{ "type": "URL", "indicator": "https://www.ssl.com/repository0", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.ssl.com/repository0", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #6716", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain ssl.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain ssl.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3890888043, "indicator": "https://www.ssl.com/repository0", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "69d9b0e549af1aae2975ebeb", "name": "Virtual Servers \u2022 Tulach \u2022 Eternal Blue", "description": "Interesting. Further research required. \n\nhttps://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=+New+Worker+Online%0A+PC:+DESKTOP-BBE3PFV%0A+User:+alien%0A+IP:+Sweden%0A+Country:+SE+\n\n\nhttps://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=\\\\xfff0\\\\xff9f\\\\xff9f\\\\xffa2+New+Worker+Online%0A\\\\xfff0\\\\xff9f\\\\xff92\\\\xffbb+PC:+DESKTOP-BBE3PFV%0A\\\\xfff0\\\\xff9f\\\\xff91\\\\xffa4+User:+alien%0A\\\\xfff0\\\\xff9f\\\\xff8c\\\\xff90+IP:+Sweden%0A\\\\xfff0\\\\xff9f\\\\xff97\\\\xffba+Country:+SE+", "modified": "2026-04-11T02:24:37.102000", "created": "2026-04-11T02:24:37.102000", "tags": [ "related pulses", "apple", "imac", "itunes", "tulach", "active", "vercel", "ms windows", "intel", "yara rule", "lredmond", "rsds", "write c", "tls sni", "write", "install", "rijndael", "malware", "accept", "self", "mtb apr", "lowfi", "backdoor", "antigua", "trojandropper", "all ipv4", "urls", "prometheus", "files", "files ip", "address", "united", "unknown aaaa", "cname", "tags", "keepalived", "ip address", "red hat", "nat node", "gns3", "firefox", "ovn network", "instances", "forum", "linux", "dynamicloader", "exclusionpath", "medium", "high", "telegram api", "windows", "f rl", "highest sc", "guard", "april", "powershell", "c mar", "virtool", "c jan", "c dec", "urls show", "url hostname", "ransom", "click", "title", "njrat", "as64521i", "bird", "bgp", "virtual private", "virtual servers", "et exploit", "ms17010 echo", "response", "echo response", "asnone", "probe ms17010", "nids", "m2 ms17010", "regsetvalueexa", "service", "wannacry", "dock", "unknown", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "found", "mitre att", "defense evasion", "sha1", "sha256", "size", "pattern match", "ascii text", "path", "stop", "hybrid", "general", "local", "twitter", "strings", "core", "telegram", "tools" ], "references": [ "Win.Ransomware.WannaCry-6313787-0 , Ransom:Win32/WannaCrypt.H IDS Detections Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE Probe MS17-010 (Generic Flags) Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware , WannaCry_Ransomware_Gen , WannaDecryptor , stack_string , MS17_010_WanaCry_worm More Alerts nids_exploit", "https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=+New+Worker+Online%0A+PC:+DESKTOP-BBE3PFV%0A+User:+alien%0A+IP:+Sweden%0A+Country:+SE+ Akamai rank: #2475\t URL https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=\\\\xfff0\\\\xff9f\\\\xff9f\\\\xffa2+New+Worker+Online%0A\\\\xfff0\\\\xff9f\\\\xff92\\\\xffbb+PC:+DESKTOP-BBE3PFV%0A\\\\xfff0\\\\xff9f\\\\xff91\\\\xffa4+User:+alien%0A\\\\xfff0\\\\xff9f\\\\xff8c\\\\xff9", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0816.pdf", "https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f", "Trojans: 149.154.166.110 command_and_control (build your own telegram) 208.95.112.1 command_and_control", "prometheus.shorty.cicloinfinito.com", "Win.Packed.njRAT-10002074-1", "NJRat IDS Detections: Telegram API Domain in DNS Lookup", "NJRat IDS Detections: Observed Telegram API Domain (api .telegram .org in TLS SNI)", "NJRat IDS Detections: Telegram API Certificate Observed", "NJRat Yara Detections: ByteCode_MSIL_Backdoor_AsyncRAT", "NJRat Alerts: hardware_id_profiling network_cnc_https_pastesite persistence_autorun", "NJRat Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert", "NJRat Alerts: windows_defender_powershell network_document_file powershell_command_suspicious", "NJRat Alerts: suspicious_command_tools antidebug_guardpages antisandbox_sleep", "NJRat Alerts: dynamic_function_loading encrypted_ioc registers_vectored_exception_handler", "NJRat Alerts: http_request reads_memory_remote_process network_cnc_https_generic reads_self", "NJRat IP\u2019s Contacted 149.154.166.110 172.66.171.73", "NJRat Domains Contacted pastebin.com api.telegram.org", "192.168.122.200 BGP: Simulating Inter-network Dynamic Routing", "EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.105\", \"dst_port\": 49317, \"sid\": 2025650, \"date\": \"2020/06/18 11:39:48\", \"dst_ip\": \"192.168.56.103\" }, \"type\": \"ioc\", \"description\": null }, { \"category\": \"suricata\", \"ioc\": { \"src_port\": 445, \"name\": \"ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.108\", \"dst_port\": 49324, " ], "public": 1, "adversary": "", "targeted_countries": [ "Japan", "United States of America", "China" ], "malware_families": [ { "id": "Win.Trojan.Generic-9908396-0", "display_name": "Win.Trojan.Generic-9908396-0", "target": null }, { "id": "Win.Trojan.Crypted-30", "display_name": "Win.Trojan.Crypted-30", "target": null }, { "id": "Backdoor:Win32/Berbew", "display_name": "Backdoor:Win32/Berbew", "target": "/malware/Backdoor:Win32/Berbew" }, { "id": "Win.Malware.Score-6985947-1", "display_name": "Win.Malware.Score-6985947-1", "target": null }, { "id": "ALF:PWS:MSIL/Stealgen.GC!MTB", "display_name": "ALF:PWS:MSIL/Stealgen.GC!MTB", "target": null }, { "id": "Win.Packed.Zpack-10013367-0", "display_name": "Win.Packed.Zpack-10013367-0", "target": null }, { "id": "ALF:Trojan:Win32/FormBook.F!MTB", "display_name": "ALF:Trojan:Win32/FormBook.F!MTB", "target": null }, { "id": "Win.Malware.Renos-10003934-0", "display_name": "Win.Malware.Renos-10003934-0", "target": null }, { "id": "Win.Trojan.Razy-10016933-0", "display_name": "Win.Trojan.Razy-10016933-0", "target": null }, { "id": "#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.A", "display_name": "#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.A", "target": null }, { "id": "NJRat", "display_name": "NJRat", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Private Internet Access", "display_name": "Private Internet Access", "target": null }, { "id": "Malware Packed", "display_name": "Malware Packed", "target": null }, { "id": "W32/WannaCryptor.491A!tr.ransom", "display_name": "W32/WannaCryptor.491A!tr.ransom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1584.003", "name": "Virtual Private Server", "display_name": "T1584.003 - Virtual Private Server" }, { "id": "TA0029", "name": "Privilege Escalation", "display_name": "TA0029 - Privilege Escalation" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1144", "name": "Gatekeeper Bypass", "display_name": "T1144 - Gatekeeper Bypass" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [ "Telecommunications", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 556, "domain": 206, "URL": 863, "FileHash-SHA256": 1589, "IPv4": 519, "FileHash-MD5": 472, "FileHash-SHA1": 376, "SSLCertFingerprint": 11, "email": 1 }, "indicator_count": 4593, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d3522448a6a2faaa9fd792", "name": "VirusTotal report\n for download.js", "description": "><<< full report on Sigma, a new generation of malware, has been published on the website of the University of South Africa's Security Research Centre (Sarac), based in the capital, Pretoria.\u20ac>> united states. Beyond Theory. e p o a e . Epoch", "modified": "2026-04-06T06:26:44.786000", "created": "2026-04-06T06:26:44.786000", "tags": [ "mitre attack", "network info", "file type", "sigma", "program", "t1055 process", "overview", "dropped info", "processes extra", "overview zenbox", "malicious", "next", "in a", "create", "manager", "docker", "5 dev", "k8s configmap", "profiles", "etcd", "get https", "https", "refresh", "cookie", "ascii text", "crlf line", "text text", "ms windows", "vista event", "windows event", "thumbprint", "windows sandbox", "calls process", "pe file", "drops pe", "sample", "pe32", "spawns", "aslr", "persistence", "info", "creates", "performs dns", "default", "shell folders", "folders", "parent pid", "full path", "command line", "inprocserver32", "registry keys", "k netsvcs", "nothing", "mensaje", "wps office", "extra info", "drops", "defense evasion", "binary", "window" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456178&Signature=veZ5ILWvDbljstqg4NlX%2Bxs8GT3FFuOKYzQc%2B27Rfrzrxz9KINRfg5iEd%2FTD%2FJh0%2Bq%2BUFppfHwGwnnMNhD99MoqLrX735IHzqHRH3Y%2BhrlHexlMj6uTX%2FhuA91WtmQoFu8u8NtWjsAldaYDAJjFHT7HCenKy%2BmD%2FVHzSvfzxaf4d%2FZtoqDdCpPzDigdhx%2BpKQUOSIw0wEDklMmjQ8OQnKdK9RXK5duMVg%2Fwd7u7HVHNa", "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456268&Signature=r6fOkWGbwBX8z6YDvUFYQnPc8efKUXVyW0Ma97Qze1Gg5yigm12abg4Ohbydi7izPRODvv6sVLGy9Uj3%2FKSBJY3SoMgbLkj5YofXLKyp40m%2B32vj%2Boml5b0R%2FYrwd7rcA8dzMAuMKZpQ04wgR%2BiSh772Z%2BZ34H2CYZZnjpJoUC49ip8c4%2FUDETK%2BrFZMZqerVs2ONWDAzCMzN%2BvpWHlLkuAH7n2fTCOTvtO43TMqTzE5", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456681&Signature=Mcrv0JEeKTzfxc7JwD4u6K1dNY8liXAX1tF2i91bXpymU0E%2FlRM95joj0ZuMk2A82ekHHzgKJbSxrkjVIutcPfV%2FYWPOj1or9HVjXg4Jq6QJb7fmWG5%2BqUxcfMqz8D7UN8v0FFVTc%2F%2FP3Sv3PpE3%2FKIhPcdMc1SodC9krYB%2Bbdj1obcveSDLlBtXgl9wP%2B7SuYub12drNzeyC9UKw%2FX0n7vZpU3JLAiYznAMTB", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456701&Signature=t3Xqew0bsV61nmgncFTOCX%2FtqVKoAMgUft1dTGFLOFu7%2Fw4fbqeYn3laYdKEN6S%2BK7DF5nDi%2BN6pZq%2Be%2FsOZjAHgy821VBDeXqJaq6BdPAlT6fXrqDPaTghd9A00rdfDtOXh6Zy%2Bl5f16NPFVSl8FRZqU6GLhD%2B%2BSo%2FIP1XbQBHhcyOPh7nfc%2F8BxsyypNTadLDWEEJqVPSKFTVYwIagyVlTMD59xYMUtP8L2Ogdm9mJICbv", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456734&Signature=Twrc6n%2BEyYc3IkPf4BD0CucGYLqOW4lxcGi2ZNxHRk7tNezVNxxouYRnGIr3OFeByvpf87X6oDI2BVrHR8er8NmM4CFpWpyRrf7xJh%2FZ6Vca48ROgTEWVHlnjgW0jVMzSe9TZOnN3zpmnpw37X95of0%2BzE6e4Fpl96po0RZcvPRC0G%2BqbKKwb%2FhIAspbkpn76RKrHyf%2FCb8aZ21ec7FwUJa%2BAZ%2FolkR0TdqCHOXyBcBQQ5", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456766&Signature=fhEgpRoSszxXiIBuHWVEId9w1CwC9EnIKxPCKHEQMqEzppF90L%2B%2FlxW%2FywCNH6CMqGY1o9mJvTVmLXyypm1kzfmWsyA80dWPTGIRRYKfqvQ3Nng8wj93UHAEQuxrv4kfCNpUBBjn1WDnmQhRTooluOfdTIrQ10pjymrCYCKxOAFwm5bbvSKJ0%2BtX3rYiPf3fD%2BRRO9heg7G6MndwBJE2WMOzyy6vo8lgQCLwHAh4rCiDobnbPC8XTy6osE1J", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456802&Signature=imED1VqYi14phTIENcdipBYjA%2BPgkL01TfJ1OydtY11LRS0lWv7THCPLLrLTkqq5ZoqxfCHCpuGqhWbabkW%2FSywvmyfhLD8TAvNRo0A%2Fdc27m6nC815oX%2BMHPVKhiTkshZH2KFL5rPe%2FQN81hxksJ07blNlH%2FGB6mG4fnRkg4rmqjT0QFA0yYvzH0bBAtM5ZmMRpoIg7zab6oVeuUuqroFECb2%2Fl3KcRdgZm2RQcf%2BvoJW", "https://vtbehaviour.commondatastorage.googleapis.com/0002815bed9019ec43e804f3eb7436b82b133ae60fce110cbbadae8ed8be5b3e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456853&Signature=ohh65FvVsmXmQYu%2BJk1T4eXJGcdQGvMivSh5TmeHZLoDT%2ByKeGjHrEPJLhUqlYbxRx8n2cI91TyF9CGdex%2F461K5YKhHcc1nzbCf%2BHknI5sKA%2FMDvRrmPb0DYDVnExub3GBqS92stLwDSfSKYmbg3%2Bewiypp3nNLEzgg1XFvXV%2Bu%2Bk%2F4EG8y495NBtU%2F5%2Fh3oLc%2F0NDQfdQWmwE%2FuiC9lWax%2FmZm7V2%2Bap03q3xN", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456905&Signature=RYIw5qZjecwIW0t7r5f%2BW29otPot2E4%2FAtLi37l8zcqFvx5%2B%2F9fgG%2B1Ay2Srf3y63cFKycTp%2BPmZvlwpImAkOOt4%2FBgJ7020dTOz%2FLOWUt6aeKt5xvjqwwkju5zlpLraECdTpENMPV436aJoAh1I2kbPY6oHixcY%2BW1t1E4XcpCMLPlEQOgQmoVly6vDIA4BFHjHbrRd%2FpgtZExPke2Y%2FXgggLW75UrBbd", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456942&Signature=CyFvPFvbJhEdaWGF5he4cjzXT2%2FgvcmLJtVWaxv%2BNDzHPqLCNte56ZKxxP6mxUJPRZOpew0513JF50Ks8VL3kYoD566k1EAY27gm%2FdAS2N7xeaKV%2FdmihrhDfLdb2wqlXciSx3fb9Kf4z4T%2F4Kf9%2FSGh6lka0UFtlvIBzlq2OGtr0n6YEpVNHQG6L7jGn4adPJ1P8Zxb0ozprtOGnCXztODTwURwVPyD9asMhojWns2L1ssNl0rH0GQAAY" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 26, "FileHash-SHA1": 30, "FileHash-SHA256": 143, "IPv4": 67, "URL": 103, "domain": 19, "hostname": 130, "email": 2 }, "indicator_count": 520, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "14 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690a2c38de1708af54217faa", "name": "Access Token used to steal security credentials & hack and ride DND of targeted individuals", "description": "- https://shift.gearboxsoftware.com/link\n- Found embedded in targets phone.\n\nAccess Token used to steal security credentials & hack and ride DND of targeted individuals device. \nTAM Legal \u2022 Tulach \u2022 Hall Render \u2022 Quasi Government | Some type of Foundry user account found. \n\nStop illegally \n stalking, harassment, attempts, hacking, death threats. . Because the Colorado government allowing entities like this to operate without any type of rules, oversight or boundaries \nMILLION$ were wasted in your own fraud, waste in abuse scheme. AT&T , CrowdStrike , United Healthcare , UC Healthcare, Intermountain Health, T-Mobile, Amazon East, the Colorado Government itself, Medicare and Medicaid. For what? You have zero talent so you take it from those who do. You have nothing coming to you so you steal it from those who do. Is this somehow legal? \n#contacted #all_hosts backdoor #ransomware #cve #usa #american_terrorists #workers_compenstation_abuse #silencing #targeting #hitmen #illegal #malvertizing #aws_dns", "modified": "2025-12-04T15:01:02.531000", "created": "2025-11-04T16:39:20.035000", "tags": [ "present aug", "moved", "encrypt", "present jul", "passive dns", "ipv4 add", "reverse dns", "united states", "present may", "ip address", "gmt content", "ipv4", "all ipv4", "america", "united", "present oct", "name servers", "redacted for", "emails", "for privacy", "unknown ns", "unknown aaaa", "dynamicloader", "focus region", "unicode text", "utf16", "ms windows", "bokeh onlycanon", "zeiss jena", "mcsonnar", "high", "win64", "stream", "write", "smartassembly", "trailer", "next", "search", "medium", "as15169", "write c", "reads", "team", "malware", "local", "yara detections", "delphi", "strings", "dcom", "form", "trojandropper", "mtb nov", "backdoor", "otx telemetry", "trojan", "type", "data upload", "extraction", "ol rop", "hash avast", "avg clamav", "msdefender nov", "win32upatre nov", "win32berbew nov", "dynamic", "pe section", "error", "close", "status", "urls", "expiration date", "hostname", "url analysis", "yara rule", "show", "binary file", "wine emulator", "mtb oct", "files", "denmark asn", "as32934", "candyopen", "possible", "smoke loader", "trojanspy", "filehash", "pulses otx", "related tags", "file type", "no analysis", "available", "api key", "screenshots", "present nov", "aaaa", "mtb may", "mexico", "hostname add", "registrar", "domain add", "location united", "email add", "none related", "domains", "email domain", "service", "domain", "america flag", "body", "title", "aws dns", "next associated", "risepro", "guard", "v full", "reports v", "t1059 shared", "modules", "t1129 system", "t1569", "help v", "t1179 boot", "logon autost", "encoding", "packing f0001", "hidden files", "e1203 windows", "file attributes", "registry value", "catalog tree", "analysis ob0001", "evasion b0003", "virtual machine", "ip traffic", "memory pattern", "pattern urls", "tls sni", "get https", "post https", "named pipe", "delete c", "radar", "defender", "format", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "country", "contacted hosts", "process details", "flag", "globalc", "intel", "win32", "worm", "path", "explorer", "script", "href", "external", "html content", "tulach", "hallrender", "tam legal", "brian sabey", "christopher ahmann", "apple", "msie", "chrome", "ascio", "creation date", "date", "germany unknown", "germany asn", "files ip", "address", "asn as24940", "less", "script urls", "a domains", "prox", "dennis schrder", "meta", "apache", "99u25f.exe", "entries", "as24940 hetzner", "dns resolutions", "status code", "body length", "kb body", "software/ hardware", "external-resources", "password-input", "overview", "colorado" ], "references": [ "https://shift.gearboxsoftware.com/link", "https://tulach.cc/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 alohatube.xyz \u2022 1001pornvideos.com", "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe", "https://www.turbo.net/run/videolan/vlc", "http://www.forensickb.com/2013/03/file-entropy-explained.html", "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/", "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to", "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal", "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before ." ], "public": 1, "adversary": "Colorado Quasi Government | Workerk Compensation", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Generic-9878032-0", "display_name": "Win.Trojan.Generic-9878032-0", "target": null }, { "id": "Win.Trojan.Starter-171", "display_name": "Win.Trojan.Starter-171", "target": null }, { "id": "GravityRAT", "display_name": "GravityRAT", "target": null }, { "id": "Backdoor:Win32/Berbew.AA!MTB", "display_name": "Backdoor:Win32/Berbew.AA!MTB", "target": "/malware/Backdoor:Win32/Berbew.AA!MTB" }, { "id": "Trojan:MSIL/AgentTesla.DW!MTB", "display_name": "Trojan:MSIL/AgentTesla.DW!MTB", "target": "/malware/Trojan:MSIL/AgentTesla.DW!MTB" }, { "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "target": null }, { "id": "Trojandropper:Win32/VB.IL", "display_name": "Trojandropper:Win32/VB.IL", "target": "/malware/Trojandropper:Win32/VB.IL" }, { "id": "Nemucod", "display_name": "Nemucod", "target": null }, { "id": "Berbew", "display_name": "Berbew", "target": null }, { "id": "PWS:Win32/Zbot.MS!MTB", "display_name": "PWS:Win32/Zbot.MS!MTB", "target": "/malware/PWS:Win32/Zbot.MS!MTB" }, { "id": "Win.Trojan.Barys-10005825-0", "display_name": "Win.Trojan.Barys-10005825-0", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Win.Exploit.Rozena-10038302-0", "display_name": "Win.Exploit.Rozena-10038302-0", "target": null }, { "id": "Zombie", "display_name": "Zombie", "target": null }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" }, { "id": "Muldrop", "display_name": "Muldrop", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Dorv", "display_name": "Dorv", "target": null }, { "id": "Win.Malware.Pits-10035540-0", "display_name": "Win.Malware.Pits-10035540-0", "target": null }, { "id": "Win.Ransomware.Msilzilla-10014498-0", "display_name": "Win.Ransomware.Msilzilla-10014498-0", "target": null }, { "id": "CVE-2023-4966", "display_name": "CVE-2023-4966", "target": null }, { "id": "Exploit:Linux/CVE-2017-17215", "display_name": "Exploit:Linux/CVE-2017-17215", "target": "/malware/Exploit:Linux/CVE-2017-17215" }, { "id": "Ransom:Win32/CVE-2017-0147", "display_name": "Ransom:Win32/CVE-2017-0147", "target": "/malware/Ransom:Win32/CVE-2017-0147" }, { "id": "CVE-2022-26134", "display_name": "CVE-2022-26134", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6051, "hostname": 2627, "FileHash-MD5": 401, "FileHash-SHA1": 257, "email": 11, "domain": 1838, "FileHash-SHA256": 1742, "CVE": 4, "SSLCertFingerprint": 3 }, "indicator_count": 12934, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "689d5115ad786de4ff048e5b", "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker", "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access", "modified": "2025-09-13T02:00:42.729000", "created": "2025-08-14T02:59:33.036000", "tags": [ "url https", "url http", "search", "type indicator", "role title", "added active", "related pulses", "showing", "entries", "present sep", "united", "present aug", "present jul", "present jun", "moved", "unknown ns", "present may", "present apr", "passive dns", "date", "encrypt", "body", "cookie", "gmt server", "content type", "dynamicloader", "medium", "x17x03x01", "download studio", "high", "read c", "show", "windows", "copy", "powershell", "write", "anomaly", "next", "unknown", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "yara detections", "delphi", "codeoverlap", "win32", "rgba", "memcommit", "delete", "png image", "hash", "dock", "execution", "malware", "wine emulator", "dynamic", "msie", "windows nt", "wow64", "slcc2", "media center", "capture", "persistence", "sha256", "submitted", "copy md5", "copy sha1", "copy sha256", "sha1", "script", "mitre att", "ck id", "show technique", "ck matrix", "null", "august", "span", "refresh", "meta", "mirai", "february", "april", "june", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "caribe", "rest", "accept", "friday", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6211, "domain": 682, "hostname": 1661, "FileHash-MD5": 117, "FileHash-SHA1": 100, "FileHash-SHA256": 1386, "SSLCertFingerprint": 5 }, "indicator_count": 10162, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "219 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67b0911d4395f91b8fdac730", "name": "lumma", "description": "", "modified": "2025-07-07T00:26:37.681000", "created": "2025-02-15T13:05:33.258000", "tags": [], "references": [ "https://www.virustotal.com/graph/g9155e32765e8465eb4c422d9abc5dcc8c830fa9dc83e40a99c0b1c6fb56e098c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 38, "URL": 138, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 253, "hostname": 20 }, "indicator_count": 475, "is_author": false, "is_subscribing": null, "subscriber_count": 178, "modified_text": "287 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "553 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "667f111dcdeeba812adc4fd4", "name": "DoS:Win32/Rask | ZingoStealer | Used by Law/Legal/Tesms/Gov/IBM", "description": "It sure takes a lot to make, framing, spying, shadowing look like an investigation. I can't help but notice the excessive gay, teen porn and blackpu**y love.", "modified": "2024-07-28T18:04:28.664000", "created": "2024-06-28T19:38:05.236000", "tags": [ "historical ssl", "threat network", "infrastructure", "discord bots", "ualberta tld", "cobalt strike", "data redacted", "cloudflare", "code", "server", "registrar abuse", "admin country", "registrant name", "registry domain", "dnssec", "billing country", "date", "dns replication", "aaaa", "record type", "ttl value", "domain status", "registrant fax", "registrar url", "whois lookup", "dynamicloader", "show", "search", "adobe reader", "copy", "dynamic", "adobe", "incorporated", "read", "write", "read c", "write c", "delete c", "memcommit", "medium", "time stamping", "united", "domain", "persistence", "execution", "malware", "suspicious", "encrypt", "referrer", "first", "utc submissions", "submitters", "domains", "csc corporate", "scaleway", "tucows", "google", "dynadot llc", "amazon02", "facebook", "level3", "lineargradient", "png image", "ascii text", "pattern match", "ff6633", "mitre att", "rgba", "path", "ck id", "show technique", "mask", "june", "hybrid", "local", "click", "strings", "body", "stop", "enterprise", "rask", "abcd", "yara detections", "tls sni", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "malicious ids", "as17667", "passive dns", "content type", "title", "scan endpoints", "all scoreblue", "ipv4", "pulse submit", "url analysis", "urls", "as37153", "south africa", "unknown", "files", "status", "showing", "record value", "for privacy", "redacted for", "entity", "as49505", "russia unknown", "servers", "script urls", "health law", "meta", "a domains", "providers", "state server", "internalname", "legalcopyright", "filehash", "entries", "zeppelin20", "total", "trojan", "gmt content", "vercel x", "refresh", "time", "antivirus", "win32trickler", "targeted", "oval oval", "cve cve20020013", "exploits", "cve overview", "vulnerabilities", "protos", "shadow", "quasi", "creation date", "as706", "as15293", "cname", "expiration date", "as14870 flexera", "hilgraeve", "virgin islands", "as19905", "as16276", "france unknown", "canada unknown", "next", "hostname", "expiration", "ibm", "x force", "components", "installs", "high", "explorer", "anomalous file", "as44273 host", "certificate", "as54113", "name servers", "moved", "asnone united", "apple", "apple remote", "apple spy", "abuse", "as22612", "as397240", "as19527 google", "nxdomain", "whitelisted", "aaaa nxdomain", "as21342", "a nxdomain", "ns nxdomain", "teenfuckers.com", "fuck", "fuck team", "dod", "teen porn", "malvertising", "framing", "killers", "hitmen", "stalkers", "orbiters", "fake date", "date app", "blind install", "government", "dark" ], "references": [ "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Yara Detections: Zeppelin_10 , Zeppelin_20 , ConventionEngine_Anomaly_MultiPDB_Double , MS_Visual_Cpp_2005", "High Priority Alert: stealth_network modifies_certificates network_icmp", "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI) 192.168.56.115", "Zingo/GinzoStealer: FileHash-SHA256 015d67fcca9d2fa8e4ea8f8a2cb99dee5f0b4bf39898d160c27bc4e4c6ccd237 trojan", "Zingo/GinzoStealer: FileHash-MD5 0b5fd8367272a6986f93af06faf977a9 trojan", "Zingo/GinzoStealer: FileHash-SHA1 72b5f7716dbf8e1e6fa26ef19a9d7f8970221300 trojan", "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Zingo/GinzoStealer: https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "https://www.hybrid-analysis.com/sample/caeed78015e7bcdf122aa01354016e3057cae1b585a946086d2d69ff643e7e2c/667e87c7badf2ad3670bd6bb", "Installation/Persistence: \"Press_Release_99x180_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: N/A]", "https://otx.alienvault.com/indicator/ip/110.238.1.102 | https://otx.alienvault.com/indicator/hostname/ninr.syslinx.com.au", "https://otx.alienvault.com/indicator/ip/15.197.225.128", "www.resident-physician-lawyer.com | HTTP/1.1 405 Not Allowed Server: awselb/2.0 Connection: keep alive WAFRule: 0", "https://otx.alienvault.com/indicator/hostname/www.resident-physician-lawyer.com | www.thehealthlawfirm.com", "Trojan:Win32/Trickler: FileHash-SHA256 ccbb9ff792732151e9b57b30cb18bff96e63d5cec17fac1bd937ae5c49271699", "Trojan:Win32/Trickler: FileHash-MD5 8d2a19ceb45e794e08e8c1588d22d242", "Trojan:Win32/Trickler: FileHash-SHA1 a461b60b2a82cdd560f96b2502a4b9b9ac98a7ed", "Trojan:Win32/Msposer.I: FileHash-SHA256 6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Trojan:Win32/Msposer.I: FileHash-MD5 e30112d853700a6e93bec678c1c0a538", "Trojan:Win32/Msposer.I: FileHash-SHA1 410efb8108fdf5db106e1f6a3d7608355621562d", "DoS:Win32/Rask: http://karelinform.ru/news/world/02-06-2016/uchenye-raskryli-sekret-antirakovyh-svoystv-aspirina", "PROTOS Remote SNMP Attack Tool: https://otx.alienvault.com/indicator/cve/CVE-2002-0013", "Bot: api-app-prod.wobot.ai | wizarbot.com | ipv4bot.whatismyipaddress.com", "Spy: app.zapspy.net | http://spywarefrance.com | spywarefrance.com", "http://www.iss.net/security_center/alerts/advise110.php | Governmental? related to several @ellenmmm Pulses reports one cited DoD /Pentagon", "Hostname www.govsuppliers1920.aot.com.au | www.curuzu.gov.ar", "Yara Detection: ProtectSharewareV11eCompservCMS | StringFileInfo@\u0001\u0001040904B04\u0014\u0001CompanyName", "Alerts: persistence_autorun antisandbox_mouse_hook infostealer_keylog stealth_hiddenreg", "Interesting Strings http://schemas.microsoft.com/cdo/configuration/", "leaplegalsoftwaremerch.brandedproducts.com.au", "https://otx.alienvault.com/indicator/file/6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "appleremotesupport.com | applesundermybed.com | appleid-secure-login.com", "teenfuckers.com | fuck.cloudflaressl.com | animefuck.org |", "blackteensexy.net | teenfuckers.com | teengayvideo.com | teensexporno.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Agent-678024", "display_name": "Win.Trojan.Agent-678024", "target": null }, { "id": "ZingoStealer", "display_name": "ZingoStealer", "target": null }, { "id": "Ginzo Stealer", "display_name": "Ginzo Stealer", "target": null }, { "id": "Trojan:Win32/Trickler", "display_name": "Trojan:Win32/Trickler", "target": "/malware/Trojan:Win32/Trickler" }, { "id": "Other:Malware-gen", "display_name": "Other:Malware-gen", "target": null }, { "id": "CVE-2002-0013", "display_name": "CVE-2002-0013", "target": null }, { "id": "Trojan:Win32/Msposer.I", "display_name": "Trojan:Win32/Msposer.I", "target": "/malware/Trojan:Win32/Msposer.I" }, { "id": "DoS:Win32/Rask", "display_name": "DoS:Win32/Rask", "target": "/malware/DoS:Win32/Rask" }, { "id": "Zeppelin", "display_name": "Zeppelin", "target": null }, { "id": "Win.Malware.Swisyn-9942393-0", "display_name": "Win.Malware.Swisyn-9942393-0", "target": null }, { "id": "TEL:HTML/MalvertWindowResize", "display_name": "TEL:HTML/MalvertWindowResize", "target": "/malware/TEL:HTML/MalvertWindowResize" } ], "attack_ids": [ { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1118", "name": "InstallUtil", "display_name": "T1118 - InstallUtil" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Healthcare", "Technology", "Legal", "Civilian Society" ], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 239, "FileHash-SHA1": 234, "FileHash-SHA256": 775, "domain": 2293, "hostname": 1545, "URL": 1431, "email": 13, "SSLCertFingerprint": 10, "CVE": 1 }, "indicator_count": 6541, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "630 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6681f3f6b512c5b6aacffa39", "name": "DoS:Win32/Rask | ZingoStealer | Used by Law/Legal/Tesms/Gov/IBM ", "description": "", "modified": "2024-07-28T18:04:28.664000", "created": "2024-07-01T00:10:30.700000", "tags": [ "historical ssl", "threat network", "infrastructure", "discord bots", "ualberta tld", "cobalt strike", "data redacted", "cloudflare", "code", "server", "registrar abuse", "admin country", "registrant name", "registry domain", "dnssec", "billing country", "date", "dns replication", "aaaa", "record type", "ttl value", "domain status", "registrant fax", "registrar url", "whois lookup", "dynamicloader", "show", "search", "adobe reader", "copy", "dynamic", "adobe", "incorporated", "read", "write", "read c", "write c", "delete c", "memcommit", "medium", "time stamping", "united", "domain", "persistence", "execution", "malware", "suspicious", "encrypt", "referrer", "first", "utc submissions", "submitters", "domains", "csc corporate", "scaleway", "tucows", "google", "dynadot llc", "amazon02", "facebook", "level3", "lineargradient", "png image", "ascii text", "pattern match", "ff6633", "mitre att", "rgba", "path", "ck id", "show technique", "mask", "june", "hybrid", "local", "click", "strings", "body", "stop", "enterprise", "rask", "abcd", "yara detections", "tls sni", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "malicious ids", "as17667", "passive dns", "content type", "title", "scan endpoints", "all scoreblue", "ipv4", "pulse submit", "url analysis", "urls", "as37153", "south africa", "unknown", "files", "status", "showing", "record value", "for privacy", "redacted for", "entity", "as49505", "russia unknown", "servers", "script urls", "health law", "meta", "a domains", "providers", "state server", "internalname", "legalcopyright", "filehash", "entries", "zeppelin20", "total", "trojan", "gmt content", "vercel x", "refresh", "time", "antivirus", "win32trickler", "targeted", "oval oval", "cve cve20020013", "exploits", "cve overview", "vulnerabilities", "protos", "shadow", "quasi", "creation date", "as706", "as15293", "cname", "expiration date", "as14870 flexera", "hilgraeve", "virgin islands", "as19905", "as16276", "france unknown", "canada unknown", "next", "hostname", "expiration", "ibm", "x force", "components", "installs", "high", "explorer", "anomalous file", "as44273 host", "certificate", "as54113", "name servers", "moved", "asnone united", "apple", "apple remote", "apple spy", "abuse", "as22612", "as397240", "as19527 google", "nxdomain", "whitelisted", "aaaa nxdomain", "as21342", "a nxdomain", "ns nxdomain", "teenfuckers.com", "fuck", "fuck team", "dod", "teen porn", "malvertising", "framing", "killers", "hitmen", "stalkers", "orbiters", "fake date", "date app", "blind install", "government", "dark" ], "references": [ "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Yara Detections: Zeppelin_10 , Zeppelin_20 , ConventionEngine_Anomaly_MultiPDB_Double , MS_Visual_Cpp_2005", "High Priority Alert: stealth_network modifies_certificates network_icmp", "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI) 192.168.56.115", "Zingo/GinzoStealer: FileHash-SHA256 015d67fcca9d2fa8e4ea8f8a2cb99dee5f0b4bf39898d160c27bc4e4c6ccd237 trojan", "Zingo/GinzoStealer: FileHash-MD5 0b5fd8367272a6986f93af06faf977a9 trojan", "Zingo/GinzoStealer: FileHash-SHA1 72b5f7716dbf8e1e6fa26ef19a9d7f8970221300 trojan", "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Zingo/GinzoStealer: https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "https://www.hybrid-analysis.com/sample/caeed78015e7bcdf122aa01354016e3057cae1b585a946086d2d69ff643e7e2c/667e87c7badf2ad3670bd6bb", "Installation/Persistence: \"Press_Release_99x180_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: N/A]", "https://otx.alienvault.com/indicator/ip/110.238.1.102 | https://otx.alienvault.com/indicator/hostname/ninr.syslinx.com.au", "https://otx.alienvault.com/indicator/ip/15.197.225.128", "www.resident-physician-lawyer.com | HTTP/1.1 405 Not Allowed Server: awselb/2.0 Connection: keep alive WAFRule: 0", "https://otx.alienvault.com/indicator/hostname/www.resident-physician-lawyer.com | www.thehealthlawfirm.com", "Trojan:Win32/Trickler: FileHash-SHA256 ccbb9ff792732151e9b57b30cb18bff96e63d5cec17fac1bd937ae5c49271699", "Trojan:Win32/Trickler: FileHash-MD5 8d2a19ceb45e794e08e8c1588d22d242", "Trojan:Win32/Trickler: FileHash-SHA1 a461b60b2a82cdd560f96b2502a4b9b9ac98a7ed", "Trojan:Win32/Msposer.I: FileHash-SHA256 6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Trojan:Win32/Msposer.I: FileHash-MD5 e30112d853700a6e93bec678c1c0a538", "Trojan:Win32/Msposer.I: FileHash-SHA1 410efb8108fdf5db106e1f6a3d7608355621562d", "DoS:Win32/Rask: http://karelinform.ru/news/world/02-06-2016/uchenye-raskryli-sekret-antirakovyh-svoystv-aspirina", "PROTOS Remote SNMP Attack Tool: https://otx.alienvault.com/indicator/cve/CVE-2002-0013", "Bot: api-app-prod.wobot.ai | wizarbot.com | ipv4bot.whatismyipaddress.com", "Spy: app.zapspy.net | http://spywarefrance.com | spywarefrance.com", "http://www.iss.net/security_center/alerts/advise110.php | Governmental? related to several @ellenmmm Pulses reports one cited DoD /Pentagon", "Hostname www.govsuppliers1920.aot.com.au | www.curuzu.gov.ar", "Yara Detection: ProtectSharewareV11eCompservCMS | StringFileInfo@\u0001\u0001040904B04\u0014\u0001CompanyName", "Alerts: persistence_autorun antisandbox_mouse_hook infostealer_keylog stealth_hiddenreg", "Interesting Strings http://schemas.microsoft.com/cdo/configuration/", "leaplegalsoftwaremerch.brandedproducts.com.au", "https://otx.alienvault.com/indicator/file/6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "appleremotesupport.com | applesundermybed.com | appleid-secure-login.com", "teenfuckers.com | fuck.cloudflaressl.com | animefuck.org |", "blackteensexy.net | teenfuckers.com | teengayvideo.com | teensexporno.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Agent-678024", "display_name": "Win.Trojan.Agent-678024", "target": null }, { "id": "ZingoStealer", "display_name": "ZingoStealer", "target": null }, { "id": "Ginzo Stealer", "display_name": "Ginzo Stealer", "target": null }, { "id": "Trojan:Win32/Trickler", "display_name": "Trojan:Win32/Trickler", "target": "/malware/Trojan:Win32/Trickler" }, { "id": "Other:Malware-gen", "display_name": "Other:Malware-gen", "target": null }, { "id": "CVE-2002-0013", "display_name": "CVE-2002-0013", "target": null }, { "id": "Trojan:Win32/Msposer.I", "display_name": "Trojan:Win32/Msposer.I", "target": "/malware/Trojan:Win32/Msposer.I" }, { "id": "DoS:Win32/Rask", "display_name": "DoS:Win32/Rask", "target": "/malware/DoS:Win32/Rask" }, { "id": "Zeppelin", "display_name": "Zeppelin", "target": null }, { "id": "Win.Malware.Swisyn-9942393-0", "display_name": "Win.Malware.Swisyn-9942393-0", "target": null }, { "id": "TEL:HTML/MalvertWindowResize", "display_name": "TEL:HTML/MalvertWindowResize", "target": "/malware/TEL:HTML/MalvertWindowResize" } ], "attack_ids": [ { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1118", "name": "InstallUtil", "display_name": "T1118 - InstallUtil" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Healthcare", "Technology", "Legal", "Civilian Society" ], "TLP": "green", "cloned_from": "667f111dcdeeba812adc4fd4", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 239, "FileHash-SHA1": 234, "FileHash-SHA256": 775, "domain": 2293, "hostname": 1545, "URL": 1431, "email": 13, "SSLCertFingerprint": 10, "CVE": 1 }, "indicator_count": 6541, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "630 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456734&Signature=Twrc6n%2BEyYc3IkPf4BD0CucGYLqOW4lxcGi2ZNxHRk7tNezVNxxouYRnGIr3OFeByvpf87X6oDI2BVrHR8er8NmM4CFpWpyRrf7xJh%2FZ6Vca48ROgTEWVHlnjgW0jVMzSe9TZOnN3zpmnpw37X95of0%2BzE6e4Fpl96po0RZcvPRC0G%2BqbKKwb%2FhIAspbkpn76RKrHyf%2FCb8aZ21ec7FwUJa%2BAZ%2FolkR0TdqCHOXyBcBQQ5", "Interesting Strings http://schemas.microsoft.com/cdo/configuration/", "PROTOS Remote SNMP Attack Tool: https://otx.alienvault.com/indicator/cve/CVE-2002-0013", "NJRat IDS Detections: Observed Telegram API Domain (api .telegram .org in TLS SNI)", "Win.Ransomware.WannaCry-6313787-0 , Ransom:Win32/WannaCrypt.H IDS Detections Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE Probe MS17-010 (Generic Flags) Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware , WannaCry_Ransomware_Gen , WannaDecryptor , stack_string , MS17_010_WanaCry_worm More Alerts nids_exploit", "Zingo/GinzoStealer: FileHash-SHA1 72b5f7716dbf8e1e6fa26ef19a9d7f8970221300 trojan", "Alerts: persistence_autorun antisandbox_mouse_hook infostealer_keylog stealth_hiddenreg", "https://tulach.cc/", "blackteensexy.net | teenfuckers.com | teengayvideo.com | teensexporno.org", "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456178&Signature=veZ5ILWvDbljstqg4NlX%2Bxs8GT3FFuOKYzQc%2B27Rfrzrxz9KINRfg5iEd%2FTD%2FJh0%2Bq%2BUFppfHwGwnnMNhD99MoqLrX735IHzqHRH3Y%2BhrlHexlMj6uTX%2FhuA91WtmQoFu8u8NtWjsAldaYDAJjFHT7HCenKy%2BmD%2FVHzSvfzxaf4d%2FZtoqDdCpPzDigdhx%2BpKQUOSIw0wEDklMmjQ8OQnKdK9RXK5duMVg%2Fwd7u7HVHNa", "https://otx.alienvault.com/indicator/ip/110.238.1.102 | https://otx.alienvault.com/indicator/hostname/ninr.syslinx.com.au", "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI) 192.168.56.115", "Trojan:Win32/Trickler: FileHash-MD5 8d2a19ceb45e794e08e8c1588d22d242", "NJRat Alerts: dynamic_function_loading encrypted_ioc registers_vectored_exception_handler", "https://www.hybrid-analysis.com/sample/caeed78015e7bcdf122aa01354016e3057cae1b585a946086d2d69ff643e7e2c/667e87c7badf2ad3670bd6bb", "Trojan:Win32/Msposer.I: FileHash-MD5 e30112d853700a6e93bec678c1c0a538", "leaplegalsoftwaremerch.brandedproducts.com.au", "Trojans: 149.154.166.110 command_and_control (build your own telegram) 208.95.112.1 command_and_control", "https://www.turbo.net/run/videolan/vlc", "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to", "Zingo/GinzoStealer: FileHash-MD5 0b5fd8367272a6986f93af06faf977a9 trojan", "http://www.forensickb.com/2013/03/file-entropy-explained.html", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456802&Signature=imED1VqYi14phTIENcdipBYjA%2BPgkL01TfJ1OydtY11LRS0lWv7THCPLLrLTkqq5ZoqxfCHCpuGqhWbabkW%2FSywvmyfhLD8TAvNRo0A%2Fdc27m6nC815oX%2BMHPVKhiTkshZH2KFL5rPe%2FQN81hxksJ07blNlH%2FGB6mG4fnRkg4rmqjT0QFA0yYvzH0bBAtM5ZmMRpoIg7zab6oVeuUuqroFECb2%2Fl3KcRdgZm2RQcf%2BvoJW", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456905&Signature=RYIw5qZjecwIW0t7r5f%2BW29otPot2E4%2FAtLi37l8zcqFvx5%2B%2F9fgG%2B1Ay2Srf3y63cFKycTp%2BPmZvlwpImAkOOt4%2FBgJ7020dTOz%2FLOWUt6aeKt5xvjqwwkju5zlpLraECdTpENMPV436aJoAh1I2kbPY6oHixcY%2BW1t1E4XcpCMLPlEQOgQmoVly6vDIA4BFHjHbrRd%2FpgtZExPke2Y%2FXgggLW75UrBbd", "Trojan:Win32/Trickler: FileHash-SHA256 ccbb9ff792732151e9b57b30cb18bff96e63d5cec17fac1bd937ae5c49271699", "High Priority Alert: stealth_network modifies_certificates network_icmp", "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456268&Signature=r6fOkWGbwBX8z6YDvUFYQnPc8efKUXVyW0Ma97Qze1Gg5yigm12abg4Ohbydi7izPRODvv6sVLGy9Uj3%2FKSBJY3SoMgbLkj5YofXLKyp40m%2B32vj%2Boml5b0R%2FYrwd7rcA8dzMAuMKZpQ04wgR%2BiSh772Z%2BZ34H2CYZZnjpJoUC49ip8c4%2FUDETK%2BrFZMZqerVs2ONWDAzCMzN%2BvpWHlLkuAH7n2fTCOTvtO43TMqTzE5", "https://shift.gearboxsoftware.com/link", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456942&Signature=CyFvPFvbJhEdaWGF5he4cjzXT2%2FgvcmLJtVWaxv%2BNDzHPqLCNte56ZKxxP6mxUJPRZOpew0513JF50Ks8VL3kYoD566k1EAY27gm%2FdAS2N7xeaKV%2FdmihrhDfLdb2wqlXciSx3fb9Kf4z4T%2F4Kf9%2FSGh6lka0UFtlvIBzlq2OGtr0n6YEpVNHQG6L7jGn4adPJ1P8Zxb0ozprtOGnCXztODTwURwVPyD9asMhojWns2L1ssNl0rH0GQAAY", "NJRat Alerts: suspicious_command_tools antidebug_guardpages antisandbox_sleep", "NJRat IDS Detections: Telegram API Certificate Observed", "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before .", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456681&Signature=Mcrv0JEeKTzfxc7JwD4u6K1dNY8liXAX1tF2i91bXpymU0E%2FlRM95joj0ZuMk2A82ekHHzgKJbSxrkjVIutcPfV%2FYWPOj1or9HVjXg4Jq6QJb7fmWG5%2BqUxcfMqz8D7UN8v0FFVTc%2F%2FP3Sv3PpE3%2FKIhPcdMc1SodC9krYB%2Bbdj1obcveSDLlBtXgl9wP%2B7SuYub12drNzeyC9UKw%2FX0n7vZpU3JLAiYznAMTB", "https://www.virustotal.com/graph/g9155e32765e8465eb4c422d9abc5dcc8c830fa9dc83e40a99c0b1c6fb56e098c", "Yara Detections: Zeppelin_10 , Zeppelin_20 , ConventionEngine_Anomaly_MultiPDB_Double , MS_Visual_Cpp_2005", "Hostname www.govsuppliers1920.aot.com.au | www.curuzu.gov.ar", "Yara Detection: ProtectSharewareV11eCompservCMS | StringFileInfo@\u0001\u0001040904B04\u0014\u0001CompanyName", "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal", "https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f", "https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=+New+Worker+Online%0A+PC:+DESKTOP-BBE3PFV%0A+User:+alien%0A+IP:+Sweden%0A+Country:+SE+ Akamai rank: #2475\t URL https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=\\\\xfff0\\\\xff9f\\\\xff9f\\\\xffa2+New+Worker+Online%0A\\\\xfff0\\\\xff9f\\\\xff92\\\\xffbb+PC:+DESKTOP-BBE3PFV%0A\\\\xfff0\\\\xff9f\\\\xff91\\\\xffa4+User:+alien%0A\\\\xfff0\\\\xff9f\\\\xff8c\\\\xff9", "appleremotesupport.com | applesundermybed.com | appleid-secure-login.com", "EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.105\", \"dst_port\": 49317, \"sid\": 2025650, \"date\": \"2020/06/18 11:39:48\", \"dst_ip\": \"192.168.56.103\" }, \"type\": \"ioc\", \"description\": null }, { \"category\": \"suricata\", \"ioc\": { \"src_port\": 445, \"name\": \"ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.108\", \"dst_port\": 49324, ", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456701&Signature=t3Xqew0bsV61nmgncFTOCX%2FtqVKoAMgUft1dTGFLOFu7%2Fw4fbqeYn3laYdKEN6S%2BK7DF5nDi%2BN6pZq%2Be%2FsOZjAHgy821VBDeXqJaq6BdPAlT6fXrqDPaTghd9A00rdfDtOXh6Zy%2Bl5f16NPFVSl8FRZqU6GLhD%2B%2BSo%2FIP1XbQBHhcyOPh7nfc%2F8BxsyypNTadLDWEEJqVPSKFTVYwIagyVlTMD59xYMUtP8L2Ogdm9mJICbv", "https://vtbehaviour.commondatastorage.googleapis.com/0002815bed9019ec43e804f3eb7436b82b133ae60fce110cbbadae8ed8be5b3e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456853&Signature=ohh65FvVsmXmQYu%2BJk1T4eXJGcdQGvMivSh5TmeHZLoDT%2ByKeGjHrEPJLhUqlYbxRx8n2cI91TyF9CGdex%2F461K5YKhHcc1nzbCf%2BHknI5sKA%2FMDvRrmPb0DYDVnExub3GBqS92stLwDSfSKYmbg3%2Bewiypp3nNLEzgg1XFvXV%2Bu%2Bk%2F4EG8y495NBtU%2F5%2Fh3oLc%2F0NDQfdQWmwE%2FuiC9lWax%2FmZm7V2%2Bap03q3xN", "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "teenfuckers.com | fuck.cloudflaressl.com | animefuck.org |", "https://otx.alienvault.com/indicator/file/6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Zingo/GinzoStealer: FileHash-SHA256 015d67fcca9d2fa8e4ea8f8a2cb99dee5f0b4bf39898d160c27bc4e4c6ccd237 trojan", "NJRat Domains Contacted pastebin.com api.telegram.org", "Trojan:Win32/Msposer.I: FileHash-SHA1 410efb8108fdf5db106e1f6a3d7608355621562d", "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe", "NJRat Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert", "prometheus.shorty.cicloinfinito.com", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 alohatube.xyz \u2022 1001pornvideos.com", "192.168.122.200 BGP: Simulating Inter-network Dynamic Routing", "NJRat Alerts: http_request reads_memory_remote_process network_cnc_https_generic reads_self", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456766&Signature=fhEgpRoSszxXiIBuHWVEId9w1CwC9EnIKxPCKHEQMqEzppF90L%2B%2FlxW%2FywCNH6CMqGY1o9mJvTVmLXyypm1kzfmWsyA80dWPTGIRRYKfqvQ3Nng8wj93UHAEQuxrv4kfCNpUBBjn1WDnmQhRTooluOfdTIrQ10pjymrCYCKxOAFwm5bbvSKJ0%2BtX3rYiPf3fD%2BRRO9heg7G6MndwBJE2WMOzyy6vo8lgQCLwHAh4rCiDobnbPC8XTy6osE1J", "Installation/Persistence: \"Press_Release_99x180_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: N/A]", "NJRat Alerts: windows_defender_powershell network_document_file powershell_command_suspicious", "www.resident-physician-lawyer.com | HTTP/1.1 405 Not Allowed Server: awselb/2.0 Connection: keep alive WAFRule: 0", "DoS:Win32/Rask: http://karelinform.ru/news/world/02-06-2016/uchenye-raskryli-sekret-antirakovyh-svoystv-aspirina", "http://www.iss.net/security_center/alerts/advise110.php | Governmental? related to several @ellenmmm Pulses reports one cited DoD /Pentagon", "NJRat IDS Detections: Telegram API Domain in DNS Lookup", "Trojan:Win32/Msposer.I: FileHash-SHA256 6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Zingo/GinzoStealer: https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Bot: api-app-prod.wobot.ai | wizarbot.com | ipv4bot.whatismyipaddress.com", "Win.Packed.njRAT-10002074-1", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0816.pdf", "NJRat Alerts: hardware_id_profiling network_cnc_https_pastesite persistence_autorun", "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/", "https://otx.alienvault.com/indicator/ip/15.197.225.128", "NJRat Yara Detections: ByteCode_MSIL_Backdoor_AsyncRAT", "https://otx.alienvault.com/indicator/hostname/www.resident-physician-lawyer.com | www.thehealthlawfirm.com", "Trojan:Win32/Trickler: FileHash-SHA1 a461b60b2a82cdd560f96b2502a4b9b9ac98a7ed", "NJRat IP\u2019s Contacted 149.154.166.110 172.66.171.73", "Spy: app.zapspy.net | http://spywarefrance.com | spywarefrance.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Colorado Quasi Government | Workerk Compensation" ], "malware_families": [ "Backdoor:win32/berbew", "Win.trojan.generic-9878032-0", "Trojan:win32/zombie", "Trojan:win32/msposer.i", "Win.malware.score-6985947-1", "Win.ransomware.msilzilla-10014498-0", "Njrat", "Win.trojan.generic-9908396-0", "Zeppelin", "W32/wannacryptor.491a!tr.ransom", "Win.trojan.starter-171", "Ginzo stealer", "Ransom:win32/cve-2017-0147", "Dorv", "Exploit:linux/cve-2017-17215", "Win.packed.zpack-10013367-0", "Win.trojan.crypted-30", "Et", "Zingostealer", "Worm:win32/mofksys.rnd!mtb", "Nids", "Win.malware.swisyn-9942393-0", "Alf:pws:msil/stealgen.gc!mtb", "Malware packed", "Backdoor:win32/berbew.aa!mtb", "Win.exploit.rozena-10038302-0", "Other:malware-gen", "Zombie", "Pws:win32/zbot.ms!mtb", "Nemucod", "Trojanspy", "Gravityrat", "Dos:win32/rask", "Trojandropper:win32/vb.il", "Win.malware.pits-10035540-0", "Cve-2022-26134", "Win.trojan.barys-10005825-0", "Win.trojan.razy-10016933-0", "Trojan:win32/trickler", "Cve-2002-0013", "#lowfi:aggr:hstr:win32/possiblekeylogger.a", "Win.malware.renos-10003934-0", "Alf:trojan:win32/formbook.f!mtb", "Alf:heraklezeval:trojan:msil/gravityrat!rfn", "Private internet access", "Muldrop", "Berbew", "Cve-2023-4966", "Win.trojan.agent-678024", "Tel:html/malvertwindowresize", "Trojan:msil/agenttesla.dw!mtb", "Upatre" ], "industries": [ "Education", "Healthcare", "Telecommunications", "Civilian society", "Legal", "Technology" ], "unique_indicators": 65752 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/ssl.com", "whois": "http://whois.domaintools.com/ssl.com", "domain": "ssl.com", "hostname": "www.ssl.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "69d9b0e549af1aae2975ebeb", "name": "Virtual Servers \u2022 Tulach \u2022 Eternal Blue", "description": "Interesting. Further research required. \n\nhttps://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=+New+Worker+Online%0A+PC:+DESKTOP-BBE3PFV%0A+User:+alien%0A+IP:+Sweden%0A+Country:+SE+\n\n\nhttps://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=\\\\xfff0\\\\xff9f\\\\xff9f\\\\xffa2+New+Worker+Online%0A\\\\xfff0\\\\xff9f\\\\xff92\\\\xffbb+PC:+DESKTOP-BBE3PFV%0A\\\\xfff0\\\\xff9f\\\\xff91\\\\xffa4+User:+alien%0A\\\\xfff0\\\\xff9f\\\\xff8c\\\\xff90+IP:+Sweden%0A\\\\xfff0\\\\xff9f\\\\xff97\\\\xffba+Country:+SE+", "modified": "2026-04-11T02:24:37.102000", "created": "2026-04-11T02:24:37.102000", "tags": [ "related pulses", "apple", "imac", "itunes", "tulach", "active", "vercel", "ms windows", "intel", "yara rule", "lredmond", "rsds", "write c", "tls sni", "write", "install", "rijndael", "malware", "accept", "self", "mtb apr", "lowfi", "backdoor", "antigua", "trojandropper", "all ipv4", "urls", "prometheus", "files", "files ip", "address", "united", "unknown aaaa", "cname", "tags", "keepalived", "ip address", "red hat", "nat node", "gns3", "firefox", "ovn network", "instances", "forum", "linux", "dynamicloader", "exclusionpath", "medium", "high", "telegram api", "windows", "f rl", "highest sc", "guard", "april", "powershell", "c mar", "virtool", "c jan", "c dec", "urls show", "url hostname", "ransom", "click", "title", "njrat", "as64521i", "bird", "bgp", "virtual private", "virtual servers", "et exploit", "ms17010 echo", "response", "echo response", "asnone", "probe ms17010", "nids", "m2 ms17010", "regsetvalueexa", "service", "wannacry", "dock", "unknown", "learn", "ck id", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "found", "mitre att", "defense evasion", "sha1", "sha256", "size", "pattern match", "ascii text", "path", "stop", "hybrid", "general", "local", "twitter", "strings", "core", "telegram", "tools" ], "references": [ "Win.Ransomware.WannaCry-6313787-0 , Ransom:Win32/WannaCrypt.H IDS Detections Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE Probe MS17-010 (Generic Flags) Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware , WannaCry_Ransomware_Gen , WannaDecryptor , stack_string , MS17_010_WanaCry_worm More Alerts nids_exploit", "https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=+New+Worker+Online%0A+PC:+DESKTOP-BBE3PFV%0A+User:+alien%0A+IP:+Sweden%0A+Country:+SE+ Akamai rank: #2475\t URL https://api.telegram.org/bot8479694307:AAHBqcVtSCKfb3XApVQcVGpW7SFQgnxZJgM/sendMessage?chat_id=-1002760967718&text=\\\\xfff0\\\\xff9f\\\\xff9f\\\\xffa2+New+Worker+Online%0A\\\\xfff0\\\\xff9f\\\\xff92\\\\xffbb+PC:+DESKTOP-BBE3PFV%0A\\\\xfff0\\\\xff9f\\\\xff91\\\\xffa4+User:+alien%0A\\\\xfff0\\\\xff9f\\\\xff8c\\\\xff9", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0816.pdf", "https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f", "Trojans: 149.154.166.110 command_and_control (build your own telegram) 208.95.112.1 command_and_control", "prometheus.shorty.cicloinfinito.com", "Win.Packed.njRAT-10002074-1", "NJRat IDS Detections: Telegram API Domain in DNS Lookup", "NJRat IDS Detections: Observed Telegram API Domain (api .telegram .org in TLS SNI)", "NJRat IDS Detections: Telegram API Certificate Observed", "NJRat Yara Detections: ByteCode_MSIL_Backdoor_AsyncRAT", "NJRat Alerts: hardware_id_profiling network_cnc_https_pastesite persistence_autorun", "NJRat Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert", "NJRat Alerts: windows_defender_powershell network_document_file powershell_command_suspicious", "NJRat Alerts: suspicious_command_tools antidebug_guardpages antisandbox_sleep", "NJRat Alerts: dynamic_function_loading encrypted_ioc registers_vectored_exception_handler", "NJRat Alerts: http_request reads_memory_remote_process network_cnc_https_generic reads_self", "NJRat IP\u2019s Contacted 149.154.166.110 172.66.171.73", "NJRat Domains Contacted pastebin.com api.telegram.org", "192.168.122.200 BGP: Simulating Inter-network Dynamic Routing", "EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.105\", \"dst_port\": 49317, \"sid\": 2025650, \"date\": \"2020/06/18 11:39:48\", \"dst_ip\": \"192.168.56.103\" }, \"type\": \"ioc\", \"description\": null }, { \"category\": \"suricata\", \"ioc\": { \"src_port\": 445, \"name\": \"ET EXPLOIT ETERNALBLUE Probe Vulnerable System Response MS17-010\", \"src_ip\": \"192.168.56.108\", \"dst_port\": 49324, " ], "public": 1, "adversary": "", "targeted_countries": [ "Japan", "United States of America", "China" ], "malware_families": [ { "id": "Win.Trojan.Generic-9908396-0", "display_name": "Win.Trojan.Generic-9908396-0", "target": null }, { "id": "Win.Trojan.Crypted-30", "display_name": "Win.Trojan.Crypted-30", "target": null }, { "id": "Backdoor:Win32/Berbew", "display_name": "Backdoor:Win32/Berbew", "target": "/malware/Backdoor:Win32/Berbew" }, { "id": "Win.Malware.Score-6985947-1", "display_name": "Win.Malware.Score-6985947-1", "target": null }, { "id": "ALF:PWS:MSIL/Stealgen.GC!MTB", "display_name": "ALF:PWS:MSIL/Stealgen.GC!MTB", "target": null }, { "id": "Win.Packed.Zpack-10013367-0", "display_name": "Win.Packed.Zpack-10013367-0", "target": null }, { "id": "ALF:Trojan:Win32/FormBook.F!MTB", "display_name": "ALF:Trojan:Win32/FormBook.F!MTB", "target": null }, { "id": "Win.Malware.Renos-10003934-0", "display_name": "Win.Malware.Renos-10003934-0", "target": null }, { "id": "Win.Trojan.Razy-10016933-0", "display_name": "Win.Trojan.Razy-10016933-0", "target": null }, { "id": "#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.A", "display_name": "#Lowfi:AGGR:HSTR:Win32/PossibleKeylogger.A", "target": null }, { "id": "NJRat", "display_name": "NJRat", "target": null }, { "id": "NIDS", "display_name": "NIDS", "target": null }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Private Internet Access", "display_name": "Private Internet Access", "target": null }, { "id": "Malware Packed", "display_name": "Malware Packed", "target": null }, { "id": "W32/WannaCryptor.491A!tr.ransom", "display_name": "W32/WannaCryptor.491A!tr.ransom", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1094", "name": "Custom Command and Control Protocol", "display_name": "T1094 - Custom Command and Control Protocol" }, { "id": "T1584.003", "name": "Virtual Private Server", "display_name": "T1584.003 - Virtual Private Server" }, { "id": "TA0029", "name": "Privilege Escalation", "display_name": "TA0029 - Privilege Escalation" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" }, { "id": "T1144", "name": "Gatekeeper Bypass", "display_name": "T1144 - Gatekeeper Bypass" }, { "id": "T1003.008", "name": "/etc/passwd and /etc/shadow", "display_name": "T1003.008 - /etc/passwd and /etc/shadow" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [ "Telecommunications", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 556, "domain": 206, "URL": 863, "FileHash-SHA256": 1589, "IPv4": 519, "FileHash-MD5": 472, "FileHash-SHA1": 376, "SSLCertFingerprint": 11, "email": 1 }, "indicator_count": 4593, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d3522448a6a2faaa9fd792", "name": "VirusTotal report\n for download.js", "description": "><<< full report on Sigma, a new generation of malware, has been published on the website of the University of South Africa's Security Research Centre (Sarac), based in the capital, Pretoria.\u20ac>> united states. Beyond Theory. e p o a e . Epoch", "modified": "2026-04-06T06:26:44.786000", "created": "2026-04-06T06:26:44.786000", "tags": [ "mitre attack", "network info", "file type", "sigma", "program", "t1055 process", "overview", "dropped info", "processes extra", "overview zenbox", "malicious", "next", "in a", "create", "manager", "docker", "5 dev", "k8s configmap", "profiles", "etcd", "get https", "https", "refresh", "cookie", "ascii text", "crlf line", "text text", "ms windows", "vista event", "windows event", "thumbprint", "windows sandbox", "calls process", "pe file", "drops pe", "sample", "pe32", "spawns", "aslr", "persistence", "info", "creates", "performs dns", "default", "shell folders", "folders", "parent pid", "full path", "command line", "inprocserver32", "registry keys", "k netsvcs", "nothing", "mensaje", "wps office", "extra info", "drops", "defense evasion", "binary", "window" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456178&Signature=veZ5ILWvDbljstqg4NlX%2Bxs8GT3FFuOKYzQc%2B27Rfrzrxz9KINRfg5iEd%2FTD%2FJh0%2Bq%2BUFppfHwGwnnMNhD99MoqLrX735IHzqHRH3Y%2BhrlHexlMj6uTX%2FhuA91WtmQoFu8u8NtWjsAldaYDAJjFHT7HCenKy%2BmD%2FVHzSvfzxaf4d%2FZtoqDdCpPzDigdhx%2BpKQUOSIw0wEDklMmjQ8OQnKdK9RXK5duMVg%2Fwd7u7HVHNa", "https://vtbehaviour.commondatastorage.googleapis.com/026281c7651d49c77c597d1843578b4578deac3fb8c10be3977371f140b54690_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456268&Signature=r6fOkWGbwBX8z6YDvUFYQnPc8efKUXVyW0Ma97Qze1Gg5yigm12abg4Ohbydi7izPRODvv6sVLGy9Uj3%2FKSBJY3SoMgbLkj5YofXLKyp40m%2B32vj%2Boml5b0R%2FYrwd7rcA8dzMAuMKZpQ04wgR%2BiSh772Z%2BZ34H2CYZZnjpJoUC49ip8c4%2FUDETK%2BrFZMZqerVs2ONWDAzCMzN%2BvpWHlLkuAH7n2fTCOTvtO43TMqTzE5", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456681&Signature=Mcrv0JEeKTzfxc7JwD4u6K1dNY8liXAX1tF2i91bXpymU0E%2FlRM95joj0ZuMk2A82ekHHzgKJbSxrkjVIutcPfV%2FYWPOj1or9HVjXg4Jq6QJb7fmWG5%2BqUxcfMqz8D7UN8v0FFVTc%2F%2FP3Sv3PpE3%2FKIhPcdMc1SodC9krYB%2Bbdj1obcveSDLlBtXgl9wP%2B7SuYub12drNzeyC9UKw%2FX0n7vZpU3JLAiYznAMTB", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456701&Signature=t3Xqew0bsV61nmgncFTOCX%2FtqVKoAMgUft1dTGFLOFu7%2Fw4fbqeYn3laYdKEN6S%2BK7DF5nDi%2BN6pZq%2Be%2FsOZjAHgy821VBDeXqJaq6BdPAlT6fXrqDPaTghd9A00rdfDtOXh6Zy%2Bl5f16NPFVSl8FRZqU6GLhD%2B%2BSo%2FIP1XbQBHhcyOPh7nfc%2F8BxsyypNTadLDWEEJqVPSKFTVYwIagyVlTMD59xYMUtP8L2Ogdm9mJICbv", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456734&Signature=Twrc6n%2BEyYc3IkPf4BD0CucGYLqOW4lxcGi2ZNxHRk7tNezVNxxouYRnGIr3OFeByvpf87X6oDI2BVrHR8er8NmM4CFpWpyRrf7xJh%2FZ6Vca48ROgTEWVHlnjgW0jVMzSe9TZOnN3zpmnpw37X95of0%2BzE6e4Fpl96po0RZcvPRC0G%2BqbKKwb%2FhIAspbkpn76RKrHyf%2FCb8aZ21ec7FwUJa%2BAZ%2FolkR0TdqCHOXyBcBQQ5", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456766&Signature=fhEgpRoSszxXiIBuHWVEId9w1CwC9EnIKxPCKHEQMqEzppF90L%2B%2FlxW%2FywCNH6CMqGY1o9mJvTVmLXyypm1kzfmWsyA80dWPTGIRRYKfqvQ3Nng8wj93UHAEQuxrv4kfCNpUBBjn1WDnmQhRTooluOfdTIrQ10pjymrCYCKxOAFwm5bbvSKJ0%2BtX3rYiPf3fD%2BRRO9heg7G6MndwBJE2WMOzyy6vo8lgQCLwHAh4rCiDobnbPC8XTy6osE1J", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456802&Signature=imED1VqYi14phTIENcdipBYjA%2BPgkL01TfJ1OydtY11LRS0lWv7THCPLLrLTkqq5ZoqxfCHCpuGqhWbabkW%2FSywvmyfhLD8TAvNRo0A%2Fdc27m6nC815oX%2BMHPVKhiTkshZH2KFL5rPe%2FQN81hxksJ07blNlH%2FGB6mG4fnRkg4rmqjT0QFA0yYvzH0bBAtM5ZmMRpoIg7zab6oVeuUuqroFECb2%2Fl3KcRdgZm2RQcf%2BvoJW", "https://vtbehaviour.commondatastorage.googleapis.com/0002815bed9019ec43e804f3eb7436b82b133ae60fce110cbbadae8ed8be5b3e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456853&Signature=ohh65FvVsmXmQYu%2BJk1T4eXJGcdQGvMivSh5TmeHZLoDT%2ByKeGjHrEPJLhUqlYbxRx8n2cI91TyF9CGdex%2F461K5YKhHcc1nzbCf%2BHknI5sKA%2FMDvRrmPb0DYDVnExub3GBqS92stLwDSfSKYmbg3%2Bewiypp3nNLEzgg1XFvXV%2Bu%2Bk%2F4EG8y495NBtU%2F5%2Fh3oLc%2F0NDQfdQWmwE%2FuiC9lWax%2FmZm7V2%2Bap03q3xN", "https://vtbehaviour.commondatastorage.googleapis.com/0000e8cff55bbade9d37b4ab17e56adba1680091d209830945cc26c9d58d6a9d_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456905&Signature=RYIw5qZjecwIW0t7r5f%2BW29otPot2E4%2FAtLi37l8zcqFvx5%2B%2F9fgG%2B1Ay2Srf3y63cFKycTp%2BPmZvlwpImAkOOt4%2FBgJ7020dTOz%2FLOWUt6aeKt5xvjqwwkju5zlpLraECdTpENMPV436aJoAh1I2kbPY6oHixcY%2BW1t1E4XcpCMLPlEQOgQmoVly6vDIA4BFHjHbrRd%2FpgtZExPke2Y%2FXgggLW75UrBbd", "https://vtbehaviour.commondatastorage.googleapis.com/0000fd39c79ba7e0b6f7ed3a181308cb8ac141672370d8f2f2e2f5faba8f93eb_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775456942&Signature=CyFvPFvbJhEdaWGF5he4cjzXT2%2FgvcmLJtVWaxv%2BNDzHPqLCNte56ZKxxP6mxUJPRZOpew0513JF50Ks8VL3kYoD566k1EAY27gm%2FdAS2N7xeaKV%2FdmihrhDfLdb2wqlXciSx3fb9Kf4z4T%2F4Kf9%2FSGh6lka0UFtlvIBzlq2OGtr0n6YEpVNHQG6L7jGn4adPJ1P8Zxb0ozprtOGnCXztODTwURwVPyD9asMhojWns2L1ssNl0rH0GQAAY" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 26, "FileHash-SHA1": 30, "FileHash-SHA256": 143, "IPv4": 67, "URL": 103, "domain": 19, "hostname": 130, "email": 2 }, "indicator_count": 520, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "14 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "690a2c38de1708af54217faa", "name": "Access Token used to steal security credentials & hack and ride DND of targeted individuals", "description": "- https://shift.gearboxsoftware.com/link\n- Found embedded in targets phone.\n\nAccess Token used to steal security credentials & hack and ride DND of targeted individuals device. \nTAM Legal \u2022 Tulach \u2022 Hall Render \u2022 Quasi Government | Some type of Foundry user account found. \n\nStop illegally \n stalking, harassment, attempts, hacking, death threats. . Because the Colorado government allowing entities like this to operate without any type of rules, oversight or boundaries \nMILLION$ were wasted in your own fraud, waste in abuse scheme. AT&T , CrowdStrike , United Healthcare , UC Healthcare, Intermountain Health, T-Mobile, Amazon East, the Colorado Government itself, Medicare and Medicaid. For what? You have zero talent so you take it from those who do. You have nothing coming to you so you steal it from those who do. Is this somehow legal? \n#contacted #all_hosts backdoor #ransomware #cve #usa #american_terrorists #workers_compenstation_abuse #silencing #targeting #hitmen #illegal #malvertizing #aws_dns", "modified": "2025-12-04T15:01:02.531000", "created": "2025-11-04T16:39:20.035000", "tags": [ "present aug", "moved", "encrypt", "present jul", "passive dns", "ipv4 add", "reverse dns", "united states", "present may", "ip address", "gmt content", "ipv4", "all ipv4", "america", "united", "present oct", "name servers", "redacted for", "emails", "for privacy", "unknown ns", "unknown aaaa", "dynamicloader", "focus region", "unicode text", "utf16", "ms windows", "bokeh onlycanon", "zeiss jena", "mcsonnar", "high", "win64", "stream", "write", "smartassembly", "trailer", "next", "search", "medium", "as15169", "write c", "reads", "team", "malware", "local", "yara detections", "delphi", "strings", "dcom", "form", "trojandropper", "mtb nov", "backdoor", "otx telemetry", "trojan", "type", "data upload", "extraction", "ol rop", "hash avast", "avg clamav", "msdefender nov", "win32upatre nov", "win32berbew nov", "dynamic", "pe section", "error", "close", "status", "urls", "expiration date", "hostname", "url analysis", "yara rule", "show", "binary file", "wine emulator", "mtb oct", "files", "denmark asn", "as32934", "candyopen", "possible", "smoke loader", "trojanspy", "filehash", "pulses otx", "related tags", "file type", "no analysis", "available", "api key", "screenshots", "present nov", "aaaa", "mtb may", "mexico", "hostname add", "registrar", "domain add", "location united", "email add", "none related", "domains", "email domain", "service", "domain", "america flag", "body", "title", "aws dns", "next associated", "risepro", "guard", "v full", "reports v", "t1059 shared", "modules", "t1129 system", "t1569", "help v", "t1179 boot", "logon autost", "encoding", "packing f0001", "hidden files", "e1203 windows", "file attributes", "registry value", "catalog tree", "analysis ob0001", "evasion b0003", "virtual machine", "ip traffic", "memory pattern", "pattern urls", "tls sni", "get https", "post https", "named pipe", "delete c", "radar", "defender", "format", "learn", "command", "ck id", "name tactics", "suspicious", "informative", "spawns", "mitre att", "ck techniques", "evasion att", "country", "contacted hosts", "process details", "flag", "globalc", "intel", "win32", "worm", "path", "explorer", "script", "href", "external", "html content", "tulach", "hallrender", "tam legal", "brian sabey", "christopher ahmann", "apple", "msie", "chrome", "ascio", "creation date", "date", "germany unknown", "germany asn", "files ip", "address", "asn as24940", "less", "script urls", "a domains", "prox", "dennis schrder", "meta", "apache", "99u25f.exe", "entries", "as24940 hetzner", "dns resolutions", "status code", "body length", "kb body", "software/ hardware", "external-resources", "password-input", "overview", "colorado" ], "references": [ "https://shift.gearboxsoftware.com/link", "https://tulach.cc/", "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 alohatube.xyz \u2022 1001pornvideos.com", "x402.porn \u2022 http://alohatube.xyz/search/tsara-brashears \u2022 \thttps://ufovpn.io/blog/is-eporner-safe", "https://www.turbo.net/run/videolan/vlc", "http://www.forensickb.com/2013/03/file-entropy-explained.html", "https://www.xlabs.com.br/blog/cve-2013-3304-dell-equallogic-directory-traversal/ \u2022 http://cve.phidias.com/", "Overview \"Keeping money\" by the Colorado workers' compensation system can refer to", "legal deductions, legitimate reasons for payment delays or denial, or potential issues that require legal", "counsel. The system does not \"keep\" money without a valid reason.Lies. they\u2019ve Ben in trouble before ." ], "public": 1, "adversary": "Colorado Quasi Government | Workerk Compensation", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Generic-9878032-0", "display_name": "Win.Trojan.Generic-9878032-0", "target": null }, { "id": "Win.Trojan.Starter-171", "display_name": "Win.Trojan.Starter-171", "target": null }, { "id": "GravityRAT", "display_name": "GravityRAT", "target": null }, { "id": "Backdoor:Win32/Berbew.AA!MTB", "display_name": "Backdoor:Win32/Berbew.AA!MTB", "target": "/malware/Backdoor:Win32/Berbew.AA!MTB" }, { "id": "Trojan:MSIL/AgentTesla.DW!MTB", "display_name": "Trojan:MSIL/AgentTesla.DW!MTB", "target": "/malware/Trojan:MSIL/AgentTesla.DW!MTB" }, { "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "target": null }, { "id": "Trojandropper:Win32/VB.IL", "display_name": "Trojandropper:Win32/VB.IL", "target": "/malware/Trojandropper:Win32/VB.IL" }, { "id": "Nemucod", "display_name": "Nemucod", "target": null }, { "id": "Berbew", "display_name": "Berbew", "target": null }, { "id": "PWS:Win32/Zbot.MS!MTB", "display_name": "PWS:Win32/Zbot.MS!MTB", "target": "/malware/PWS:Win32/Zbot.MS!MTB" }, { "id": "Win.Trojan.Barys-10005825-0", "display_name": "Win.Trojan.Barys-10005825-0", "target": null }, { "id": "Upatre", "display_name": "Upatre", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Win.Exploit.Rozena-10038302-0", "display_name": "Win.Exploit.Rozena-10038302-0", "target": null }, { "id": "Zombie", "display_name": "Zombie", "target": null }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" }, { "id": "Muldrop", "display_name": "Muldrop", "target": null }, { "id": "Worm:Win32/Mofksys.RND!MTB", "display_name": "Worm:Win32/Mofksys.RND!MTB", "target": "/malware/Worm:Win32/Mofksys.RND!MTB" }, { "id": "Dorv", "display_name": "Dorv", "target": null }, { "id": "Win.Malware.Pits-10035540-0", "display_name": "Win.Malware.Pits-10035540-0", "target": null }, { "id": "Win.Ransomware.Msilzilla-10014498-0", "display_name": "Win.Ransomware.Msilzilla-10014498-0", "target": null }, { "id": "CVE-2023-4966", "display_name": "CVE-2023-4966", "target": null }, { "id": "Exploit:Linux/CVE-2017-17215", "display_name": "Exploit:Linux/CVE-2017-17215", "target": "/malware/Exploit:Linux/CVE-2017-17215" }, { "id": "Ransom:Win32/CVE-2017-0147", "display_name": "Ransom:Win32/CVE-2017-0147", "target": "/malware/Ransom:Win32/CVE-2017-0147" }, { "id": "CVE-2022-26134", "display_name": "CVE-2022-26134", "target": null } ], "attack_ids": [ { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1457", "name": "Malicious Media Content", "display_name": "T1457 - Malicious Media Content" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6051, "hostname": 2627, "FileHash-MD5": 401, "FileHash-SHA1": 257, "email": 11, "domain": 1838, "FileHash-SHA256": 1742, "CVE": 4, "SSLCertFingerprint": 3 }, "indicator_count": 12934, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "689d5115ad786de4ff048e5b", "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker", "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access", "modified": "2025-09-13T02:00:42.729000", "created": "2025-08-14T02:59:33.036000", "tags": [ "url https", "url http", "search", "type indicator", "role title", "added active", "related pulses", "showing", "entries", "present sep", "united", "present aug", "present jul", "present jun", "moved", "unknown ns", "present may", "present apr", "passive dns", "date", "encrypt", "body", "cookie", "gmt server", "content type", "dynamicloader", "medium", "x17x03x01", "download studio", "high", "read c", "show", "windows", "copy", "powershell", "write", "anomaly", "next", "unknown", "next associated", "urls show", "date checked", "url hostname", "server response", "ip address", "google safe", "yara detections", "delphi", "codeoverlap", "win32", "rgba", "memcommit", "delete", "png image", "hash", "dock", "execution", "malware", "wine emulator", "dynamic", "msie", "windows nt", "wow64", "slcc2", "media center", "capture", "persistence", "sha256", "submitted", "copy md5", "copy sha1", "copy sha256", "sha1", "script", "mitre att", "ck id", "show technique", "ck matrix", "null", "august", "span", "refresh", "meta", "mirai", "february", "april", "june", "hybrid", "general", "local", "path", "click", "strings", "error", "tools", "caribe", "rest", "accept", "friday", "look", "verify", "restart" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6211, "domain": 682, "hostname": 1661, "FileHash-MD5": 117, "FileHash-SHA1": 100, "FileHash-SHA256": 1386, "SSLCertFingerprint": 5 }, "indicator_count": 10162, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "219 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67b0911d4395f91b8fdac730", "name": "lumma", "description": "", "modified": "2025-07-07T00:26:37.681000", "created": "2025-02-15T13:05:33.258000", "tags": [], "references": [ "https://www.virustotal.com/graph/g9155e32765e8465eb4c422d9abc5dcc8c830fa9dc83e40a99c0b1c6fb56e098c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 38, "URL": 138, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 253, "hostname": 20 }, "indicator_count": 475, "is_author": false, "is_subscribing": null, "subscriber_count": 178, "modified_text": "287 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "553 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "667f111dcdeeba812adc4fd4", "name": "DoS:Win32/Rask | ZingoStealer | Used by Law/Legal/Tesms/Gov/IBM", "description": "It sure takes a lot to make, framing, spying, shadowing look like an investigation. I can't help but notice the excessive gay, teen porn and blackpu**y love.", "modified": "2024-07-28T18:04:28.664000", "created": "2024-06-28T19:38:05.236000", "tags": [ "historical ssl", "threat network", "infrastructure", "discord bots", "ualberta tld", "cobalt strike", "data redacted", "cloudflare", "code", "server", "registrar abuse", "admin country", "registrant name", "registry domain", "dnssec", "billing country", "date", "dns replication", "aaaa", "record type", "ttl value", "domain status", "registrant fax", "registrar url", "whois lookup", "dynamicloader", "show", "search", "adobe reader", "copy", "dynamic", "adobe", "incorporated", "read", "write", "read c", "write c", "delete c", "memcommit", "medium", "time stamping", "united", "domain", "persistence", "execution", "malware", "suspicious", "encrypt", "referrer", "first", "utc submissions", "submitters", "domains", "csc corporate", "scaleway", "tucows", "google", "dynadot llc", "amazon02", "facebook", "level3", "lineargradient", "png image", "ascii text", "pattern match", "ff6633", "mitre att", "rgba", "path", "ck id", "show technique", "mask", "june", "hybrid", "local", "click", "strings", "body", "stop", "enterprise", "rask", "abcd", "yara detections", "tls sni", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "malicious ids", "as17667", "passive dns", "content type", "title", "scan endpoints", "all scoreblue", "ipv4", "pulse submit", "url analysis", "urls", "as37153", "south africa", "unknown", "files", "status", "showing", "record value", "for privacy", "redacted for", "entity", "as49505", "russia unknown", "servers", "script urls", "health law", "meta", "a domains", "providers", "state server", "internalname", "legalcopyright", "filehash", "entries", "zeppelin20", "total", "trojan", "gmt content", "vercel x", "refresh", "time", "antivirus", "win32trickler", "targeted", "oval oval", "cve cve20020013", "exploits", "cve overview", "vulnerabilities", "protos", "shadow", "quasi", "creation date", "as706", "as15293", "cname", "expiration date", "as14870 flexera", "hilgraeve", "virgin islands", "as19905", "as16276", "france unknown", "canada unknown", "next", "hostname", "expiration", "ibm", "x force", "components", "installs", "high", "explorer", "anomalous file", "as44273 host", "certificate", "as54113", "name servers", "moved", "asnone united", "apple", "apple remote", "apple spy", "abuse", "as22612", "as397240", "as19527 google", "nxdomain", "whitelisted", "aaaa nxdomain", "as21342", "a nxdomain", "ns nxdomain", "teenfuckers.com", "fuck", "fuck team", "dod", "teen porn", "malvertising", "framing", "killers", "hitmen", "stalkers", "orbiters", "fake date", "date app", "blind install", "government", "dark" ], "references": [ "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Yara Detections: Zeppelin_10 , Zeppelin_20 , ConventionEngine_Anomaly_MultiPDB_Double , MS_Visual_Cpp_2005", "High Priority Alert: stealth_network modifies_certificates network_icmp", "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI) 192.168.56.115", "Zingo/GinzoStealer: FileHash-SHA256 015d67fcca9d2fa8e4ea8f8a2cb99dee5f0b4bf39898d160c27bc4e4c6ccd237 trojan", "Zingo/GinzoStealer: FileHash-MD5 0b5fd8367272a6986f93af06faf977a9 trojan", "Zingo/GinzoStealer: FileHash-SHA1 72b5f7716dbf8e1e6fa26ef19a9d7f8970221300 trojan", "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Zingo/GinzoStealer: https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "https://www.hybrid-analysis.com/sample/caeed78015e7bcdf122aa01354016e3057cae1b585a946086d2d69ff643e7e2c/667e87c7badf2ad3670bd6bb", "Installation/Persistence: \"Press_Release_99x180_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: N/A]", "https://otx.alienvault.com/indicator/ip/110.238.1.102 | https://otx.alienvault.com/indicator/hostname/ninr.syslinx.com.au", "https://otx.alienvault.com/indicator/ip/15.197.225.128", "www.resident-physician-lawyer.com | HTTP/1.1 405 Not Allowed Server: awselb/2.0 Connection: keep alive WAFRule: 0", "https://otx.alienvault.com/indicator/hostname/www.resident-physician-lawyer.com | www.thehealthlawfirm.com", "Trojan:Win32/Trickler: FileHash-SHA256 ccbb9ff792732151e9b57b30cb18bff96e63d5cec17fac1bd937ae5c49271699", "Trojan:Win32/Trickler: FileHash-MD5 8d2a19ceb45e794e08e8c1588d22d242", "Trojan:Win32/Trickler: FileHash-SHA1 a461b60b2a82cdd560f96b2502a4b9b9ac98a7ed", "Trojan:Win32/Msposer.I: FileHash-SHA256 6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Trojan:Win32/Msposer.I: FileHash-MD5 e30112d853700a6e93bec678c1c0a538", "Trojan:Win32/Msposer.I: FileHash-SHA1 410efb8108fdf5db106e1f6a3d7608355621562d", "DoS:Win32/Rask: http://karelinform.ru/news/world/02-06-2016/uchenye-raskryli-sekret-antirakovyh-svoystv-aspirina", "PROTOS Remote SNMP Attack Tool: https://otx.alienvault.com/indicator/cve/CVE-2002-0013", "Bot: api-app-prod.wobot.ai | wizarbot.com | ipv4bot.whatismyipaddress.com", "Spy: app.zapspy.net | http://spywarefrance.com | spywarefrance.com", "http://www.iss.net/security_center/alerts/advise110.php | Governmental? related to several @ellenmmm Pulses reports one cited DoD /Pentagon", "Hostname www.govsuppliers1920.aot.com.au | www.curuzu.gov.ar", "Yara Detection: ProtectSharewareV11eCompservCMS | StringFileInfo@\u0001\u0001040904B04\u0014\u0001CompanyName", "Alerts: persistence_autorun antisandbox_mouse_hook infostealer_keylog stealth_hiddenreg", "Interesting Strings http://schemas.microsoft.com/cdo/configuration/", "leaplegalsoftwaremerch.brandedproducts.com.au", "https://otx.alienvault.com/indicator/file/6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "appleremotesupport.com | applesundermybed.com | appleid-secure-login.com", "teenfuckers.com | fuck.cloudflaressl.com | animefuck.org |", "blackteensexy.net | teenfuckers.com | teengayvideo.com | teensexporno.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Agent-678024", "display_name": "Win.Trojan.Agent-678024", "target": null }, { "id": "ZingoStealer", "display_name": "ZingoStealer", "target": null }, { "id": "Ginzo Stealer", "display_name": "Ginzo Stealer", "target": null }, { "id": "Trojan:Win32/Trickler", "display_name": "Trojan:Win32/Trickler", "target": "/malware/Trojan:Win32/Trickler" }, { "id": "Other:Malware-gen", "display_name": "Other:Malware-gen", "target": null }, { "id": "CVE-2002-0013", "display_name": "CVE-2002-0013", "target": null }, { "id": "Trojan:Win32/Msposer.I", "display_name": "Trojan:Win32/Msposer.I", "target": "/malware/Trojan:Win32/Msposer.I" }, { "id": "DoS:Win32/Rask", "display_name": "DoS:Win32/Rask", "target": "/malware/DoS:Win32/Rask" }, { "id": "Zeppelin", "display_name": "Zeppelin", "target": null }, { "id": "Win.Malware.Swisyn-9942393-0", "display_name": "Win.Malware.Swisyn-9942393-0", "target": null }, { "id": "TEL:HTML/MalvertWindowResize", "display_name": "TEL:HTML/MalvertWindowResize", "target": "/malware/TEL:HTML/MalvertWindowResize" } ], "attack_ids": [ { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1118", "name": "InstallUtil", "display_name": "T1118 - InstallUtil" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Healthcare", "Technology", "Legal", "Civilian Society" ], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 239, "FileHash-SHA1": 234, "FileHash-SHA256": 775, "domain": 2293, "hostname": 1545, "URL": 1431, "email": 13, "SSLCertFingerprint": 10, "CVE": 1 }, "indicator_count": 6541, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "630 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6681f3f6b512c5b6aacffa39", "name": "DoS:Win32/Rask | ZingoStealer | Used by Law/Legal/Tesms/Gov/IBM ", "description": "", "modified": "2024-07-28T18:04:28.664000", "created": "2024-07-01T00:10:30.700000", "tags": [ "historical ssl", "threat network", "infrastructure", "discord bots", "ualberta tld", "cobalt strike", "data redacted", "cloudflare", "code", "server", "registrar abuse", "admin country", "registrant name", "registry domain", "dnssec", "billing country", "date", "dns replication", "aaaa", "record type", "ttl value", "domain status", "registrant fax", "registrar url", "whois lookup", "dynamicloader", "show", "search", "adobe reader", "copy", "dynamic", "adobe", "incorporated", "read", "write", "read c", "write c", "delete c", "memcommit", "medium", "time stamping", "united", "domain", "persistence", "execution", "malware", "suspicious", "encrypt", "referrer", "first", "utc submissions", "submitters", "domains", "csc corporate", "scaleway", "tucows", "google", "dynadot llc", "amazon02", "facebook", "level3", "lineargradient", "png image", "ascii text", "pattern match", "ff6633", "mitre att", "rgba", "path", "ck id", "show technique", "mask", "june", "hybrid", "local", "click", "strings", "body", "stop", "enterprise", "rask", "abcd", "yara detections", "tls sni", "pulse pulses", "av detections", "ids detections", "alerts", "analysis date", "file score", "malicious ids", "as17667", "passive dns", "content type", "title", "scan endpoints", "all scoreblue", "ipv4", "pulse submit", "url analysis", "urls", "as37153", "south africa", "unknown", "files", "status", "showing", "record value", "for privacy", "redacted for", "entity", "as49505", "russia unknown", "servers", "script urls", "health law", "meta", "a domains", "providers", "state server", "internalname", "legalcopyright", "filehash", "entries", "zeppelin20", "total", "trojan", "gmt content", "vercel x", "refresh", "time", "antivirus", "win32trickler", "targeted", "oval oval", "cve cve20020013", "exploits", "cve overview", "vulnerabilities", "protos", "shadow", "quasi", "creation date", "as706", "as15293", "cname", "expiration date", "as14870 flexera", "hilgraeve", "virgin islands", "as19905", "as16276", "france unknown", "canada unknown", "next", "hostname", "expiration", "ibm", "x force", "components", "installs", "high", "explorer", "anomalous file", "as44273 host", "certificate", "as54113", "name servers", "moved", "asnone united", "apple", "apple remote", "apple spy", "abuse", "as22612", "as397240", "as19527 google", "nxdomain", "whitelisted", "aaaa nxdomain", "as21342", "a nxdomain", "ns nxdomain", "teenfuckers.com", "fuck", "fuck team", "dod", "teen porn", "malvertising", "framing", "killers", "hitmen", "stalkers", "orbiters", "fake date", "date app", "blind install", "government", "dark" ], "references": [ "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Yara Detections: Zeppelin_10 , Zeppelin_20 , ConventionEngine_Anomaly_MultiPDB_Double , MS_Visual_Cpp_2005", "High Priority Alert: stealth_network modifies_certificates network_icmp", "ET TROJAN Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI) 192.168.56.115", "Zingo/GinzoStealer: FileHash-SHA256 015d67fcca9d2fa8e4ea8f8a2cb99dee5f0b4bf39898d160c27bc4e4c6ccd237 trojan", "Zingo/GinzoStealer: FileHash-MD5 0b5fd8367272a6986f93af06faf977a9 trojan", "Zingo/GinzoStealer: FileHash-SHA1 72b5f7716dbf8e1e6fa26ef19a9d7f8970221300 trojan", "https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "Zingo/GinzoStealer: https://otx.alienvault.com/indicator/file/4fcfe3c9358a6ece8fe1406be7790a72db6665206e87dd06cdb17d130498e47a", "https://www.hybrid-analysis.com/sample/caeed78015e7bcdf122aa01354016e3057cae1b585a946086d2d69ff643e7e2c/667e87c7badf2ad3670bd6bb", "Installation/Persistence: \"Press_Release_99x180_1_.svg\" has type \"SVG Scalable Vector Graphics image\"- [targetUID: N/A]", "https://otx.alienvault.com/indicator/ip/110.238.1.102 | https://otx.alienvault.com/indicator/hostname/ninr.syslinx.com.au", "https://otx.alienvault.com/indicator/ip/15.197.225.128", "www.resident-physician-lawyer.com | HTTP/1.1 405 Not Allowed Server: awselb/2.0 Connection: keep alive WAFRule: 0", "https://otx.alienvault.com/indicator/hostname/www.resident-physician-lawyer.com | www.thehealthlawfirm.com", "Trojan:Win32/Trickler: FileHash-SHA256 ccbb9ff792732151e9b57b30cb18bff96e63d5cec17fac1bd937ae5c49271699", "Trojan:Win32/Trickler: FileHash-MD5 8d2a19ceb45e794e08e8c1588d22d242", "Trojan:Win32/Trickler: FileHash-SHA1 a461b60b2a82cdd560f96b2502a4b9b9ac98a7ed", "Trojan:Win32/Msposer.I: FileHash-SHA256 6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "Trojan:Win32/Msposer.I: FileHash-MD5 e30112d853700a6e93bec678c1c0a538", "Trojan:Win32/Msposer.I: FileHash-SHA1 410efb8108fdf5db106e1f6a3d7608355621562d", "DoS:Win32/Rask: http://karelinform.ru/news/world/02-06-2016/uchenye-raskryli-sekret-antirakovyh-svoystv-aspirina", "PROTOS Remote SNMP Attack Tool: https://otx.alienvault.com/indicator/cve/CVE-2002-0013", "Bot: api-app-prod.wobot.ai | wizarbot.com | ipv4bot.whatismyipaddress.com", "Spy: app.zapspy.net | http://spywarefrance.com | spywarefrance.com", "http://www.iss.net/security_center/alerts/advise110.php | Governmental? related to several @ellenmmm Pulses reports one cited DoD /Pentagon", "Hostname www.govsuppliers1920.aot.com.au | www.curuzu.gov.ar", "Yara Detection: ProtectSharewareV11eCompservCMS | StringFileInfo@\u0001\u0001040904B04\u0014\u0001CompanyName", "Alerts: persistence_autorun antisandbox_mouse_hook infostealer_keylog stealth_hiddenreg", "Interesting Strings http://schemas.microsoft.com/cdo/configuration/", "leaplegalsoftwaremerch.brandedproducts.com.au", "https://otx.alienvault.com/indicator/file/6aad634cd39d45d3e03c9cd3791b82efc66da624902ac8d9a6dd109c16701694", "appleremotesupport.com | applesundermybed.com | appleid-secure-login.com", "teenfuckers.com | fuck.cloudflaressl.com | animefuck.org |", "blackteensexy.net | teenfuckers.com | teengayvideo.com | teensexporno.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Agent-678024", "display_name": "Win.Trojan.Agent-678024", "target": null }, { "id": "ZingoStealer", "display_name": "ZingoStealer", "target": null }, { "id": "Ginzo Stealer", "display_name": "Ginzo Stealer", "target": null }, { "id": "Trojan:Win32/Trickler", "display_name": "Trojan:Win32/Trickler", "target": "/malware/Trojan:Win32/Trickler" }, { "id": "Other:Malware-gen", "display_name": "Other:Malware-gen", "target": null }, { "id": "CVE-2002-0013", "display_name": "CVE-2002-0013", "target": null }, { "id": "Trojan:Win32/Msposer.I", "display_name": "Trojan:Win32/Msposer.I", "target": "/malware/Trojan:Win32/Msposer.I" }, { "id": "DoS:Win32/Rask", "display_name": "DoS:Win32/Rask", "target": "/malware/DoS:Win32/Rask" }, { "id": "Zeppelin", "display_name": "Zeppelin", "target": null }, { "id": "Win.Malware.Swisyn-9942393-0", "display_name": "Win.Malware.Swisyn-9942393-0", "target": null }, { "id": "TEL:HTML/MalvertWindowResize", "display_name": "TEL:HTML/MalvertWindowResize", "target": "/malware/TEL:HTML/MalvertWindowResize" } ], "attack_ids": [ { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1478", "name": "Install Insecure or Malicious Configuration", "display_name": "T1478 - Install Insecure or Malicious Configuration" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1118", "name": "InstallUtil", "display_name": "T1118 - InstallUtil" }, { "id": "T1056.001", "name": "Keylogging", "display_name": "T1056.001 - Keylogging" }, { "id": "T1589", "name": "Gather Victim Identity Information", "display_name": "T1589 - Gather Victim Identity Information" }, { "id": "T1590", "name": "Gather Victim Network Information", "display_name": "T1590 - Gather Victim Network Information" }, { "id": "T1591", "name": "Gather Victim Org Information", "display_name": "T1591 - Gather Victim Org Information" }, { "id": "T1528", "name": "Steal Application Access Token", "display_name": "T1528 - Steal Application Access Token" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [ "Healthcare", "Technology", "Legal", "Civilian Society" ], "TLP": "green", "cloned_from": "667f111dcdeeba812adc4fd4", "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 239, "FileHash-SHA1": 234, "FileHash-SHA256": 775, "domain": 2293, "hostname": 1545, "URL": 1431, "email": 13, "SSLCertFingerprint": 10, "CVE": 1 }, "indicator_count": 6541, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "630 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.ssl.com/repository0", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.ssl.com/repository0", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776681589.7661803 }