{ "type": "Domain", "indicator": "rishigangoly.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/rishigangoly.com", "alexa": "http://www.alexa.com/siteinfo/rishigangoly.com", "indicator": "rishigangoly.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2118146540, "indicator": "rishigangoly.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "670224ac3c8cce621843a477", "name": "Man in Browser Multi-systems attack | Ransom", "description": "System wide issues. Internal and external attack affecting medical and educational institution \u2022 Man in Browser \u2022 Mail spammer. Many other priority vulnerabilities.\nShort List of Malware Families\nAtros3.AHFB\nETPRO\nNOD32\nSAPE.Heur.9B552\nSpammer:MSIL/Misnt.A\nSymantec\nTrojan:Win32/Zonsterarch\nWin.Ransomware.Sodinokibi-7013612-0\nIDS Detections\nW32/Emotet.v4 Checkin", "modified": "2024-11-05T05:02:29.649000", "created": "2024-10-06T05:48:28.806000", "tags": [ "as32934", "passive dns", "urls", "address", "search", "unknown", "aaaa", "as13414 twitter", "as19679 dropbox", "germany unknown", "france unknown", "hong kong", "asnone hong", "kong unknown", "kong", "all scoreblue", "ipv4", "files", "http", "ip address", "related nids", "files location", "flag united", "hostname", "a domains", "meta", "moved", "body", "as13768 aptum", "canada", "asnone united", "whitelisted", "url analysis", "location united", "cookie", "united states", "record type", "ttl value", "key identifier", "full name", "data", "v3 serial", "number", "cus odigicert", "cndigicert sha2", "high assurance", "server ca", "validity", "united", "as2914 ntt", "yuming", "name servers", "date", "next", "as32780 hosting", "welcome", "pulse pulses", "accept", "domainmaster", "creation date", "expiration date", "as35280 acorus", "as396982 google", "status", "cname", "united kingdom", "trojan", "service", "ransom", "pulse submit", "asn as35280", "error", "japan unknown", "post https", "post method", "medium", "high", "registry", "creates", "alerts", "contacted", "tools", "win32", "malware", "copy", "persistence", "execution", "powershell e", "script urls", "httponly set", "general", "read c", "show", "entries", "etpro trojan", "intel", "ms windows", "file", "virustotal", "write", "baidu", "vipre", "panda", "download", "main", "look", "install", "push", "sape.heur.9b552", "nod32", "symantec", "etpro", "dynamicloader", "yara rule", "stack pivoting", "cape", "maninbrowser", "mitb", "t1055", "server", "registrar abuse", "contact phone", "registrar url", "registrar", "whois lookup", "dnssec", "domain name", "attempts", "performs", "packing t1045", "browse scan", "august", "as174 cogent", "canada unknown", "overview ip", "files domain", "files related", "pulses none", "related tags", "gmt content", "type", "content length", "svr id", "encrypt", "trojandropper", "virtool", "msie", "chrome", "as45012 dogado", "tr tr", "die domain", "td tr", "gmt server", "scan endpoints", "scoreblue ipv4", "ripe route", "ip location", "asn as45012", "cloudpit dogado", "gmbh", "whois server", "reverse ip", "abuse contact", "de adminc", "ssh attacker", "mysql", "tor relays", "sabey type", "showing", "pulses", "indicator facts", "hichina zhicheng technology ltd.,", "domain", "as4837 china", "china unknown", "default", "tlsv1", "germany as34788", "post", "windows nt", "dotted quad", "fake browser", "artemis", "emotet", "as9808 china", "as56047 china", "as56040 china", "as58541 qingdao", "et trojan", "sinkhole cookie", "macoute", "sha256", "yara detections", "worm", "explorer", "possible", "april", "uchealth", "ogoogle inc", "lsalford", "ocomodo ca", "limited", "secure server", "c2087940" ], "references": [ "\u00bb 2preprod-sonar-data-preprod-sonar-data5z.redirectme.netmovilpreprod-sonar-datappmovilpreprod-sonar-datafentryd.0025.ali.zomans.com", "prfsmtppr01ccd.uchospitals.edu \u2022 165.68.13.55", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Get MX ETPRO TROJAN Spammer MSIL/Misnt.A Fetching Spam List", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Spam Payload Download", "Spammer:MSIL/Misnt.A PLUS - FileHash-SHA256 5966e329cb56a0cc4956f1ca0da2b337aa3e6145d4622ac1152bfc29ab96304d", "YARA Detections: WinRAR_SFX", "High Priority Alerts: antisandbox_unhook antivirus_virustotal", "utmmail.bcw.edu | 166.78.44.213 11/04/24 | isu.edu | iup.edu | siu.edu | stcloudstate.edu | ucr.edu | router9.mail.cornell.edu", "dmz-mailsec-scanner-6.mit.edu | external-relay.iupui.edu | fresno.ucsf.edu | mail.virginia.edu | mailfilter2.cgu.edu | mx.gonzaga.edu", "mx3.stanford.edu | my-stjohns-edu.mail.protection.outlook.com | prfsmtppr01ccd.uchospitals.edu", "extdomembers-2022.bounceme.netoppofrobledevradiod.devkissflowd-netoppofweblatedevradio-krd-kr-finance-fw.devkissflowd-netoppofweblatedevradio-krd-kr.ali.zomans.com", "trojan.msil.spammer.ai = spammer.ai", "interact.f5.com", "https://0-enakamai-lanwpradio-pornos4-dd-engine.redirectme.netoppofe2znetoppofindnetoppofcassandraddd-production.neto46cassandra.ali.zomans.com", "http://apple.phishing.91tbc.com/ | apple.phishing.491459.top http://apple.phishing.91tbc.com/?ZYUKUR=8049183536181170.html", "https://bd-server.com/user/JasminMcVey2/", "http://google.com.demo-box.cognito.svcgateway.foodsigned-php.ppp.canva-apps.cn/", "(Invalid IP) 022.12.7.75 Chrome \\\\ user data \\\\ crowd deny \\\\ rData \\\\ crowd deny \\\\ 28 \\\\ metadata \\\\ ve", "(Invalid IP) 022.12.7.75 redirect \u00bb 18.12.7.75 AS 3 (MIT-GATEWAYS) US", "High Priority IDS Detections: W32/Emotet.v4 FileHash-SHA256 613ed78c024ee7744c5b53c18b315d10faa39d18975f1634f82da61c02ea8a4f", "Suspicious of NSO Pegasus type spyware campaign (possibly)" ], "public": 1, "adversary": "", "targeted_countries": [ "Singapore", "Malaysia", "United States of America", "Argentina", "France", "Sweden", "Ireland", "Romania", "Taiwan", "Germany", "Netherlands", "Brazil", "Colombia", "Indonesia", "Hong Kong", "Poland", "Slovakia", "Lithuania", "United Kingdom of Great Britain and Northern Ireland", "Denmark", "Slovenia", "Greece", "Italy", "Aruba", "China", "Japan" ], "malware_families": [ { "id": "Trojan:Win32/Zonsterarch", "display_name": "Trojan:Win32/Zonsterarch", "target": "/malware/Trojan:Win32/Zonsterarch" }, { "id": "Win.Ransomware.Sodinokibi-7013612-0", "display_name": "Win.Ransomware.Sodinokibi-7013612-0", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Spammer:MSIL/Misnt.A", "display_name": "Spammer:MSIL/Misnt.A", "target": "/malware/Spammer:MSIL/Misnt.A" }, { "id": "SAPE.Heur.9B552", "display_name": "SAPE.Heur.9B552", "target": null }, { "id": "NOD32", "display_name": "NOD32", "target": null }, { "id": "Symantec", "display_name": "Symantec", "target": null }, { "id": "ETPRO", "display_name": "ETPRO", "target": null }, { "id": "Worm:Win32/Macoute.A", "display_name": "Worm:Win32/Macoute.A", "target": "/malware/Worm:Win32/Macoute.A" }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "C2087940", "display_name": "C2087940", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1428", "name": "Exploit Enterprise Resources", "display_name": "T1428 - Exploit Enterprise Resources" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" } ], "industries": [ "Healthcare", "Civilian Society", "Technology", "Education" ], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1287, "hostname": 2995, "URL": 3606, "email": 22, "FileHash-MD5": 173, "FileHash-SHA256": 1059, "FileHash-SHA1": 163, "CIDR": 1, "SSLCertFingerprint": 43 }, "indicator_count": 9349, "is_author": false, "is_subscribing": null, "subscriber_count": 236, "modified_text": "571 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657098fb4c59f8ac3f86f612", "name": "202303251514", "description": "", "modified": "2023-12-06T15:53:31.627000", "created": "2023-12-06T15:53:31.627000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 976, "FileHash-MD5": 196, "FileHash-SHA1": 196, "domain": 174, "hostname": 171, "URL": 3 }, "indicator_count": 1716, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641f01b25f684f5bb91cea7f", "name": "202303251514", "description": "Hashes for the first time are being shared by users using the same IP address as the BBC News app and BBC Radio 4's Newsround website, which is available to listen to any of the above.", "modified": "2023-04-24T14:04:42.146000", "created": "2023-03-25T14:14:10.717000", "tags": [ "emotet", "wannacry", "systembc", "trickbot", "qbot", "cobalt strike", "agent tesla", "wannycry", "domains", "hashes", "wcry", "emotet malware", "fake net", "iocs ip", "microsoft", "cobaltstrike", "trojan", "flawedammyy", "first", "eternalblue", "desktop", "malware", "fallout" ], "references": [ "a.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 196, "FileHash-SHA1": 196, "FileHash-SHA256": 976, "URL": 3, "domain": 174, "hostname": 171 }, "indicator_count": 1716, "is_author": false, "is_subscribing": null, "subscriber_count": 417, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "utmmail.bcw.edu | 166.78.44.213 11/04/24 | isu.edu | iup.edu | siu.edu | stcloudstate.edu | ucr.edu | router9.mail.cornell.edu", "https://0-enakamai-lanwpradio-pornos4-dd-engine.redirectme.netoppofe2znetoppofindnetoppofcassandraddd-production.neto46cassandra.ali.zomans.com", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Spam Payload Download", "Suspicious of NSO Pegasus type spyware campaign (possibly)", "http://google.com.demo-box.cognito.svcgateway.foodsigned-php.ppp.canva-apps.cn/", "prfsmtppr01ccd.uchospitals.edu \u2022 165.68.13.55", "http://apple.phishing.91tbc.com/ | apple.phishing.491459.top http://apple.phishing.91tbc.com/?ZYUKUR=8049183536181170.html", "High Priority Alerts: antisandbox_unhook antivirus_virustotal", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Get MX ETPRO TROJAN Spammer MSIL/Misnt.A Fetching Spam List", "YARA Detections: WinRAR_SFX", "dmz-mailsec-scanner-6.mit.edu | external-relay.iupui.edu | fresno.ucsf.edu | mail.virginia.edu | mailfilter2.cgu.edu | mx.gonzaga.edu", "a.txt", "interact.f5.com", "extdomembers-2022.bounceme.netoppofrobledevradiod.devkissflowd-netoppofweblatedevradio-krd-kr-finance-fw.devkissflowd-netoppofweblatedevradio-krd-kr.ali.zomans.com", "mx3.stanford.edu | my-stjohns-edu.mail.protection.outlook.com | prfsmtppr01ccd.uchospitals.edu", "\u00bb 2preprod-sonar-data-preprod-sonar-data5z.redirectme.netmovilpreprod-sonar-datappmovilpreprod-sonar-datafentryd.0025.ali.zomans.com", "trojan.msil.spammer.ai = spammer.ai", "Spammer:MSIL/Misnt.A PLUS - FileHash-SHA256 5966e329cb56a0cc4956f1ca0da2b337aa3e6145d4622ac1152bfc29ab96304d", "(Invalid IP) 022.12.7.75 Chrome \\\\ user data \\\\ crowd deny \\\\ rData \\\\ crowd deny \\\\ 28 \\\\ metadata \\\\ ve", "(Invalid IP) 022.12.7.75 redirect \u00bb 18.12.7.75 AS 3 (MIT-GATEWAYS) US", "High Priority IDS Detections: W32/Emotet.v4 FileHash-SHA256 613ed78c024ee7744c5b53c18b315d10faa39d18975f1634f82da61c02ea8a4f", "https://bd-server.com/user/JasminMcVey2/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Worm:win32/macoute.a", "Trojan:win32/zonsterarch", "Qbot", "Systembc", "Atros3.ahfb", "Spammer:msil/misnt.a", "Nod32", "Etpro", "Agent tesla", "Trickbot", "C2087940", "Win.ransomware.sodinokibi-7013612-0", "Wannacry", "Emotet", "Wannycry", "Cobalt strike", "Sape.heur.9b552", "Symantec" ], "industries": [ "Civilian society", "Education", "Healthcare", "Technology" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "670224ac3c8cce621843a477", "name": "Man in Browser Multi-systems attack | Ransom", "description": "System wide issues. Internal and external attack affecting medical and educational institution \u2022 Man in Browser \u2022 Mail spammer. Many other priority vulnerabilities.\nShort List of Malware Families\nAtros3.AHFB\nETPRO\nNOD32\nSAPE.Heur.9B552\nSpammer:MSIL/Misnt.A\nSymantec\nTrojan:Win32/Zonsterarch\nWin.Ransomware.Sodinokibi-7013612-0\nIDS Detections\nW32/Emotet.v4 Checkin", "modified": "2024-11-05T05:02:29.649000", "created": "2024-10-06T05:48:28.806000", "tags": [ "as32934", "passive dns", "urls", "address", "search", "unknown", "aaaa", "as13414 twitter", "as19679 dropbox", "germany unknown", "france unknown", "hong kong", "asnone hong", "kong unknown", "kong", "all scoreblue", "ipv4", "files", "http", "ip address", "related nids", "files location", "flag united", "hostname", "a domains", "meta", "moved", "body", "as13768 aptum", "canada", "asnone united", "whitelisted", "url analysis", "location united", "cookie", "united states", "record type", "ttl value", "key identifier", "full name", "data", "v3 serial", "number", "cus odigicert", "cndigicert sha2", "high assurance", "server ca", "validity", "united", "as2914 ntt", "yuming", "name servers", "date", "next", "as32780 hosting", "welcome", "pulse pulses", "accept", "domainmaster", "creation date", "expiration date", "as35280 acorus", "as396982 google", "status", "cname", "united kingdom", "trojan", "service", "ransom", "pulse submit", "asn as35280", "error", "japan unknown", "post https", "post method", "medium", "high", "registry", "creates", "alerts", "contacted", "tools", "win32", "malware", "copy", "persistence", "execution", "powershell e", "script urls", "httponly set", "general", "read c", "show", "entries", "etpro trojan", "intel", "ms windows", "file", "virustotal", "write", "baidu", "vipre", "panda", "download", "main", "look", "install", "push", "sape.heur.9b552", "nod32", "symantec", "etpro", "dynamicloader", "yara rule", "stack pivoting", "cape", "maninbrowser", "mitb", "t1055", "server", "registrar abuse", "contact phone", "registrar url", "registrar", "whois lookup", "dnssec", "domain name", "attempts", "performs", "packing t1045", "browse scan", "august", "as174 cogent", "canada unknown", "overview ip", "files domain", "files related", "pulses none", "related tags", "gmt content", "type", "content length", "svr id", "encrypt", "trojandropper", "virtool", "msie", "chrome", "as45012 dogado", "tr tr", "die domain", "td tr", "gmt server", "scan endpoints", "scoreblue ipv4", "ripe route", "ip location", "asn as45012", "cloudpit dogado", "gmbh", "whois server", "reverse ip", "abuse contact", "de adminc", "ssh attacker", "mysql", "tor relays", "sabey type", "showing", "pulses", "indicator facts", "hichina zhicheng technology ltd.,", "domain", "as4837 china", "china unknown", "default", "tlsv1", "germany as34788", "post", "windows nt", "dotted quad", "fake browser", "artemis", "emotet", "as9808 china", "as56047 china", "as56040 china", "as58541 qingdao", "et trojan", "sinkhole cookie", "macoute", "sha256", "yara detections", "worm", "explorer", "possible", "april", "uchealth", "ogoogle inc", "lsalford", "ocomodo ca", "limited", "secure server", "c2087940" ], "references": [ "\u00bb 2preprod-sonar-data-preprod-sonar-data5z.redirectme.netmovilpreprod-sonar-datappmovilpreprod-sonar-datafentryd.0025.ali.zomans.com", "prfsmtppr01ccd.uchospitals.edu \u2022 165.68.13.55", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Get MX ETPRO TROJAN Spammer MSIL/Misnt.A Fetching Spam List", "IDS Detections: ETPRO TROJAN Spammer MSIL/Misnt.A Spam Payload Download", "Spammer:MSIL/Misnt.A PLUS - FileHash-SHA256 5966e329cb56a0cc4956f1ca0da2b337aa3e6145d4622ac1152bfc29ab96304d", "YARA Detections: WinRAR_SFX", "High Priority Alerts: antisandbox_unhook antivirus_virustotal", "utmmail.bcw.edu | 166.78.44.213 11/04/24 | isu.edu | iup.edu | siu.edu | stcloudstate.edu | ucr.edu | router9.mail.cornell.edu", "dmz-mailsec-scanner-6.mit.edu | external-relay.iupui.edu | fresno.ucsf.edu | mail.virginia.edu | mailfilter2.cgu.edu | mx.gonzaga.edu", "mx3.stanford.edu | my-stjohns-edu.mail.protection.outlook.com | prfsmtppr01ccd.uchospitals.edu", "extdomembers-2022.bounceme.netoppofrobledevradiod.devkissflowd-netoppofweblatedevradio-krd-kr-finance-fw.devkissflowd-netoppofweblatedevradio-krd-kr.ali.zomans.com", "trojan.msil.spammer.ai = spammer.ai", "interact.f5.com", "https://0-enakamai-lanwpradio-pornos4-dd-engine.redirectme.netoppofe2znetoppofindnetoppofcassandraddd-production.neto46cassandra.ali.zomans.com", "http://apple.phishing.91tbc.com/ | apple.phishing.491459.top http://apple.phishing.91tbc.com/?ZYUKUR=8049183536181170.html", "https://bd-server.com/user/JasminMcVey2/", "http://google.com.demo-box.cognito.svcgateway.foodsigned-php.ppp.canva-apps.cn/", "(Invalid IP) 022.12.7.75 Chrome \\\\ user data \\\\ crowd deny \\\\ rData \\\\ crowd deny \\\\ 28 \\\\ metadata \\\\ ve", "(Invalid IP) 022.12.7.75 redirect \u00bb 18.12.7.75 AS 3 (MIT-GATEWAYS) US", "High Priority IDS Detections: W32/Emotet.v4 FileHash-SHA256 613ed78c024ee7744c5b53c18b315d10faa39d18975f1634f82da61c02ea8a4f", "Suspicious of NSO Pegasus type spyware campaign (possibly)" ], "public": 1, "adversary": "", "targeted_countries": [ "Singapore", "Malaysia", "United States of America", "Argentina", "France", "Sweden", "Ireland", "Romania", "Taiwan", "Germany", "Netherlands", "Brazil", "Colombia", "Indonesia", "Hong Kong", "Poland", "Slovakia", "Lithuania", "United Kingdom of Great Britain and Northern Ireland", "Denmark", "Slovenia", "Greece", "Italy", "Aruba", "China", "Japan" ], "malware_families": [ { "id": "Trojan:Win32/Zonsterarch", "display_name": "Trojan:Win32/Zonsterarch", "target": "/malware/Trojan:Win32/Zonsterarch" }, { "id": "Win.Ransomware.Sodinokibi-7013612-0", "display_name": "Win.Ransomware.Sodinokibi-7013612-0", "target": null }, { "id": "Atros3.AHFB", "display_name": "Atros3.AHFB", "target": null }, { "id": "Spammer:MSIL/Misnt.A", "display_name": "Spammer:MSIL/Misnt.A", "target": "/malware/Spammer:MSIL/Misnt.A" }, { "id": "SAPE.Heur.9B552", "display_name": "SAPE.Heur.9B552", "target": null }, { "id": "NOD32", "display_name": "NOD32", "target": null }, { "id": "Symantec", "display_name": "Symantec", "target": null }, { "id": "ETPRO", "display_name": "ETPRO", "target": null }, { "id": "Worm:Win32/Macoute.A", "display_name": "Worm:Win32/Macoute.A", "target": "/malware/Worm:Win32/Macoute.A" }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "C2087940", "display_name": "C2087940", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1089", "name": "Disabling Security Tools", "display_name": "T1089 - Disabling Security Tools" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" }, { "id": "T1428", "name": "Exploit Enterprise Resources", "display_name": "T1428 - Exploit Enterprise Resources" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "TA0037", "name": "Command and Control", "display_name": "TA0037 - Command and Control" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" } ], "industries": [ "Healthcare", "Civilian Society", "Technology", "Education" ], "TLP": "green", "cloned_from": null, "export_count": 55, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1287, "hostname": 2995, "URL": 3606, "email": 22, "FileHash-MD5": 173, "FileHash-SHA256": 1059, "FileHash-SHA1": 163, "CIDR": 1, "SSLCertFingerprint": 43 }, "indicator_count": 9349, "is_author": false, "is_subscribing": null, "subscriber_count": 236, "modified_text": "571 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657098fb4c59f8ac3f86f612", "name": "202303251514", "description": "", "modified": "2023-12-06T15:53:31.627000", "created": "2023-12-06T15:53:31.627000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 976, "FileHash-MD5": 196, "FileHash-SHA1": 196, "domain": 174, "hostname": 171, "URL": 3 }, "indicator_count": 1716, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641f01b25f684f5bb91cea7f", "name": "202303251514", "description": "Hashes for the first time are being shared by users using the same IP address as the BBC News app and BBC Radio 4's Newsround website, which is available to listen to any of the above.", "modified": "2023-04-24T14:04:42.146000", "created": "2023-03-25T14:14:10.717000", "tags": [ "emotet", "wannacry", "systembc", "trickbot", "qbot", "cobalt strike", "agent tesla", "wannycry", "domains", "hashes", "wcry", "emotet malware", "fake net", "iocs ip", "microsoft", "cobaltstrike", "trojan", "flawedammyy", "first", "eternalblue", "desktop", "malware", "fallout" ], "references": [ "a.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 196, "FileHash-SHA1": 196, "FileHash-SHA256": 976, "URL": 3, "domain": 174, "hostname": 171 }, "indicator_count": 1716, "is_author": false, "is_subscribing": null, "subscriber_count": 417, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "rishigangoly.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "rishigangoly.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780200074.3572092 }