escalation", "evasive", "show", "scan endpoints", "all octoseek", "filehash", "pulse pulses", "av detections", "ids detections", "yara detections", "copy", "threat network", "service modification", "target", "targeting an individual", "cybercrime", "fraud services", "attack", "africa", "libel", "password cracker", "ios" ], "references": [ "frostwire-5.3.9.windows.exe", "185.199.108.133", "cdn-185-199-108-133.github.com", "AS : AS16509 Amazon.com, Inc", "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe", "IP : 54.192.29.164", "https://otx.alienvault.com/indicator/ip/185.199.108.133", "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133", "YARA Rules", "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs", "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs", "Matches rule UPX from ruleset UPX by kevoreilly", "REFERENCE: https://goo.gl/hXbwiV", "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command", "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]", "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]", "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]", "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]", "www.anyxxxtube.net", "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]", "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]", "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]", "103.246.145.111 [malware]", "x.ss2.us", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Magic", "display_name": "Magic", "target": null }, { "id": "Multios.Coinminer.Miner-6781728-2", "display_name": "Multios.Coinminer.Miner-6781728-2", "target": null }, { "id": "Win32/Ispen BADNEWS Fake User-Agent", "display_name": "Win32/Ispen BADNEWS Fake User-Agent", "target": null }, { "id": "Babulya/CollectorStealer User-Agent", "display_name": "Babulya/CollectorStealer User-Agent", "target": null }, { "id": "Win.Malware.Generic-9820446-0", "display_name": "Win.Malware.Generic-9820446-0", "target": null }, { "id": "Worm:Win32/AutoRun!atmn", "display_name": "Worm:Win32/AutoRun!atmn", "target": "/malware/Worm:Win32/AutoRun!atmn" }, { "id": "VirTool:MSIL/Obfuscator.BV", "display_name": "VirTool:MSIL/Obfuscator.BV", "target": "/malware/VirTool:MSIL/Obfuscator.BV" }, { "id": "Win.Trojan.Emotet-9850453-0", "display_name": "Win.Trojan.Emotet-9850453-0", "target": null }, { "id": "ALF:HSTR:HackTool:ExtremeInjector.S01", "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "target": null }, { "id": "!#HSTR:Win32/Spectorsoft", "display_name": "!#HSTR:Win32/Spectorsoft", "target": "/malware/!#HSTR:Win32/Spectorsoft" }, { "id": "ALF:Base64EncodeFunctionMonitorW", "display_name": "ALF:Base64EncodeFunctionMonitorW", "target": null }, { "id": "185.199.108.133.Malware_Host", "display_name": "185.199.108.133.Malware_Host", "target": null }, { "id": "adware.opencandy", "display_name": "adware.opencandy", "target": null }, { "id": "Malvertizing", "display_name": "Malvertizing", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1872, "FileHash-SHA1": 1140, "FileHash-SHA256": 2367, "URL": 1969, "domain": 327, "hostname": 1025, "email": 1 }, "indicator_count": 8701, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6585b18d61efd8798827c12a", "name": "Potential Poodle Attack against a server | Injection | Threat Network", "description": "", "modified": "2024-01-21T15:01:52.390000", "created": "2023-12-22T15:55:57.639000", "tags": [ "whois record", "ssl certificate", "threat roundup", "december", "whois whois", "historical ssl", "referrer", "problems", "november", "tsara brashears", "startpage", "core", "hacktool", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "no data", "tag count", "ioc search", "new ioc", "teams api", "contact", "search", "iocs", "sample summary", "as54113", "united", "xamzexpires300", "unknown", "a domains", "passive dns", "entries", "github pages", "request id", "sea x", "virtool", "accept", "cache", "hit x", "date hash", "avast avg", "files show", "execution", "contacted", "threat analyzer", "threat", "paste", "hostnames", "urls http", "noname057", "generic malware", "threat report", "ip summary", "url summary", "summary", "generic", "inject", "!#AddsCopyToStartup", "SLF:Exploit:Win32/UACPathBypass.A", "SSL excessive fatal alerts (possible POODLE attack against serve", "injector", "185.199.108.133", "malware infection", "link", "name servers", "date", "title", "urls", "domain robot", "for privacy", "redacted for", "expiration date", "emotet", "upx", "msil", "trojan", "malware", "apple", "data collection", "privilege escalation", "evasive", "show", "scan endpoints", "all octoseek", "filehash", "pulse pulses", "av detections", "ids detections", "yara detections", "copy", "threat network", "service modification", "target", "targeting an individual", "cybercrime", "fraud services", "attack", "africa", "libel", "password cracker", "ios" ], "references": [ "frostwire-5.3.9.windows.exe", "185.199.108.133", "cdn-185-199-108-133.github.com", "AS : AS16509 Amazon.com, Inc", "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe", "IP : 54.192.29.164", "https://otx.alienvault.com/indicator/ip/185.199.108.133", "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133", "YARA Rules", "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs", "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs", "Matches rule UPX from ruleset UPX by kevoreilly", "REFERENCE: https://goo.gl/hXbwiV", "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command", "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]", "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]", "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]", "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]", "www.anyxxxtube.net", "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]", "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]", "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]", "103.246.145.111 [malware]", "x.ss2.us", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Magic", "display_name": "Magic", "target": null }, { "id": "Multios.Coinminer.Miner-6781728-2", "display_name": "Multios.Coinminer.Miner-6781728-2", "target": null }, { "id": "Win32/Ispen BADNEWS Fake User-Agent", "display_name": "Win32/Ispen BADNEWS Fake User-Agent", "target": null }, { "id": "Babulya/CollectorStealer User-Agent", "display_name": "Babulya/CollectorStealer User-Agent", "target": null }, { "id": "Win.Malware.Generic-9820446-0", "display_name": "Win.Malware.Generic-9820446-0", "target": null }, { "id": "Worm:Win32/AutoRun!atmn", "display_name": "Worm:Win32/AutoRun!atmn", "target": "/malware/Worm:Win32/AutoRun!atmn" }, { "id": "VirTool:MSIL/Obfuscator.BV", "display_name": "VirTool:MSIL/Obfuscator.BV", "target": "/malware/VirTool:MSIL/Obfuscator.BV" }, { "id": "Win.Trojan.Emotet-9850453-0", "display_name": "Win.Trojan.Emotet-9850453-0", "target": null }, { "id": "ALF:HSTR:HackTool:ExtremeInjector.S01", "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "target": null }, { "id": "!#HSTR:Win32/Spectorsoft", "display_name": "!#HSTR:Win32/Spectorsoft", "target": "/malware/!#HSTR:Win32/Spectorsoft" }, { "id": "ALF:Base64EncodeFunctionMonitorW", "display_name": "ALF:Base64EncodeFunctionMonitorW", "target": null }, { "id": "185.199.108.133.Malware_Host", "display_name": "185.199.108.133.Malware_Host", "target": null }, { "id": "adware.opencandy", "display_name": "adware.opencandy", "target": null }, { "id": "Malvertizing", "display_name": "Malvertizing", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1872, "FileHash-SHA1": 1140, "FileHash-SHA256": 2367, "URL": 1969, "domain": 327, "hostname": 1025, "email": 1 }, "indicator_count": 8701, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709127d115350fd0249f37", "name": "https://news.line.me/detail/oa-sankeinews/1iawg1xp7wp9'", "description": "", "modified": "2023-12-06T15:20:07.034000", "created": "2023-12-06T15:20:07.034000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 332, "hostname": 39, "URL": 133, "domain": 36, "FileHash-MD5": 46, "FileHash-SHA1": 45, "CVE": 1 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f04876a2fd4fca1305fe17", "name": "https://news.line.me/detail/oa-sankeinews/1iawg1xp7wp9'", "description": "", "modified": "2022-09-07T00:04:00.988000", "created": "2022-08-07T23:19:18.616000", "tags": [ "apt", "runtime data", "ansi", "threat level", "runtime process", "pcap", "august", "local", "CVE-2021-22941" ], "references": [ "https://hybrid-analysis.com/sample/aebca17ee5731a445d503739077d416a4b9c7389548d3efe361a24d14342abdd/62f04031f60007490c314f44", "CVE-2021-22941" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 133, "hostname": 39, "domain": 36, "FileHash-SHA256": 332, "CVE": 1, "FileHash-MD5": 46, "FileHash-SHA1": 45 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1362 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "IP : 54.192.29.164", "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs", "x.ss2.us", "103.246.145.111 [malware]", "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]", "https://otx.alienvault.com/indicator/ip/185.199.108.133", "CVE-2021-22941", "AS : AS16509 Amazon.com, Inc", "185.199.108.133", "Matches rule UPX from ruleset UPX by kevoreilly", "https://hybrid-analysis.com/sample/aebca17ee5731a445d503739077d416a4b9c7389548d3efe361a24d14342abdd/62f04031f60007490c314f44", "frostwire-5.3.9.windows.exe", "www.anyxxxtube.net", "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]", "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command", "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]", "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/", "nr-data.net [Apple Private Data Collection]", "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]", "cdn-185-199-108-133.github.com", "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs", "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133", "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe", "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]", "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]", "REFERENCE: https://goo.gl/hXbwiV", "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]", "YARA Rules" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Multios.coinminer.miner-6781728-2", "Malvertizing", "Hacktool", "Worm:win32/autorun!atmn", "Emotet", "Virtool", "Magic", "!#hstr:win32/spectorsoft", "Alf:hstr:hacktool:extremeinjector.s01", "Win32/ispen badnews fake user-agent", "Babulya/collectorstealer user-agent", "Win.trojan.emotet-9850453-0", "Win.malware.generic-9820446-0", "Virtool:msil/obfuscator.bv", "Alf:heraklezeval:trojan:win32/agenttesla!rfn", "Alf:base64encodefunctionmonitorw", "185.199.108.133.malware_host", "Adware.opencandy", "Generic" ], "industries": [], "unique_indicators": 9454 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/nandos.com.au", "whois": "http://whois.domaintools.com/nandos.com.au", "domain": "nandos.com.au", "hostname": "www.nandos.com.au" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6585b183175afafb5e3bfff5", "name": "Potential Poodle Attack against a server | Injection | Threat Network", "description": "", "modified": "2024-01-21T15:01:52.390000", "created": "2023-12-22T15:55:47.977000", "tags": [ "whois record", "ssl certificate", "threat roundup", "december", "whois whois", "historical ssl", "referrer", "problems", "november", "tsara brashears", "startpage", "core", "hacktool", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "no data", "tag count", "ioc search", "new ioc", "teams api", "contact", "search", "iocs", "sample summary", "as54113", "united", "xamzexpires300", "unknown", "a domains", "passive dns", "entries", "github pages", "request id", "sea x", "virtool", "accept", "cache", "hit x", "date hash", "avast avg", "files show", "execution", "contacted", "threat analyzer", "threat", "paste", "hostnames", "urls http", "noname057", "generic malware", "threat report", "ip summary", "url summary", "summary", "generic", "inject", "!#AddsCopyToStartup", "SLF:Exploit:Win32/UACPathBypass.A", "SSL excessive fatal alerts (possible POODLE attack against serve", "injector", "185.199.108.133", "malware infection", "link", "name servers", "date", "title", "urls", "domain robot", "for privacy", "redacted for", "expiration date", "emotet", "upx", "msil", "trojan", "malware", "apple", "data collection", "privilege escalation", "evasive", "show", "scan endpoints", "all octoseek", "filehash", "pulse pulses", "av detections", "ids detections", "yara detections", "copy", "threat network", "service modification", "target", "targeting an individual", "cybercrime", "fraud services", "attack", "africa", "libel", "password cracker", "ios" ], "references": [ "frostwire-5.3.9.windows.exe", "185.199.108.133", "cdn-185-199-108-133.github.com", "AS : AS16509 Amazon.com, Inc", "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe", "IP : 54.192.29.164", "https://otx.alienvault.com/indicator/ip/185.199.108.133", "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133", "YARA Rules", "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs", "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs", "Matches rule UPX from ruleset UPX by kevoreilly", "REFERENCE: https://goo.gl/hXbwiV", "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command", "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]", "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]", "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]", "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]", "www.anyxxxtube.net", "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]", "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]", "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]", "103.246.145.111 [malware]", "x.ss2.us", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Magic", "display_name": "Magic", "target": null }, { "id": "Multios.Coinminer.Miner-6781728-2", "display_name": "Multios.Coinminer.Miner-6781728-2", "target": null }, { "id": "Win32/Ispen BADNEWS Fake User-Agent", "display_name": "Win32/Ispen BADNEWS Fake User-Agent", "target": null }, { "id": "Babulya/CollectorStealer User-Agent", "display_name": "Babulya/CollectorStealer User-Agent", "target": null }, { "id": "Win.Malware.Generic-9820446-0", "display_name": "Win.Malware.Generic-9820446-0", "target": null }, { "id": "Worm:Win32/AutoRun!atmn", "display_name": "Worm:Win32/AutoRun!atmn", "target": "/malware/Worm:Win32/AutoRun!atmn" }, { "id": "VirTool:MSIL/Obfuscator.BV", "display_name": "VirTool:MSIL/Obfuscator.BV", "target": "/malware/VirTool:MSIL/Obfuscator.BV" }, { "id": "Win.Trojan.Emotet-9850453-0", "display_name": "Win.Trojan.Emotet-9850453-0", "target": null }, { "id": "ALF:HSTR:HackTool:ExtremeInjector.S01", "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "target": null }, { "id": "!#HSTR:Win32/Spectorsoft", "display_name": "!#HSTR:Win32/Spectorsoft", "target": "/malware/!#HSTR:Win32/Spectorsoft" }, { "id": "ALF:Base64EncodeFunctionMonitorW", "display_name": "ALF:Base64EncodeFunctionMonitorW", "target": null }, { "id": "185.199.108.133.Malware_Host", "display_name": "185.199.108.133.Malware_Host", "target": null }, { "id": "adware.opencandy", "display_name": "adware.opencandy", "target": null }, { "id": "Malvertizing", "display_name": "Malvertizing", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1872, "FileHash-SHA1": 1140, "FileHash-SHA256": 2367, "URL": 1969, "domain": 327, "hostname": 1025, "email": 1 }, "indicator_count": 8701, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6585b18d61efd8798827c12a", "name": "Potential Poodle Attack against a server | Injection | Threat Network", "description": "", "modified": "2024-01-21T15:01:52.390000", "created": "2023-12-22T15:55:57.639000", "tags": [ "whois record", "ssl certificate", "threat roundup", "december", "whois whois", "historical ssl", "referrer", "problems", "november", "tsara brashears", "startpage", "core", "hacktool", "vhash", "authentihash", "imphash", "rich pe", "ssdeep", "file type", "win32 dll", "magic pe32", "intel", "ms windows", "compiler", "no data", "tag count", "ioc search", "new ioc", "teams api", "contact", "search", "iocs", "sample summary", "as54113", "united", "xamzexpires300", "unknown", "a domains", "passive dns", "entries", "github pages", "request id", "sea x", "virtool", "accept", "cache", "hit x", "date hash", "avast avg", "files show", "execution", "contacted", "threat analyzer", "threat", "paste", "hostnames", "urls http", "noname057", "generic malware", "threat report", "ip summary", "url summary", "summary", "generic", "inject", "!#AddsCopyToStartup", "SLF:Exploit:Win32/UACPathBypass.A", "SSL excessive fatal alerts (possible POODLE attack against serve", "injector", "185.199.108.133", "malware infection", "link", "name servers", "date", "title", "urls", "domain robot", "for privacy", "redacted for", "expiration date", "emotet", "upx", "msil", "trojan", "malware", "apple", "data collection", "privilege escalation", "evasive", "show", "scan endpoints", "all octoseek", "filehash", "pulse pulses", "av detections", "ids detections", "yara detections", "copy", "threat network", "service modification", "target", "targeting an individual", "cybercrime", "fraud services", "attack", "africa", "libel", "password cracker", "ios" ], "references": [ "frostwire-5.3.9.windows.exe", "185.199.108.133", "cdn-185-199-108-133.github.com", "AS : AS16509 Amazon.com, Inc", "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe", "IP : 54.192.29.164", "https://otx.alienvault.com/indicator/ip/185.199.108.133", "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133", "YARA Rules", "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs", "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs", "Matches rule UPX from ruleset UPX by kevoreilly", "REFERENCE: https://goo.gl/hXbwiV", "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command", "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]", "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]", "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]", "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]", "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]", "www.anyxxxtube.net", "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]", "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]", "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]", "103.246.145.111 [malware]", "x.ss2.us", "nr-data.net [Apple Private Data Collection]" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "HackTool", "display_name": "HackTool", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Magic", "display_name": "Magic", "target": null }, { "id": "Multios.Coinminer.Miner-6781728-2", "display_name": "Multios.Coinminer.Miner-6781728-2", "target": null }, { "id": "Win32/Ispen BADNEWS Fake User-Agent", "display_name": "Win32/Ispen BADNEWS Fake User-Agent", "target": null }, { "id": "Babulya/CollectorStealer User-Agent", "display_name": "Babulya/CollectorStealer User-Agent", "target": null }, { "id": "Win.Malware.Generic-9820446-0", "display_name": "Win.Malware.Generic-9820446-0", "target": null }, { "id": "Worm:Win32/AutoRun!atmn", "display_name": "Worm:Win32/AutoRun!atmn", "target": "/malware/Worm:Win32/AutoRun!atmn" }, { "id": "VirTool:MSIL/Obfuscator.BV", "display_name": "VirTool:MSIL/Obfuscator.BV", "target": "/malware/VirTool:MSIL/Obfuscator.BV" }, { "id": "Win.Trojan.Emotet-9850453-0", "display_name": "Win.Trojan.Emotet-9850453-0", "target": null }, { "id": "ALF:HSTR:HackTool:ExtremeInjector.S01", "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01", "target": null }, { "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn", "target": null }, { "id": "!#HSTR:Win32/Spectorsoft", "display_name": "!#HSTR:Win32/Spectorsoft", "target": "/malware/!#HSTR:Win32/Spectorsoft" }, { "id": "ALF:Base64EncodeFunctionMonitorW", "display_name": "ALF:Base64EncodeFunctionMonitorW", "target": null }, { "id": "185.199.108.133.Malware_Host", "display_name": "185.199.108.133.Malware_Host", "target": null }, { "id": "adware.opencandy", "display_name": "adware.opencandy", "target": null }, { "id": "Malvertizing", "display_name": "Malvertizing", "target": null } ], "attack_ids": [ { "id": "TA0002", "name": "Execution", "display_name": "TA0002 - Execution" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1872, "FileHash-SHA1": 1140, "FileHash-SHA256": 2367, "URL": 1969, "domain": 327, "hostname": 1025, "email": 1 }, "indicator_count": 8701, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "861 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709127d115350fd0249f37", "name": "https://news.line.me/detail/oa-sankeinews/1iawg1xp7wp9'", "description": "", "modified": "2023-12-06T15:20:07.034000", "created": "2023-12-06T15:20:07.034000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 332, "hostname": 39, "URL": 133, "domain": 36, "FileHash-MD5": 46, "FileHash-SHA1": 45, "CVE": 1 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f04876a2fd4fca1305fe17", "name": "https://news.line.me/detail/oa-sankeinews/1iawg1xp7wp9'", "description": "", "modified": "2022-09-07T00:04:00.988000", "created": "2022-08-07T23:19:18.616000", "tags": [ "apt", "runtime data", "ansi", "threat level", "runtime process", "pcap", "august", "local", "CVE-2021-22941" ], "references": [ "https://hybrid-analysis.com/sample/aebca17ee5731a445d503739077d416a4b9c7389548d3efe361a24d14342abdd/62f04031f60007490c314f44", "CVE-2021-22941" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 133, "hostname": 39, "domain": 36, "FileHash-SHA256": 332, "CVE": 1, "FileHash-MD5": 46, "FileHash-SHA1": 45 }, "indicator_count": 632, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1362 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.nandos.com.au/gift", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.nandos.com.au/gift", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780268181.7700732 }