{ "type": "Domain", "indicator": "scripts.wtf", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/scripts.wtf", "alexa": "http://www.alexa.com/siteinfo/scripts.wtf", "indicator": "scripts.wtf", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2898782741, "indicator": "scripts.wtf", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "6923408464566e39caf32285", "name": "Discord- DNS | Malvertizing | Ransom/Msilzilla (sifting IoC\u2019s created by scnrscnr)", "description": "TAGS\nActive\n443 ma2592000\nChristopher Pool\nPool's Closed\nTimothy Pool\na li\n google\namerica att\napache\napache ip\nasn as46606\nauditmode force\nbehavior\nbinary\nbinary file\nbk role\nchat\ncheck\nchrome\nck ids\ncommon stealer\ncookie\ndata upload\ndefender\ndelete c\ndirectui\ndiscord\ndns lookup\ndomain add\ndrop\ndynamicloader\neb d8\nee fc\nerror oct\nexplorer\nexternal ip\nextraction\nf0 ff\nfailed\nff bb\nff d5\nff ff\nfiles\nfoundry\ngmt content\ngmt etag\ngmt server\ngoogle chrome\nguard\nhigh\ninsert\nlolminer\nmalware\nmedia\nmeta\nmoved\nmovie\nmsie\nmsvisualbasic60\nmtb aug -present \nneversend\npowershell\nrelated nids\nresponse ip\nself\nservice domain\nsingapore\nsmartassembly\nspan\nspan a\nsx08x00x00a\ntargeting\ntls sni\ntrojan\ntrojandropper\ntwitter\ntx08x00x00n\nunique\nuser agent\nux08x00x00h\nvirtool\nvirustotal api\nvoice\nvx08x00x00j\nwrite\nwrite c\nwx08x00x00\nx08x00x00b\nx08x00x00x00\nyara\nyara rule\nyx08x00x00l\nz3je\nz3uwq7\nzx08x00x00", "modified": "2025-12-23T16:04:54.329000", "created": "2025-11-23T17:12:36.917000", "tags": [ "no expiration", "expiration", "url https", "url http", "filehashsha256", "hostname", "domain", "filehashmd5", "filehashsha1", "ipv4", "code", "pool", "timothy pool", "z3je z3uwq7", "creation date", "ip address", "emails", "expiration date", "status", "hostname add", "pulse pulses", "passive dns", "urls", "date" ], "references": [ "https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba", "Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted", "http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com", "https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com", "www.techcult.com", "http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com", "https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE", "truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com", "yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com", "lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json", "162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/", "http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing", "http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site", "2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt", "IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)", "IDS Detections: Observed Discord Domain (discord .com in TLS SNI)", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less", "Yara: Detections ConventionEngine_Term_Users", "Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents", "Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly", "Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc", "Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process", "Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name", "Yara : MS_Visual_Basic_6_0 ,", "Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser", "Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly", "Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile", "Alerts: mouse_movement_detect", "Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left", "scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.", "Foundry stalking." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanDropper:Win32/VB.IL0", "display_name": "TrojanDropper:Win32/VB.IL0", "target": "/malware/TrojanDropper:Win32/VB.IL0" }, { "id": "ALF:Trojan:Win32/Cassini_56a3061!ibt", "display_name": "ALF:Trojan:Win32/Cassini_56a3061!ibt", "target": null }, { "id": "Win.Ransomware.Msilzilla-10014498-0", "display_name": "Win.Ransomware.Msilzilla-10014498-0", "target": null } ], "attack_ids": [ { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 773, "FileHash-SHA1": 684, "FileHash-SHA256": 1910, "CVE": 2, "SSLCertFingerprint": 4, "URL": 3783, "domain": 878, "email": 7, "hostname": 1913 }, "indicator_count": 9954, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "160 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690b39b3cf3cb86d14ccd811", "name": "VirusTotal Graph - 11.05.25 - UAlberta Insiders", "description": "I was just looking for a Dark Gate and came across this...hmmmm....\nI enriched on import, vet out and refer to virustotal graph referenced.\nRefer to References below - am unable to get them in. Profiled student group (OSINT) - unclear if potential allies or not.", "modified": "2025-12-05T11:00:41.797000", "created": "2025-11-05T11:49:07.495000", "tags": [ "chadsualberta" ], "references": [ "https://www.virustotal.com/graph/embed/ge8fc36dfbe1c48cab7c6efb0398cc30cb5aaebda2bf24123bb6a282436cc5bab?theme=dark", "https://www.filescan.io/uploads/690baf5e85b61a93a738d0d5/reports/ecaf45a2-956f-4d4e-8ebd-00813d966614/ioc", "ThreatZone - Malicious", "https://tria.ge/251105-yvvzgssldn", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495/690baf2999a0659ae9046188", "Email: chads@ualberta[.]ca" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 120, "FileHash-SHA1": 120, "FileHash-SHA256": 1809, "URL": 603, "domain": 396, "hostname": 514 }, "indicator_count": 3562, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "178 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682bc2458ba622cc1ce0fe31", "name": "hxxps://astromust[.]com - alleged group of Canadian *Hackers* - 05.19.25", "description": "Quick Peak into hxxps://astromust[.]com - alleged group of Canadian *Hackers* - 05.19.25\n-->> Just gotta Graph it out // Add some names // all that jazz\nAstromust is a mobile game set in an intergalactic world, where players are pitted against each other in a race to the moon, and the ultimate space adventure game is on offer.", "modified": "2025-06-20T16:02:07.802000", "created": "2025-05-19T23:44:05.771000", "tags": [ "astromust", "multi universal", "space team", "ai team", "astrostation", "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "platform", "etmodules", "sandbox", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "kaspersky threat intelligence portal", "online virus scan file", "online file scanner", "kaspersky online scanner", "online file virus scan", "scan file online", "scan file for virus", "file scanner", "online file virus scanner", "check link for virus", "kaspersky online scan", "check file for virus", "false alarm", "false detection", "false positive", "community", "results", "switch", "inquest labs", "resources api", "notes supported", "cve list", "drop your", "file", "service", "prefetch8 ansi", "date", "show process", "ansi", "threat level", "hash seen", "pcap processing", "pcap", "sha256", "command decode", "suspicious", "hybrid", "comspec", "starfield", "close", "click", "hosts", "general", "path", "model", "encrypt", "strings", "contact", "ip location", "osint verdict", "javascript", "technology", "domain status", "server", "dnssec", "domain name", "status", "abuse contact", "email", "registrar abuse", "contact phone", "algorithm", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus olet", "encrypt cnr10", "validity", "subject public", "UAlberta" ], "references": [ "https://www.filescan.io/uploads/682bbaad0de036ed65ac2b71/reports/331527e9-620a-4de4-8453-ae192d8fa4a0/overview", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b", "https://opentip.kaspersky.com/https%3A%2F%2Fastromust.com/?tab=lookup", "https://metadefender.com/results/url/aHR0cHM6Ly9hc3Ryb211c3QuY29t", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b/682bbc44b7f58e83f50c9316", "https://www.virustotal.com/gui/domain/astromust.com/relations", "https://www.virustotal.com/gui/domain/astromust.com/details", "https://polyswarm.network/scan/results/url/b90bd2fbc0b269c2355b17ce439872ce2795d5d297c2321c704c451293830887", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23/iocs", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23", "https://www.virustotal.com/graph/embed/gd3d17be766b04b91a5de8ddd5b16415eb8efe15309a14f5f9584649fd216ca12?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "AstroStation", "display_name": "AstroStation", "target": null } ], "attack_ids": [ { "id": "T1505", "name": "Server Software Component", "display_name": "T1505 - Server Software Component" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Government", "Telecommunications", "Healthcare", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 70, "FileHash-SHA256": 801, "URL": 421, "domain": 473, "hostname": 237, "FileHash-MD5": 64, "SSLCertFingerprint": 17, "email": 6 }, "indicator_count": 2089, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674833893330368db05cb246", "name": "Test Ransomware Collection - 11.28.24", "description": "Test Ransomware Collection - 11.27.24\nhttps://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark\n\nhttps://www.virustotal.com/gui/collection/19165d66b639534ac6928f43a50ae8689795ab8cd6cba5c2fa9570a3bbd3aa62/iocs --> For a certain POC customer (HK) asprotect cve-2016-0101 cve-2016-5696 contains-pe upx cve-2005-0446 pecompact cve-2014-3931 bobsoft cve-2017-7285 cve-2016-2569 contains-elf\nGraph (incomplete / unexpanded): Test Ransomware Collection - 11.28.24 - partial expansion https://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark", "modified": "2024-12-28T08:00:28.380000", "created": "2024-11-28T09:10:33.845000", "tags": [ "userid", "entity", "please", "javascript" ], "references": [ "https://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/iocs", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/community" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 295, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 124, "FileHash-SHA1": 122, "FileHash-SHA256": 2193, "URL": 815, "domain": 790, "hostname": 710 }, "indicator_count": 4754, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "521 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing", "Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser", "https://www.virustotal.com/graph/embed/gd3d17be766b04b91a5de8ddd5b16415eb8efe15309a14f5f9584649fd216ca12?theme=dark", "IDS Detections: Observed Discord Domain (discord .com in TLS SNI)", "Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted", "Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left", "https://www.filescan.io/uploads/682bbaad0de036ed65ac2b71/reports/331527e9-620a-4de4-8453-ae192d8fa4a0/overview", "Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly", "https://opentip.kaspersky.com/https%3A%2F%2Fastromust.com/?tab=lookup", "https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495/690baf2999a0659ae9046188", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b/682bbc44b7f58e83f50c9316", "IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)", "IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23", "Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents", "https://www.virustotal.com/graph/embed/ge8fc36dfbe1c48cab7c6efb0398cc30cb5aaebda2bf24123bb6a282436cc5bab?theme=dark", "Email: chads@ualberta[.]ca", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/iocs", "https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE", "Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process", "scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/community", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a", "truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23/iocs", "http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site", "Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name", "https://www.filescan.io/uploads/690baf5e85b61a93a738d0d5/reports/ecaf45a2-956f-4d4e-8ebd-00813d966614/ioc", "lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json", "Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc", "https://tria.ge/251105-yvvzgssldn", "Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly", "2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt", "https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495", "yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com", "https://metadefender.com/results/url/aHR0cHM6Ly9hc3Ryb211c3QuY29t", "Foundry stalking.", "https://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark", "Yara : MS_Visual_Basic_6_0 ,", "Alerts: mouse_movement_detect", "https://www.virustotal.com/gui/domain/astromust.com/details", "http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com", "https://www.virustotal.com/gui/domain/astromust.com/relations", "Yara: Detections ConventionEngine_Term_Users", "Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b", "162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/", "http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com", "ThreatZone - Malicious", "https://polyswarm.network/scan/results/url/b90bd2fbc0b269c2355b17ce439872ce2795d5d297c2321c704c451293830887", "www.techcult.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Win.ransomware.msilzilla-10014498-0", "Trojandropper:win32/vb.il0", "Alf:trojan:win32/cassini_56a3061!ibt", "Astrostation" ], "industries": [ "Technology", "Government", "Education", "Healthcare", "Telecommunications" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "6923408464566e39caf32285", "name": "Discord- DNS | Malvertizing | Ransom/Msilzilla (sifting IoC\u2019s created by scnrscnr)", "description": "TAGS\nActive\n443 ma2592000\nChristopher Pool\nPool's Closed\nTimothy Pool\na li\n google\namerica att\napache\napache ip\nasn as46606\nauditmode force\nbehavior\nbinary\nbinary file\nbk role\nchat\ncheck\nchrome\nck ids\ncommon stealer\ncookie\ndata upload\ndefender\ndelete c\ndirectui\ndiscord\ndns lookup\ndomain add\ndrop\ndynamicloader\neb d8\nee fc\nerror oct\nexplorer\nexternal ip\nextraction\nf0 ff\nfailed\nff bb\nff d5\nff ff\nfiles\nfoundry\ngmt content\ngmt etag\ngmt server\ngoogle chrome\nguard\nhigh\ninsert\nlolminer\nmalware\nmedia\nmeta\nmoved\nmovie\nmsie\nmsvisualbasic60\nmtb aug -present \nneversend\npowershell\nrelated nids\nresponse ip\nself\nservice domain\nsingapore\nsmartassembly\nspan\nspan a\nsx08x00x00a\ntargeting\ntls sni\ntrojan\ntrojandropper\ntwitter\ntx08x00x00n\nunique\nuser agent\nux08x00x00h\nvirtool\nvirustotal api\nvoice\nvx08x00x00j\nwrite\nwrite c\nwx08x00x00\nx08x00x00b\nx08x00x00x00\nyara\nyara rule\nyx08x00x00l\nz3je\nz3uwq7\nzx08x00x00", "modified": "2025-12-23T16:04:54.329000", "created": "2025-11-23T17:12:36.917000", "tags": [ "no expiration", "expiration", "url https", "url http", "filehashsha256", "hostname", "domain", "filehashmd5", "filehashsha1", "ipv4", "code", "pool", "timothy pool", "z3je z3uwq7", "creation date", "ip address", "emails", "expiration date", "status", "hostname add", "pulse pulses", "passive dns", "urls", "date" ], "references": [ "https://otx.alienvault.com/pulse/5fa57698ac0f6638b7b9a8ba", "Examining pulse created by scnrscnr is worth reviewing. I was surprised tonal see a targets name.I didn\u2019t see Foundry highlighted", "http://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com", "https://aninditaannisa.blogspot.com/2019/02/tsara-brashears-porn.html \u2022 blogspot.com \u2022 www.techcult.com/judge-the-simpsons-parody-is-child-pornography/ Whitelisted domain techcult.com\t Domain blogspot.com Whitelisted domain blogspot.com\t Domain techcult.com Whitelisted domain techcult.com\t Hostname aninditaannisa.blogspot.com \u2022 domain blogspot.com", "www.techcult.com", "http://foundry.tartarynova.com phishing \u2022 https://foundry.tartarynova.com \u2022 foundry.tartarynova.com", "https://trail.truefoundry.com/api/t/c/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE/enc_U2FsdGVkX1_wWHRx9nPGCEspZpUcIwc1yphMTxaaQ2ZAbsxOqRR4ibXcaYtcmgJ1UgabTFCHVVBLx2oAnBAW2h8el_edjHN72Ug0yKQePjKnSJEOnQvtq8MUPo0vkU1N", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_L9bYYgL2HGng9mDsC", "https://trail.truefoundry.com/api/track/open/usr_NEDuPPvnqv5DXyhti/tsk_X2YECqnpAow7t6JuE", "truefoundry.com \u2022 assets.production.truefoundry.com \u2022 cpt.llm-gateway.truefoundry.com", "yyz.llm-gateway.truefoundry.com \u2022 trail.truefoundry.com \u2022 sin.llm-gateway.truefoundry.com", "lm-gateway.truefoundry.com \u2022 https://assets.production.truefoundry.com/sample-openapi.json", "162.159.128.233 \u2022 http://tsar.vicly.org \u2022 https://tsar.vicly.org \u2022 tsar.vicly.org \u2022 vicly.org \u2022 https://tsar.vicly.org/", "http://scteamcommunity.com/4k-high-res-porn-videos/squirt phishing", "http://pic.porn.hub-accessories.site \u2022 https://pic.porn.hub-accessories.site \u2022 pic.porn.hub-accessories.site", "2022ww11.pornhubgsy.com \u2022 http://scteamcommunity.com/4k-high-res-porn-videos/squirt", "IDS Detections: Observed Discord Domain in DNS Lookup (discord .com) Discord Chat Service Domain in DNS Lookup (discord .com)", "IDS Detections: Observed Discord Domain (discord .com in TLS SNI)", "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)", "IDS Detections: Observed Discord Domain (discordapp .com in TLS SNI) Observed Discord Service Domain (discord .com) in TLS SNI Less", "Yara: Detections ConventionEngine_Term_Users", "Yara: ConventionEngine_Anomaly_MultiPDB_Double , ConventionEngine_Term_Documents", "Alerts: infostealer_browser infostealer_cookies binary_yara procmem_yara static_pe_anomaly", "Alerts: pe_compile_timestomping antiav_detectfile antidebug_guardpages encrypted_ioc", "Alerts: dynamic_function_loading injection_write_process reads_memory_remote_process", "Alerts : network_cnc_https_generic reads_self packer_entropy injection_rwx uses_windows_utilities antivm_checks_available_memory queries_computer_name queries_user_name", "Yara : MS_Visual_Basic_6_0 ,", "Yara : UPX , Nrv2x , UPX_OEP_place , UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser", "Alerts : ransomware_file_modifications stealth_file procmem_yara static_pe_anomaly", "Alerts: disables_folder_options stealth_hidden_extension stealth_hiddenreg anomalous_deletefile", "Alerts: mouse_movement_detect", "Couldn\u2019t pulse 1st pulse so here\u2019s what\u2019s left", "scnrscnr pulse is good. I\u2019m assuming they\u2019re targets.", "Foundry stalking." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "TrojanDropper:Win32/VB.IL0", "display_name": "TrojanDropper:Win32/VB.IL0", "target": "/malware/TrojanDropper:Win32/VB.IL0" }, { "id": "ALF:Trojan:Win32/Cassini_56a3061!ibt", "display_name": "ALF:Trojan:Win32/Cassini_56a3061!ibt", "target": null }, { "id": "Win.Ransomware.Msilzilla-10014498-0", "display_name": "Win.Ransomware.Msilzilla-10014498-0", "target": null } ], "attack_ids": [ { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1443", "name": "Remotely Install Application", "display_name": "T1443 - Remotely Install Application" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 773, "FileHash-SHA1": 684, "FileHash-SHA256": 1910, "CVE": 2, "SSLCertFingerprint": 4, "URL": 3783, "domain": 878, "email": 7, "hostname": 1913 }, "indicator_count": 9954, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "160 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "690b39b3cf3cb86d14ccd811", "name": "VirusTotal Graph - 11.05.25 - UAlberta Insiders", "description": "I was just looking for a Dark Gate and came across this...hmmmm....\nI enriched on import, vet out and refer to virustotal graph referenced.\nRefer to References below - am unable to get them in. Profiled student group (OSINT) - unclear if potential allies or not.", "modified": "2025-12-05T11:00:41.797000", "created": "2025-11-05T11:49:07.495000", "tags": [ "chadsualberta" ], "references": [ "https://www.virustotal.com/graph/embed/ge8fc36dfbe1c48cab7c6efb0398cc30cb5aaebda2bf24123bb6a282436cc5bab?theme=dark", "https://www.filescan.io/uploads/690baf5e85b61a93a738d0d5/reports/ecaf45a2-956f-4d4e-8ebd-00813d966614/ioc", "ThreatZone - Malicious", "https://tria.ge/251105-yvvzgssldn", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495", "https://hybrid-analysis.com/sample/30df68083e80263898ac56e2ef458811cec5fa73b92ad60f14b96ce676a11495/690baf2999a0659ae9046188", "Email: chads@ualberta[.]ca" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 120, "FileHash-SHA1": 120, "FileHash-SHA256": 1809, "URL": 603, "domain": 396, "hostname": 514 }, "indicator_count": 3562, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "178 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682bc2458ba622cc1ce0fe31", "name": "hxxps://astromust[.]com - alleged group of Canadian *Hackers* - 05.19.25", "description": "Quick Peak into hxxps://astromust[.]com - alleged group of Canadian *Hackers* - 05.19.25\n-->> Just gotta Graph it out // Add some names // all that jazz\nAstromust is a mobile game set in an intergalactic world, where players are pitted against each other in a race to the moon, and the ultimate space adventure game is on offer.", "modified": "2025-06-20T16:02:07.802000", "created": "2025-05-19T23:44:05.771000", "tags": [ "astromust", "multi universal", "space team", "ai team", "astrostation", "malware", "virus", "trojan", "ransomware", "static", "analysis", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "download", "platform", "etmodules", "sandbox", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "kaspersky threat intelligence portal", "online virus scan file", "online file scanner", "kaspersky online scanner", "online file virus scan", "scan file online", "scan file for virus", "file scanner", "online file virus scanner", "check link for virus", "kaspersky online scan", "check file for virus", "false alarm", "false detection", "false positive", "community", "results", "switch", "inquest labs", "resources api", "notes supported", "cve list", "drop your", "file", "service", "prefetch8 ansi", "date", "show process", "ansi", "threat level", "hash seen", "pcap processing", "pcap", "sha256", "command decode", "suspicious", "hybrid", "comspec", "starfield", "close", "click", "hosts", "general", "path", "model", "encrypt", "strings", "contact", "ip location", "osint verdict", "javascript", "technology", "domain status", "server", "dnssec", "domain name", "status", "abuse contact", "email", "registrar abuse", "contact phone", "algorithm", "key identifier", "x509v3 subject", "data", "v3 serial", "number", "cus olet", "encrypt cnr10", "validity", "subject public", "UAlberta" ], "references": [ "https://www.filescan.io/uploads/682bbaad0de036ed65ac2b71/reports/331527e9-620a-4de4-8453-ae192d8fa4a0/overview", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b", "https://opentip.kaspersky.com/https%3A%2F%2Fastromust.com/?tab=lookup", "https://metadefender.com/results/url/aHR0cHM6Ly9hc3Ryb211c3QuY29t", "https://www.hybrid-analysis.com/sample/00defff362d7d7129f891a2934b04b2ed53e6d951a2211e0846eca4f69c8d67b/682bbc44b7f58e83f50c9316", "https://www.virustotal.com/gui/domain/astromust.com/relations", "https://www.virustotal.com/gui/domain/astromust.com/details", "https://polyswarm.network/scan/results/url/b90bd2fbc0b269c2355b17ce439872ce2795d5d297c2321c704c451293830887", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23/iocs", "https://www.virustotal.com/gui/collection/1a911851d442fb25c6c63a6cbfe62be07ccd5b0f1eff0f07db8df5a23d1e2d23", "https://www.virustotal.com/graph/embed/gd3d17be766b04b91a5de8ddd5b16415eb8efe15309a14f5f9584649fd216ca12?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [ { "id": "AstroStation", "display_name": "AstroStation", "target": null } ], "attack_ids": [ { "id": "T1505", "name": "Server Software Component", "display_name": "T1505 - Server Software Component" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" } ], "industries": [ "Government", "Telecommunications", "Healthcare", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 70, "FileHash-SHA256": 801, "URL": 421, "domain": 473, "hostname": 237, "FileHash-MD5": 64, "SSLCertFingerprint": 17, "email": 6 }, "indicator_count": 2089, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674833893330368db05cb246", "name": "Test Ransomware Collection - 11.28.24", "description": "Test Ransomware Collection - 11.27.24\nhttps://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark\n\nhttps://www.virustotal.com/gui/collection/19165d66b639534ac6928f43a50ae8689795ab8cd6cba5c2fa9570a3bbd3aa62/iocs --> For a certain POC customer (HK) asprotect cve-2016-0101 cve-2016-5696 contains-pe upx cve-2005-0446 pecompact cve-2014-3931 bobsoft cve-2017-7285 cve-2016-2569 contains-elf\nGraph (incomplete / unexpanded): Test Ransomware Collection - 11.28.24 - partial expansion https://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark", "modified": "2024-12-28T08:00:28.380000", "created": "2024-11-28T09:10:33.845000", "tags": [ "userid", "entity", "please", "javascript" ], "references": [ "https://www.virustotal.com/graph/embed/gc7afcbd88ce9414fa243b96484295747299b4c38c7c9495ebe028e4ada9f6351?theme=dark", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/iocs", "https://www.virustotal.com/gui/collection/cc301819657fe4fd86545ec8f557a4255781b10446b2aa7e5f0ac9e44158ca9a/community" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 295, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 124, "FileHash-SHA1": 122, "FileHash-SHA256": 2193, "URL": 815, "domain": 790, "hostname": 710 }, "indicator_count": 4754, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "521 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "scripts.wtf", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "scripts.wtf", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780389652.4602208 }