{ "type": "Domain", "indicator": "mydiser.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/mydiser.com", "alexa": "http://www.alexa.com/siteinfo/mydiser.com", "indicator": "mydiser.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 231835376, "indicator": "mydiser.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 30, "pulses": [ { "id": "699a8339b9e516069852d3e2", "name": "Whitelist Shell", "description": "Data Point for Further Review", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T04:16:57.040000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 39, "FileHash-MD5": 2, "FileHash-SHA1": 2, "hostname": 194, "email": 6, "URL": 187, "domain": 263, "CVE": 30 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "59 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03093e9854fc99b761f1b", "name": "Phishing | Mar 11, 2026 | Part 267/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 267/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:54:11.156000", "created": "2026-03-10T14:54:11.156000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 774, "hostname": 1226 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedcf7e0b454af92b02a11", "name": "Phishing | Mar 10, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:45:11.250000", "created": "2026-03-09T14:45:11.250000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1317, "domain": 683 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad89ba9b8f6c9e06bf4952", "name": "Phishing | Mar 9, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:37:46.630000", "created": "2026-03-08T14:37:46.630000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac38df3434ab20081b0c03", "name": "Phishing | Mar 8, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:40:31.413000", "created": "2026-03-07T14:40:31.413000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae6f9aa5d41a16a140e60", "name": "Phishing | Mar 7, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:38:49.861000", "created": "2026-03-06T14:38:49.861000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99ad24e0908f6e3879f83", "name": "Phishing | Mar 6, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:01:38.053000", "created": "2026-03-05T15:01:38.053000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a844257ce0c4f1f6826b70", "name": "Phishing | Mar 5, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:39:33.179000", "created": "2026-03-04T14:39:33.179000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f145956e70e79214a4e2", "name": "Phishing | Mar 4, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:33:41.175000", "created": "2026-03-03T14:33:41.175000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b731fd3adb4178cd2830", "name": "Phishing | Mar 3, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:13:37.788000", "created": "2026-03-02T16:13:37.788000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5156d39b34945ff5e801f", "name": "Phishing | Mar 2, 2026 | Part 228/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 228/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:43:25.188000", "created": "2026-03-02T04:43:25.188000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1278, "domain": 722 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a441f07c6ad29b91b24cfa", "name": "Phishing | Mar 2, 2026 | Part 230/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 230/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:41:04.287000", "created": "2026-03-01T13:41:04.287000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1307, "domain": 693 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a407a78023f774868389a1", "name": "Phishing | Mar 1, 2026 | Part 230/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 230/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:32:23.492000", "created": "2026-03-01T09:32:23.492000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1307, "domain": 693 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a38619ce13a1b2757cfb05", "name": "Phishing | Mar 1, 2026 | Part 230/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 230/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:19:37.210000", "created": "2026-03-01T00:19:37.210000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1243, "domain": 757 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997fcd4bcbd1b55d08452bf", "name": "Phishing | Feb 20, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:19:00.919000", "created": "2026-02-20T06:19:00.919000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "99 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976a950b834abc8173626d", "name": "Phishing | Feb 20, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T19:55:01.431000", "created": "2026-02-19T19:55:01.431000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972b597e3184e5b5748c2d", "name": "Phishing | Feb 20, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:25:13.740000", "created": "2026-02-19T15:25:13.740000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970c1c792c91b546919ceb", "name": "Phishing | Feb 19, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:11:56.251000", "created": "2026-02-19T13:11:56.251000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699635e6be5f0090a4d010e8", "name": "Phishing | Feb 19, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T21:57:58.332000", "created": "2026-02-18T21:57:58.332000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699576b7970acffa8e8c8f3e", "name": "Phishing | Feb 18, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:22:15.491000", "created": "2026-02-18T08:22:15.491000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 804, "hostname": 1196 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949b2dbfc6a88da384def2", "name": "Phishing | Feb 18, 2026 | Part 232/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 232/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:45:33.889000", "created": "2026-02-17T16:45:33.889000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 804, "hostname": 1196 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699299548dab7538ff0d9717", "name": "Phishing | Feb 16, 2026 | Part 236/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 236/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:13:08.415000", "created": "2026-02-16T04:13:08.415000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 692, "hostname": 1308 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69915a0c6d49df9ed4e0f2af", "name": "Phishing | Feb 15, 2026 | Part 240/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 240/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:30:52.439000", "created": "2026-02-15T05:30:52.439000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1193, "domain": 807 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908b7b64b2686dc66dc001", "name": "Phishing | Feb 15, 2026 | Part 243/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 243/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T14:49:31.274000", "created": "2026-02-14T14:49:31.274000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 734, "hostname": 1266 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c5de5c13775f55f6a3354", "name": "Phishing | Feb 11, 2026 | Part 265/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 265/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:45:57.746000", "created": "2026-02-11T10:45:57.746000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1233, "domain": 767 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "108 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981aa30d9f0bad61c44bb65", "name": "Phishing | 2026-01-31 | Part 68/163", "description": "Phishing indicators. Date: 2026-01-31. Part 68/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T07:56:32.389000", "created": "2026-02-03T07:56:32.389000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 3376, "hostname": 6624 }, "indicator_count": 10000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "116 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c8a64436a7aee2e25a1", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:46.707000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 65, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "801 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3c31230455f6d8da3a9f0", "name": "Locky: File Deletion targeting incriminating archived files II", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T21:07:30.887000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c8a64436a7aee2e25a1", "export_count": 73, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Enqrypted", "id": "272105", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 62, "modified_text": "801 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d3acf32e1088e76165a307", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T19:33:07.504000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": "65d34c91868744aa1449fef2", "export_count": 64, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 234, "modified_text": "801 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65d34c91868744aa1449fef2", "name": "Locky: File Deletion targeting incriminating archived files.", "description": "redhatdelete.com : Adversaries are deleting files in bulk from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.", "modified": "2024-03-20T12:00:39.809000", "created": "2024-02-19T12:41:52.846000", "tags": [ "it consultant", "uk collection", "dns intel", "ips collection", "suspicous ip", "whois file", "cname", "record type", "ttl value", "algorithm", "v3 serial", "number", "cus cnr3", "olet", "subject public", "key info", "key algorithm", "key identifier", "whois lookup", "region create", "domain", "name server", "registrant name", "technical city", "region update", "united", "command decode", "mitre att", "suricata ipv4", "windows nt", "win64", "khtml", "gecko", "ck id", "cookie", "meta", "february", "hybrid", "general", "click", "strings", "contact", "threat analyzer", "threat", "paste", "iocs", "urls http", "dns replication", "code", "namecheap", "registrar abuse", "namecheap inc", "privacy service", "withheld", "privacy", "dnssec", "email", "first", "bodis", "unknown", "creation date", "search", "emails", "as397240", "date", "next", "all octoseek", "threat roundup", "january", "june", "historical ssl", "referrer", "contacted", "group", "execution", "phishing", "malware", "core", "malicious", "dark power", "play ransomware", "pe32", "intel", "ms windows", "win32 dynamic", "link library", "win16 ne", "icons library", "os2 executable", "pe32 linker", "gnu linker", "compiler", "info header", "name md5", "overlay", "passive dns", "entries", "ipv4", "pulse pulses", "urls", "files", "trojan", "location united", "query", "activity dns", "observed dns", "msie", "high", "copy", "write", "win32", "hashes", "host interaction", "sabey type", "hallrender", "brian sabey", "memory pattern", "http requests", "http method", "get response", "dns resolutions", "ip traffic", "domains", "mutex", "samplepath", "created", "shell commands", "r processes", "tree", "analyze", "hostnames", "url https", "samples", "hostname", "pattern urls", "memory", "pattern", "pattern domains", "roundup", "formbook", "mirai", "ben c", "injection", "server", "scan endpoints", "show", "august", "bq feb", "chrome", "precondition", "virtool", "downloadmr", "body", "status", "servers", "record value", "name servers", "showing", "mailrubar", "trojanclicker", "slcc2", "media center", "delete c", "malware beacon", "suspicious", "class", "internal", "local", "encrypt", "as15169 google", "gmt cache", "twitter", "rostpay", "date hash", "avast avg", "mtb may", "susp", "cryp", "win32upatre may", "mtb showing", "lowfi", "aaaa", "win32pcmega jan", "urlshortner dec", "urlshortner sep", "as133618", "nxdomain", "as133775 xiamen", "germany unknown", "webtoolbar", "nanocore rat", "gamehack", "cobalt strike", "whois record", "ssl certificate", "tsara brashears", "resolutions", "critical risk", "apple phone", "unlocker", "shell code", "installer", "ursnif", "hacktool", "emotet", "tracker", "chaos", "ransomexx", "xor ddos", "xorddos", "mitre attack", "parent domain", "urls url", "siblings", "metro", "communicating", "collection", "dropped", "skynet", "youth", "com laude", "ltd dba", "utc submissions", "submitters", "cloudflarenet", "akamaias", "digitaloceanasn", "csc corporate", "pt mora", "univjos", "etisalat misr", "acurix networks", "pty ltd", "beijing baidu", "highly targeted", "http", "network hijacks", "redline stealer", "whois sslcert", "contacted urls", "whois whois", "september", "hidden cobra", "threats", "kimsuky", "service", "read c", "create c", "write c", "regsetvalueexa", "mozilla", "capture", "asnone", "domain http", "request", "malware dns", "lookup wannacry", "default", "ransom", "push", "playgame", "command", "email document", "exploit domain", "owner exploit", "kit exploit", "source file", "hacking tools", "hunting macro", "malware hosting", "memory scanning", "yara detections", "debug", "icmp traffic", "pdb path", "pe section", "low software", "packing t1045", "ransomware", "egregor", "find", "false", "psexec", "powershell", "qakbot", "qbot", "icedid" ], "references": [ "redhatdelete.com", "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695" ], "public": 1, "adversary": "", "targeted_countries": [ "Australia", "United States of America" ], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin", "target": null }, { "id": "Rostpay", "display_name": "Rostpay", "target": null }, { "id": "VirTool", "display_name": "VirTool", "target": null }, { "id": "Mitre Attack", "display_name": "Mitre Attack", "target": null }, { "id": "Chaos (ELF)", "display_name": "Chaos (ELF)", "target": null }, { "id": "TrojanDropper:Win32/GameHack", "display_name": "TrojanDropper:Win32/GameHack", "target": "/malware/TrojanDropper:Win32/GameHack" }, { "id": "Win.Ransomware.Locky-7766366-0", "display_name": "Win.Ransomware.Locky-7766366-0", "target": null }, { "id": "Ransom:Win32/WannaCrypt.A!rsm", "display_name": "Ransom:Win32/WannaCrypt.A!rsm", "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm" }, { "id": "ALF:E5.SpikeAex.rhh_pid", "display_name": "ALF:E5.SpikeAex.rhh_pid", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0034", "name": "Impact", "display_name": "TA0034 - Impact" }, { "id": "TA0040", "name": "Impact", "display_name": "TA0040 - Impact" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1107", "name": "File Deletion", "display_name": "T1107 - File Deletion" }, { "id": "T1563", "name": "Remote Service Session Hijacking", "display_name": "T1563 - Remote Service Session Hijacking" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 57, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1848, "FileHash-SHA1": 1783, "FileHash-SHA256": 7170, "domain": 1649, "hostname": 1191, "email": 9, "URL": 729, "CVE": 2, "SSLCertFingerprint": 2, "CIDR": 1 }, "indicator_count": 14384, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "801 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}", "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695", "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60", "explorer.exe \u2022 Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe", "https://ltna.com.au/cyber", "Trojan-Ransom.Win32.Blocker.jgb Checkin", "redhatdelete.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Alf:e5.spikeaex.rhh_pid", "Rostpay", "Trojan-ransom.win32.blocker.jgb checkin", "Chaos (elf)", "Trojandropper:win32/gamehack", "Mitre attack", "Virtool", "Mirai", "Win.ransomware.locky-7766366-0", "Ransom:win32/wannacrypt.a!rsm" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 30, "pulses": [ { "id": "699a8339b9e516069852d3e2", "name": "Whitelist Shell", "description": "Data Point for Further Review", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T04:16:57.040000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 39, "FileHash-MD5": 2, "FileHash-SHA1": 2, "hostname": 194, "email": 6, "URL": 187, "domain": 263, "CVE": 30 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "59 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b03093e9854fc99b761f1b", "name": "Phishing | Mar 11, 2026 | Part 267/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 267/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:54:11.156000", "created": "2026-03-10T14:54:11.156000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 774, "hostname": 1226 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "81 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedcf7e0b454af92b02a11", "name": "Phishing | Mar 10, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:45:11.250000", "created": "2026-03-09T14:45:11.250000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1317, "domain": 683 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad89ba9b8f6c9e06bf4952", "name": "Phishing | Mar 9, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:37:46.630000", "created": "2026-03-08T14:37:46.630000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac38df3434ab20081b0c03", "name": "Phishing | Mar 8, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:40:31.413000", "created": "2026-03-07T14:40:31.413000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae6f9aa5d41a16a140e60", "name": "Phishing | Mar 7, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:38:49.861000", "created": "2026-03-06T14:38:49.861000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99ad24e0908f6e3879f83", "name": "Phishing | Mar 6, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:01:38.053000", "created": "2026-03-05T15:01:38.053000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a844257ce0c4f1f6826b70", "name": "Phishing | Mar 5, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:39:33.179000", "created": "2026-03-04T14:39:33.179000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f145956e70e79214a4e2", "name": "Phishing | Mar 4, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:33:41.175000", "created": "2026-03-03T14:33:41.175000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 803, "hostname": 1197 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b731fd3adb4178cd2830", "name": "Phishing | Mar 3, 2026 | Part 226/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 226/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:13:37.788000", "created": "2026-03-02T16:13:37.788000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1198, "domain": 802 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "mydiser.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "mydiser.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780185557.465864 }