{ "type": "Domain", "indicator": "lelongtips.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/lelongtips.com", "alexa": "http://www.alexa.com/siteinfo/lelongtips.com", "indicator": "lelongtips.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4132896508, "indicator": "lelongtips.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "693de4a8a72cf95b028365f0", "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee", "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets", "modified": "2026-01-12T21:02:35.560000", "created": "2025-12-13T22:11:52.474000", "tags": [ "network", "ip address", "subnet", "dynamicloader", "port", "destination", "high", "windows", "united", "write", "tofsee", "stream", "win64", "push", "urls", "url analysis", "dnssec", "script domains", "encrypt", "url add", "http", "related nids", "flag united", "germany", "address google", "passive dns", "ipv4 add", "files", "asn as13335", "dns resolutions", "domains top", "level", "unique tlds", "location united", "asn asnone", "present dec", "backdoor", "lowfi", "win32autoit mar", "urls show", "date checked", "connection", "httponly", "secure", "path", "expiressat", "dynamic cfray", "medium", "delete c", "displayname", "show", "unknown", "next", "rndhex", "malware", "cname", "next associated", "url hostname", "server response", "google safe", "read c", "unicode", "png image", "rgba", "memcommit", "dock", "execution", "files location", "china flag", "china hostname", "hostname", "domain", "files ip", "address", "asn as45102", "gmt content", "certificate", "associated urls", "location china", "china asn", "as4808 china", "present aug", "object", "present apr", "present oct", "alman", "present sep", "error", "present jul", "rmndrp", "present feb", "expiration", "url https", "url http", "iocs", "review iocs", "expireswed", "samesitenone", "maxage86400", "maxage0", "server", "expires", "victina nulcac", "data upload", "extraction", "enter", "enter source", "url data", "type", "extract indic", "included iocs", "china unknown", "botnet", "folk in browser", "japan unknown", "asnone country", "as13335", "a domains", "script urls", "servers", "title", "moved", "record value", "entries", "whitelisted", "powershell", "xf9xb5xf9", "xxcexf6x8fr", "k2xe7xcbxxeaxa2", "x99x19", "x88yxf9xc858", "x83x12x8da", "zx9bx8ex84", "attempts", "yara detections", "contacted", "tags none", "file type", "pe packer", "dll compilation", "guard", "botnets" ], "references": [ "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet", "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )", "foundry.neconsside.com \u2022 http://foundry.neconsside.com", "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside", "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com" ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America", "Russian Federation", "T\u00fcrkiye", "Netherlands" ], "malware_families": [ { "id": "Backdoor:Win32/Tofsee", "display_name": "Backdoor:Win32/Tofsee", "target": "/malware/Backdoor:Win32/Tofsee" }, { "id": "AutoIT", "display_name": "AutoIT", "target": null }, { "id": "HtBot", "display_name": "HtBot", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1195.001", "name": "Compromise Software Dependencies and Development Tools", "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1593.001", "name": "Social Media", "display_name": "T1593.001 - Social Media" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1481", "name": "Web Service", "display_name": "T1481 - Web Service" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8145, "domain": 1389, "FileHash-SHA256": 1545, "CIDR": 2, "hostname": 2533, "FileHash-MD5": 209, "FileHash-SHA1": 190, "email": 6, "SSLCertFingerprint": 4 }, "indicator_count": 14023, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "140 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68cf2c43f6493c55c8d08bf9", "name": "Executed \u2022 Installend RMS Module | .exe RMS.exe", "description": "Recap: Executed in Denver, Co.USA. Attacked a Newly purchased iPhone. Multi person attempt . Attacker executed via watch. . Related to Trump campaign Palantir text linked in references. \n\nCyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.\nCreation Date\n2023-05-01 00:28:45\nLast Modification Date\n2025-09-13 22:34:36\n- by CarlosCabal (VirusTotal)\n\nInteresting. Being used in America.", "modified": "2025-10-20T21:03:08.498000", "created": "2025-09-20T22:35:47.459000", "tags": [ "lowfi", "tektonit yara", "pulses otx", "pexe", "pe32", "intel", "vendor finding", "ms defender", "number", "install", "installend", "igor", "pavlov", "remote access tool", "dynamicloader", "medium", "dynamic", "ip address", "domain", "file name", "reads", "windows", "checks", "pehash external", "rms", "rms module", "private build", "watch", "msie", "windows nt", "wow64", "slcc2", "media center", "port", "destination", "search", "united", "read c", "write", "persistence", "execution", "malware", "push", "copy", "next", "autorun", "unknown", "skykit", "companyname", "insta", "dod", "udp a83f8110", "encoding", "e1203 windows", "file attributes", "catalog tree", "analysis ob0001", "analysis ob0002", "f0002 polling", "control ob0004", "access ob0005", "defense evasion", "extraction", "data upload", "failed", "related tru", "unit data", "included review", "iocs", "suggestedloes", "find su", "type o", "extr", "references try", "cat antivirus", "com tektonit", "original f", "match info", "adversaries", "match unknown", "30000s", "info", "info checks", "taskjob t1053", "execution flow", "t1574 dll", "window", "tulach", "yara", "hallrender", "apple", "ios", "114.114.114.114", "targeted", "monitoring", "brian sabey & co", "tsara brashears target", "angry quasi", "pp mafia", "dangerous", "redrum", "nemtih" ], "references": [ "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Alerts: allocates_rwx antisandbox_foregroundwindows", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "IDS: Unique rule identifier: This rule belongs to a private collection", "Signa: Matches rule Msiexec Quiet Installation by frack113", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "Capabilities: Targeting Identify system language via API", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "Malware packed. Haven\u2019t sorted all.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "I\u2019d like to make an appeal. Please stop. Your original target has gone away." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#Lowfi:HSTR:MonitoringTool:TektonIt", "display_name": "#Lowfi:HSTR:MonitoringTool:TektonIt", "target": null }, { "id": "Win.Trojan.Remoteadmin-151", "display_name": "Win.Trojan.Remoteadmin-151", "target": null }, { "id": "Win.Trojan.Rfusclient", "display_name": "Win.Trojan.Rfusclient", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "TrojanDownloader:HTML/Adodb.gen!A", "display_name": "TrojanDownloader:HTML/Adodb.gen!A", "target": "/malware/TrojanDownloader:HTML/Adodb.gen!A" } ], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 479, "FileHash-SHA1": 436, "FileHash-SHA256": 2102, "URL": 659, "domain": 162, "hostname": 305, "SSLCertFingerprint": 1, "email": 6 }, "indicator_count": 4150, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "224 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "Malware packed. Haven\u2019t sorted all.", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "Signa: Matches rule Msiexec Quiet Installation by frack113", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "foundry.neconsside.com \u2022 http://foundry.neconsside.com", "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "Capabilities: Targeting Identify system language via API", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "Alerts: allocates_rwx antisandbox_foregroundwindows", "IDS: Unique rule identifier: This rule belongs to a private collection", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "I\u2019d like to make an appeal. Please stop. Your original target has gone away.", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "#lowfi:hstr:monitoringtool:tektonit", "Autoit", "Win.trojan.rfusclient", "Mirai", "Trojandownloader:html/adodb.gen!a", "Win.trojan.remoteadmin-151", "Tulach", "Htbot", "Backdoor:win32/tofsee" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "693de4a8a72cf95b028365f0", "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee", "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets", "modified": "2026-01-12T21:02:35.560000", "created": "2025-12-13T22:11:52.474000", "tags": [ "network", "ip address", "subnet", "dynamicloader", "port", "destination", "high", "windows", "united", "write", "tofsee", "stream", "win64", "push", "urls", "url analysis", "dnssec", "script domains", "encrypt", "url add", "http", "related nids", "flag united", "germany", "address google", "passive dns", "ipv4 add", "files", "asn as13335", "dns resolutions", "domains top", "level", "unique tlds", "location united", "asn asnone", "present dec", "backdoor", "lowfi", "win32autoit mar", "urls show", "date checked", "connection", "httponly", "secure", "path", "expiressat", "dynamic cfray", "medium", "delete c", "displayname", "show", "unknown", "next", "rndhex", "malware", "cname", "next associated", "url hostname", "server response", "google safe", "read c", "unicode", "png image", "rgba", "memcommit", "dock", "execution", "files location", "china flag", "china hostname", "hostname", "domain", "files ip", "address", "asn as45102", "gmt content", "certificate", "associated urls", "location china", "china asn", "as4808 china", "present aug", "object", "present apr", "present oct", "alman", "present sep", "error", "present jul", "rmndrp", "present feb", "expiration", "url https", "url http", "iocs", "review iocs", "expireswed", "samesitenone", "maxage86400", "maxage0", "server", "expires", "victina nulcac", "data upload", "extraction", "enter", "enter source", "url data", "type", "extract indic", "included iocs", "china unknown", "botnet", "folk in browser", "japan unknown", "asnone country", "as13335", "a domains", "script urls", "servers", "title", "moved", "record value", "entries", "whitelisted", "powershell", "xf9xb5xf9", "xxcexf6x8fr", "k2xe7xcbxxeaxa2", "x99x19", "x88yxf9xc858", "x83x12x8da", "zx9bx8ex84", "attempts", "yara detections", "contacted", "tags none", "file type", "pe packer", "dll compilation", "guard", "botnets" ], "references": [ "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet", "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )", "foundry.neconsside.com \u2022 http://foundry.neconsside.com", "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside", "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com" ], "public": 1, "adversary": "", "targeted_countries": [ "Hong Kong", "United States of America", "Russian Federation", "T\u00fcrkiye", "Netherlands" ], "malware_families": [ { "id": "Backdoor:Win32/Tofsee", "display_name": "Backdoor:Win32/Tofsee", "target": "/malware/Backdoor:Win32/Tofsee" }, { "id": "AutoIT", "display_name": "AutoIT", "target": null }, { "id": "HtBot", "display_name": "HtBot", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1195.001", "name": "Compromise Software Dependencies and Development Tools", "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1593.001", "name": "Social Media", "display_name": "T1593.001 - Social Media" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1481", "name": "Web Service", "display_name": "T1481 - Web Service" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1459", "name": "Device Unlock Code Guessing or Brute Force", "display_name": "T1459 - Device Unlock Code Guessing or Brute Force" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8145, "domain": 1389, "FileHash-SHA256": 1545, "CIDR": 2, "hostname": 2533, "FileHash-MD5": 209, "FileHash-SHA1": 190, "email": 6, "SSLCertFingerprint": 4 }, "indicator_count": 14023, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "140 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68cf2c43f6493c55c8d08bf9", "name": "Executed \u2022 Installend RMS Module | .exe RMS.exe", "description": "Recap: Executed in Denver, Co.USA. Attacked a Newly purchased iPhone. Multi person attempt . Attacker executed via watch. . Related to Trump campaign Palantir text linked in references. \n\nCyberInt states that Remote Manipulator System (RMS) is a legitimate tool developed by Russian organization TektonIT and has been observed in campaigns conducted by TA505 as well as numerous smaller campaigns likely attributable to other, disparate, threat actors. In addition to the availability of commercial licenses, the tool is free for non-commercial use and supports the remote administration of both Microsoft Windows and Android devices.\nCreation Date\n2023-05-01 00:28:45\nLast Modification Date\n2025-09-13 22:34:36\n- by CarlosCabal (VirusTotal)\n\nInteresting. Being used in America.", "modified": "2025-10-20T21:03:08.498000", "created": "2025-09-20T22:35:47.459000", "tags": [ "lowfi", "tektonit yara", "pulses otx", "pexe", "pe32", "intel", "vendor finding", "ms defender", "number", "install", "installend", "igor", "pavlov", "remote access tool", "dynamicloader", "medium", "dynamic", "ip address", "domain", "file name", "reads", "windows", "checks", "pehash external", "rms", "rms module", "private build", "watch", "msie", "windows nt", "wow64", "slcc2", "media center", "port", "destination", "search", "united", "read c", "write", "persistence", "execution", "malware", "push", "copy", "next", "autorun", "unknown", "skykit", "companyname", "insta", "dod", "udp a83f8110", "encoding", "e1203 windows", "file attributes", "catalog tree", "analysis ob0001", "analysis ob0002", "f0002 polling", "control ob0004", "access ob0005", "defense evasion", "extraction", "data upload", "failed", "related tru", "unit data", "included review", "iocs", "suggestedloes", "find su", "type o", "extr", "references try", "cat antivirus", "com tektonit", "original f", "match info", "adversaries", "match unknown", "30000s", "info", "info checks", "taskjob t1053", "execution flow", "t1574 dll", "window", "tulach", "yara", "hallrender", "apple", "ios", "114.114.114.114", "targeted", "monitoring", "brian sabey & co", "tsara brashears target", "angry quasi", "pp mafia", "dangerous", "redrum", "nemtih" ], "references": [ "Try LogMeIn Resolve For Free \u2014 Powerful tools for device management and remote software installs from LogMeInResolve.", "Installed on Tsara Brashears phone in a drive up incident in October 2024", "Yara: CATEGORY _7_Zip_Installer ;!@Install@! ;!@InstallEnd@! 7z Igor,Pavlov", "Antivirus Detections: Yara.Trojan.Remoteadmin-151 (29:30 BST) - a full list of key details:-1-2-3-4.", "EXE:CompanyName \u2022 TektonIT EXE:EntryPoint:0x121cf \u2022 EXE:FileDescription RMS Component", "TektonIT RMS Component \u2022 6.0 Internal Name \u2022 LegalCopyright\u00a9 2014 TektonIT.", "Original Filename: RMS Module PrivateBuild \u2022 ProductName \u2022 RMS ProductVersion 6.0", "Worn as Watch \u2022 Highlighter yellow & green Large Font. Looks like a toy. Clearly a weapon", "Non white or African American , black haired Middle Eastern 55+ male in non discreet Car", "Vehicle described as Midnight blue , attempted to hit target at a high rate of speed when target left", "parking spot on possibly Logan, male tried to clip target at Logan & 18th. No plates", "Same target l followed and observed at Metro T-mobile on Evans & Federal in Denver", "Described as an Opaque white skinned , non Caucasian bald male. Clearly Persian or Israeli (other) Russian?", "He watched a \u2018target\u2019 while buying least expensive product available. Shirt with US Flag distraction", "Target no longer able to provide info. Paper tags over real Co#LP on car dark colored car.", "Attempted, overt side swipe of family member of target in City Park , by W/M w/US Army tags", "Not surprisingly driving a Ford F 150 | Very disturbing incidents continue. Goal clear. Hired to K****", "Alerts: recon_fingerprint antisandbox_sleep dynamic_function_loading encrypted_ioc", "Alerts: resumethread_remote_process reads_self stealth_window uses_windows_utilities", "Alerts: antivm_checks_available_memory queries_keyboard_layout", "Alerts: stealth_timeout dll_load_uncommon_file_types antidebug_setunhandledexceptionfilter", "Alerts: network_icmp modifies_certificates injection_resumethread dumped_buffer", "Alerts: network_cnc_http network_http creates_exe uses_windows_utilities", "Alerts: allocates_rwx antisandbox_foregroundwindows", "Related Trump pulse: https://otx.alienvault.com/pulse/68c954a80675ccc89b0e9b63", "6.0.0.0 Deep Impact: +Tsara Brashears , +callmeDoris , +Merkd1904 , +scnrscnr, likely dorkingbeauty", "6.0.0.0 United States AS749 DOD network information center \u2022 Historical telemetry", "Don\u2019t ask questions. Just terrorize. destroy equipment paid for by US citizens. What\u2019s yours is theirs.", "IDS: MALWARE-CNC Win.Trojan.Rfusclient outbound connection", "IDS: Matches rule PROTOCOL-ICMP Unusual PING detected", "IDS: PROTOCOL-ICMP PING Windows PROTOCOL-ICMP PING PROTOCOL-ICMP Echo Reply", "IDS: PUA-OTHER RMS rmansys remote management tool cnc communication", "IDS: Unique rule identifier: This rule belongs to a private collection", "Signa: Matches rule Msiexec Quiet Installation by frack113", "Sigma: Matches rule Remote Access Tool Services Have Been Installed - Security by Connor Martin, Nasreddine Bencherchali (Nextron Systems)", "Sigma: Matches rule Compression Utility Passed Uncommon Directory (via cmdline) by SOC Prime Team", "Capabilities: Collection Get geographical location \u2022 Log keystrokes via polling", "Capabilities: Anti-Analysis Self delete \u2022 Inspect load icon resource", "Capabilities: Targeting Identify system language via API", "Capabilities: Data-Manipulation Encode data using XOR Hash data with CRC32", "Capabilities: Persistence Create shortcut via IShellLink Communication \u2022 Write and execute a file", "Malware packed. Haven\u2019t sorted all.", "Continued stalking \u2022 I am of course also being targeted w/ attempts requiring surgery.", "Very dangerous. Has been going on for 12+ years affecting everyone who knew target.", "Machiavellians have already built a new world with a world. Some fear the Apocalypse they created.", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/mc/challenge/brw/do/210/dd14d159", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/210/d5caee55-c7ae-4b3a-8be7-b65fa5f885c9", "https://apideveloper.santander.cl/sancl/partner/transaction_authorization/v1/coordinate_card/acs/visa/challenge/brw/get/220/6b180faa-7ce7-4e26-a3b0-aa241497c70f", "The attackers are all different races, Caucasian, African American, Asian, Indian, Persian, Ethiopian, and ambiguous", "I\u2019d like to make an appeal. Please stop. Your original target has gone away." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "#Lowfi:HSTR:MonitoringTool:TektonIt", "display_name": "#Lowfi:HSTR:MonitoringTool:TektonIt", "target": null }, { "id": "Win.Trojan.Remoteadmin-151", "display_name": "Win.Trojan.Remoteadmin-151", "target": null }, { "id": "Win.Trojan.Rfusclient", "display_name": "Win.Trojan.Rfusclient", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "TrojanDownloader:HTML/Adodb.gen!A", "display_name": "TrojanDownloader:HTML/Adodb.gen!A", "target": "/malware/TrojanDownloader:HTML/Adodb.gen!A" } ], "attack_ids": [ { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 479, "FileHash-SHA1": 436, "FileHash-SHA256": 2102, "URL": 659, "domain": 162, "hostname": 305, "SSLCertFingerprint": 1, "email": 6 }, "indicator_count": 4150, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "224 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "lelongtips.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "lelongtips.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780369116.8447042 }