{ "type": "Domain", "indicator": "soccersuck.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/soccersuck.com", "alexa": "http://www.alexa.com/siteinfo/soccersuck.com", "indicator": "soccersuck.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3351122310, "indicator": "soccersuck.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69f47e886aac3dce3a958d27", "name": "2011: Malware Analysis Report", "description": "", "modified": "2026-05-31T10:27:23.455000", "created": "2026-05-01T10:20:56.666000", "tags": [], "references": [ "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf", "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf", "2011-03-08 - Worm-Win32-Yimfoca.A.pdf", "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf", "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf", "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf", "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf", "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf", "2011-04-16 - Troj-Sasfis-O.pdf", "2011-05-19 - Win32-Expiro.pdf", "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf", "2011-04-30 - BKA-Trojaner (Ransomware).pdf", "2011-06-29 - Inside a Back Door Attack.pdf", "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf", "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf", "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf", "2011-07-14 - Cycbot- Ready to Ride.pdf", "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf", "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf", "2011-08-27 - Morto.A.pdf", "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf", "2011-08-03 - HTran and the Advanced Persistent Threat.pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf", "2011-09-09 - BIOS Threat is Showing up Again!.pdf", "2011-09-02 - ZeuS Gets Another Update.pdf", "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf", "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf", "2011-08-04 - Analysis of ngrBot.pdf", "2011-09-14 - Ice IX- not cool at all.pdf", "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf", "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf", "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf", "2011-09-09 - Stuxnet Malware Analysis Paper.pdf", "2011-09-27 - Debugging Injected Code with IDA Pro.pdf", "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf", "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf", "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf", "2011-10-17 - W32-Yunsip!tr.pws.pdf", "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf", "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "2011-10-31 - The Significance of the -Nitro- Attacks.pdf", "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf", "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf", "2011-12-08 - The Sykipot Attacks.pdf", "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf", "Duqu Trojan Questions and Answers.pdf", "Palebot trojan.pdf", "HTran.pdf", "Ghost RAT- Many faces.pdf", "Operation Shady Rat.pdf", "Alleged APT Intrusion Set 1.php Group.pdf", "Stuxnet , Duqu - The Evolution of Drivers.pdf", "The RSA Hack.pdf", "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf", "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf", "The LURID Downloader.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1031, "domain": 435, "CVE": 13, "FileHash-MD5": 155, "FileHash-SHA1": 8, "FileHash-SHA256": 234, "email": 9, "hostname": 1031 }, "indicator_count": 2916, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "5 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66db08e5a7f6887359fa35e2", "name": "picz.in.th", "description": "", "modified": "2025-06-19T04:44:45.537000", "created": "2024-09-06T13:51:33.753000", "tags": [], "references": [ "https://www.virustotal.com/graph/g5c18343ff7554bd8bbc90f8e8ff3ae282bbaab7bbdab4abd803396d74969792a" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 24, "FileHash-SHA1": 24, "FileHash-SHA256": 307, "URL": 20, "domain": 8, "hostname": 37 }, "indicator_count": 420, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f1accda30d94af7e846357", "name": "Zendesk as VirusTotal \u00bb Ransom:Win32/CVE", "description": "*https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088 |||\n\n*In this situation a target received a VirusTotal / Zendesk drive by pop up message that site was unauthorized , fraud risk. The link has it all! Downloaders, install core, browser bar malware, ransomware, python script. Heavy attack. Desires deletion of device , accounts and contents.\n |||\nALF:HeraklezEval:Ransom:Win32/CVE , \nALF:Trojan:Win32/Cassini_6d4ebdc9 ,\nBackdoor:Win32/Zegost ,\nCVE-2023-22518 ,\nCVE-2023-4966 ,\nFakeAV.FOR ,\nMalware:AddsCopyToStartup ,\nNinite ,\nNoobyProtect ,\nTEL:Trojan:Win64/GoCLR ,\nTELPER:HSTR:CLEAN:Ninite ,\nTrojan:Win32/Cobaltstrike ,\nTrojan:Win32/Dridex ,\nTrojan:Win32/Fanop ,\nTrojan:Win32/Neconyd ,\nTrojan:Win32/Startpage ,\nTrojan:Win32/Zombie ,\nVirTool:Win32/Injector.gen!BQ ,\nVirTool:Win32/Obfuscator ,\nWin.Trojan.Generic-9935365-0 ,\nWorm:Win32/Autorun", "modified": "2024-10-23T17:03:27.463000", "created": "2024-09-23T18:00:45.146000", "tags": [ "as396982 google", "setup", "passive dns", "unknown", "ninite sep", "a td", "443 ma2592000", "accept", "gmt cache", "trojan", "status", "name servers", "urls", "creation date", "search", "emails", "servers", "as15169 google", "aaaa", "cname", "virtool", "cryp", "as19527 google", "win32", "related pulses", "file samples", "files matching", "date hash", "trojan features", "entries", "search otx", "telper", "worm", "copyright", "levelblue", "files domain", "files related", "pulses none", "accept accept", "as16625 akamai", "as20940", "asnone united", "nxdomain", "expiration date", "as21342", "as132147", "china", "as9808 china", "body", "all scoreblue", "backdoor", "alf features", "all search", "domain", "as15133 verizon", "as16552 tiggee", "url https", "http", "hostname", "ninite", "united states", "scan endpoints", "show", "showing", "next", "united", "as54113", "github pages", "formbook cnc", "checkin", "mtb aug", "a domains", "class", "twitter", "certificate", "record value", "pulse pulses", "overview ip", "address", "related nids", "files location", "div div", "github", "meta", "homepage", "form", "as36459", "g2 tls", "rsa sha256", "as29791", "dynamicloader", "medium", "yara detections", "dynamic", "filehash", "sha256", "february", "copy", "otx telemetry", "related tags", "a li", "span p", "dj ai", "dongjun jeong", "a h2", "writeups", "infosec journey", "script urls", "netherlands", "a nxdomain", "aaaa nxdomain", "cloudfront", "trojandropper", "china unknown", "msie", "chrome", "ipv4", "noobyprotect", "files", "peeringdb", "sign", "github copilot", "view", "notifications", "branches tags", "code issues", "pull", "write", "star", "code", "stars", "python", "shell", "footer", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "as62597 nsone", "dnssec", "win32mydoom sep", "windows nt", "wow64", "khtml", "gecko", "query", "jpn write", "e0e8e", "observed dns", "expiro", "defender", "malware", "possible", "suspicious", "activity dns", "mtb may", "sameorigin", "domain name", "error", "moved", "server", "mtb sep", "win32cve sep", "cloud provider", "reverse dns", "america asn", "dns resolutions", "domains top", "level", "unique tlds", "pulses", "default", "yara rule", "high", "cnc checkin", "cape", "powershell", "vmprotect", "local", "agent", "domainabuse", "su liao", "zhi pin", "application", "expiro malware", "anomalous file", "june", "fakedout threat", "analyzer paste", "iocs", "samples", "exploit", "germany unknown", "as14636", "russia unknown", "as9123 timeweb", "as45102 alibaba", "as43830", "read c", "write c", "process32nextw", "regsetvalueexa", "regdword", "installcore", "format", "delphi", "stack", "downloader", "urls http", "delete c", "tls handshake", "number", "failure", "delete", "ids detections", "fadok", "template", "slcc2", "media center", "contacted", "ollydbg", "internal", "simda", "brian sabey", "going dark", "stop", "as14061", "hostnames", "as48287 jsc", "as50340", "czechia unknown", "date" ], "references": [ "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088", "GitHub - peeringdb/peeringdb-py: PeeringDB python client", "00-skillsetparadesarrollo.zendesk.com", "https://github.com/peeringdb/peeringdb-py", "From the lovely Cyber Folks .PL Cover" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Poland", "Australia", "Austria", "Canada", "Netherlands", "China" ], "malware_families": [ { "id": "CVE-2023-22518", "display_name": "CVE-2023-22518", "target": null }, { "id": "CVE-2023-4966", "display_name": "CVE-2023-4966", "target": null }, { "id": "FakeAV.FOR", "display_name": "FakeAV.FOR", "target": null }, { "id": "TELPER:HSTR:CLEAN:Ninite", "display_name": "TELPER:HSTR:CLEAN:Ninite", "target": null }, { "id": "VirTool:Win32/Obfuscator", "display_name": "VirTool:Win32/Obfuscator", "target": "/malware/VirTool:Win32/Obfuscator" }, { "id": "Trojan:Win32/Dridex", "display_name": "Trojan:Win32/Dridex", "target": "/malware/Trojan:Win32/Dridex" }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "Malware:AddsCopyToStartup", "display_name": "Malware:AddsCopyToStartup", "target": null }, { "id": "Trojan:Win32/Cobaltstrike", "display_name": "Trojan:Win32/Cobaltstrike", "target": "/malware/Trojan:Win32/Cobaltstrike" }, { "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9", "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9", "target": null }, { "id": "Trojan:Win32/Startpage", "display_name": "Trojan:Win32/Startpage", "target": "/malware/Trojan:Win32/Startpage" }, { "id": "Backdoor:Win32/Zegost", "display_name": "Backdoor:Win32/Zegost", "target": "/malware/Backdoor:Win32/Zegost" }, { "id": "Trojan:Win32/Fanop", "display_name": "Trojan:Win32/Fanop", "target": "/malware/Trojan:Win32/Fanop" }, { "id": "Trojan:Win32/Neconyd", "display_name": "Trojan:Win32/Neconyd", "target": "/malware/Trojan:Win32/Neconyd" }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" }, { "id": "Win.Trojan.Generic-9935365-0", "display_name": "Win.Trojan.Generic-9935365-0", "target": null }, { "id": "Ninite", "display_name": "Ninite", "target": null }, { "id": "NoobyProtect", "display_name": "NoobyProtect", "target": null }, { "id": "TEL:Trojan:Win64/GoCLR", "display_name": "TEL:Trojan:Win64/GoCLR", "target": null }, { "id": "ALF:HeraklezEval:Ransom:Win32/CVE", "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE", "target": null }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4891, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2436, "CVE": 3, "FileHash-MD5": 2510, "FileHash-SHA1": 2063, "FileHash-SHA256": 4054, "hostname": 1788, "URL": 1228, "email": 16 }, "indicator_count": 14098, "is_author": false, "is_subscribing": null, "subscriber_count": 244, "modified_text": "584 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "Palebot trojan.pdf", "2011-09-27 - Debugging Injected Code with IDA Pro.pdf", "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "https://www.virustotal.com/graph/g5c18343ff7554bd8bbc90f8e8ff3ae282bbaab7bbdab4abd803396d74969792a", "2011-06-29 - Inside a Back Door Attack.pdf", "2011-04-16 - Troj-Sasfis-O.pdf", "The RSA Hack.pdf", "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf", "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf", "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf", "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf", "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf", "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf", "From the lovely Cyber Folks .PL Cover", "2011-08-27 - Morto.A.pdf", "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088", "2011-12-08 - The Sykipot Attacks.pdf", "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf", "2011-09-14 - Ice IX- not cool at all.pdf", "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf", "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf", "Operation Shady Rat.pdf", "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf", "2011-08-04 - Analysis of ngrBot.pdf", "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf", "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf", "2011-04-30 - BKA-Trojaner (Ransomware).pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf", "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf", "2011-10-31 - The Significance of the -Nitro- Attacks.pdf", "https://github.com/peeringdb/peeringdb-py", "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf", "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf", "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf", "2011-08-03 - HTran and the Advanced Persistent Threat.pdf", "The LURID Downloader.pdf", "2011-05-19 - Win32-Expiro.pdf", "HTran.pdf", "Alleged APT Intrusion Set 1.php Group.pdf", "2011-07-14 - Cycbot- Ready to Ride.pdf", "2011-09-09 - Stuxnet Malware Analysis Paper.pdf", "Ghost RAT- Many faces.pdf", "Duqu Trojan Questions and Answers.pdf", "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf", "GitHub - peeringdb/peeringdb-py: PeeringDB python client", "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf", "00-skillsetparadesarrollo.zendesk.com", "2011-09-09 - BIOS Threat is Showing up Again!.pdf", "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf", "2011-03-08 - Worm-Win32-Yimfoca.A.pdf", "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf", "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf", "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf", "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf", "2011-09-02 - ZeuS Gets Another Update.pdf", "2011-10-17 - W32-Yunsip!tr.pws.pdf", "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf", "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf", "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf", "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf", "Stuxnet , Duqu - The Evolution of Drivers.pdf", "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Trojan:win32/dridex", "Worm:win32/autorun", "Noobyprotect", "Trojan:win32/cobaltstrike", "Ninite", "Alf:heraklezeval:ransom:win32/cve", "Virtool:win32/obfuscator", "Telper:hstr:clean:ninite", "Win.trojan.generic-9935365-0", "Cve-2023-4966", "Virtool:win32/injector.gen!bq", "Trojan:win32/zombie", "Fakeav.for", "Trojan:win32/fanop", "Alf:trojan:win32/cassini_6d4ebdc9", "Backdoor:win32/zegost", "Tel:trojan:win64/goclr", "Malware:addscopytostartup", "Trojan:win32/neconyd", "Cve-2023-22518", "Trojan:win32/startpage" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "69f47e886aac3dce3a958d27", "name": "2011: Malware Analysis Report", "description": "", "modified": "2026-05-31T10:27:23.455000", "created": "2026-05-01T10:20:56.666000", "tags": [], "references": [ "2011-03-11 - Trojan.Koredos Comes with an Unwelcomed Surprise.pdf", "2011-01-20 - Beschreibung des Virus Backdoor.Win32. Buterat.afj.pdf", "2011-03-08 - Worm-Win32-Yimfoca.A.pdf", "2011-03-02 - TDL4 and Glupteba- Piggyback PiggyBugs.pdf", "2011-04-26 - SpyEye Targets Opera, Google Chrome Users.pdf", "2011-03-28 - Microsoft Hunting Rustock Controllers.pdf", "2011-01-09 - Jan 6 CVE-2010-3333 DOC with info theft trojan from the American Chamber of Commerce.pdf", "2011-04-19 - TDSS part 1- The x64 Dollar Question.pdf", "2011-04-16 - Troj-Sasfis-O.pdf", "2011-05-19 - Win32-Expiro.pdf", "2011-06-22 - Criminals gain control over Mac with BackDoor.Olyx.pdf", "2011-04-30 - BKA-Trojaner (Ransomware).pdf", "2011-06-29 - Inside a Back Door Attack.pdf", "2011-07-26 - SpyEye Trojan defeating online banking defenses.pdf", "2011-04-28 - Un observateur d\u2019\u00e9v\u00e9nements aveugle\u2026.pdf", "2011-07-08 - Trojan.Mayachok.2- ?????? ??????? ?????????? VBR-???????.pdf", "2011-07-14 - Cycbot- Ready to Ride.pdf", "2011-07-06 - Cybercriminals switch from MBR to NTFS.pdf", "2011-07-28 - Trojan Tricks Victims Into Transferring Funds.pdf", "2011-08-27 - Morto.A.pdf", "2011-01-30 - GpCode Ransomware 2010 Simple Analysis.pdf", "2011-08-03 - HTran and the Advanced Persistent Threat.pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading.pdf", "2011-09-09 - BIOS Threat is Showing up Again!.pdf", "2011-09-02 - ZeuS Gets Another Update.pdf", "2011-08-24 - Ice IX, the first crimeware based on the leaked ZeuS sources.pdf", "2011-09-13 - Mebromi- the first BIOS rootkit in the wild.pdf", "2011-08-04 - Analysis of ngrBot.pdf", "2011-09-14 - Ice IX- not cool at all.pdf", "2011-09-14 - Malware burrows deep into computer BIOS to escape AV.pdf", "2011-09-19 - Mebromi BIOS rootkit affecting Award BIOS (aka -BMW- virus).pdf", "2011-08-28 - Windows Remote Desktop Worm -Morto- Spreading22.pdf", "2011-09-21 - Sept 21 Greedy Shylock - financial malware.pdf", "2011-09-09 - Stuxnet Malware Analysis Paper.pdf", "2011-09-27 - Debugging Injected Code with IDA Pro.pdf", "2011-10-07 - Rustock samples and analysis links. Rustock.C, E, I, J and other variants.pdf", "2011-10-14 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "2011-10-06 - ZeuS-in-the-Mobile \u2013 Facts and Theories.pdf", "2011-10-08 - Possible Governmental Backdoor Found (-Case R2D2-).pdf", "2011-10-17 - W32-Yunsip!tr.pws.pdf", "2011-10-06 - Sep 28 CVE-2010-3333 Manuscript with Taidoor (Trojan.Matryoshka by CyberESI).pdf", "2011-10-13 - A Detailed Analysis of an Advanced Persistent Threat Malware.pdf", "2011-10-31 - The Significance of the -Nitro- Attacks.pdf", "2011-10-26 - Tsunami Backdoor Can Be Used for Denial of Service Attacks.pdf", "2011-12-20 - Analyzing CVE-2011-4369 \u2013 Part One.pdf", "2011-12-08 - The Sykipot Attacks.pdf", "2011-12-11 - Intro. To Reversing - W32Pinkslipbot.pdf", "Duqu Trojan Questions and Answers.pdf", "Palebot trojan.pdf", "HTran.pdf", "Ghost RAT- Many faces.pdf", "Operation Shady Rat.pdf", "Alleged APT Intrusion Set 1.php Group.pdf", "Stuxnet , Duqu - The Evolution of Drivers.pdf", "The RSA Hack.pdf", "The Nitro Attacks - Stealing secrets from the Chemical Industry.pdf", "Global_Energy_Cyberattacks_-_Night_Dragon_.pdf", "The LURID Downloader.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "kikinumpav", "id": "385742", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1031, "domain": 435, "CVE": 13, "FileHash-MD5": 155, "FileHash-SHA1": 8, "FileHash-SHA256": 234, "email": 9, "hostname": 1031 }, "indicator_count": 2916, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "5 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66db08e5a7f6887359fa35e2", "name": "picz.in.th", "description": "", "modified": "2025-06-19T04:44:45.537000", "created": "2024-09-06T13:51:33.753000", "tags": [], "references": [ "https://www.virustotal.com/graph/g5c18343ff7554bd8bbc90f8e8ff3ae282bbaab7bbdab4abd803396d74969792a" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 24, "FileHash-SHA1": 24, "FileHash-SHA256": 307, "URL": 20, "domain": 8, "hostname": 37 }, "indicator_count": 420, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "346 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f1accda30d94af7e846357", "name": "Zendesk as VirusTotal \u00bb Ransom:Win32/CVE", "description": "*https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088 |||\n\n*In this situation a target received a VirusTotal / Zendesk drive by pop up message that site was unauthorized , fraud risk. The link has it all! Downloaders, install core, browser bar malware, ransomware, python script. Heavy attack. Desires deletion of device , accounts and contents.\n |||\nALF:HeraklezEval:Ransom:Win32/CVE , \nALF:Trojan:Win32/Cassini_6d4ebdc9 ,\nBackdoor:Win32/Zegost ,\nCVE-2023-22518 ,\nCVE-2023-4966 ,\nFakeAV.FOR ,\nMalware:AddsCopyToStartup ,\nNinite ,\nNoobyProtect ,\nTEL:Trojan:Win64/GoCLR ,\nTELPER:HSTR:CLEAN:Ninite ,\nTrojan:Win32/Cobaltstrike ,\nTrojan:Win32/Dridex ,\nTrojan:Win32/Fanop ,\nTrojan:Win32/Neconyd ,\nTrojan:Win32/Startpage ,\nTrojan:Win32/Zombie ,\nVirTool:Win32/Injector.gen!BQ ,\nVirTool:Win32/Obfuscator ,\nWin.Trojan.Generic-9935365-0 ,\nWorm:Win32/Autorun", "modified": "2024-10-23T17:03:27.463000", "created": "2024-09-23T18:00:45.146000", "tags": [ "as396982 google", "setup", "passive dns", "unknown", "ninite sep", "a td", "443 ma2592000", "accept", "gmt cache", "trojan", "status", "name servers", "urls", "creation date", "search", "emails", "servers", "as15169 google", "aaaa", "cname", "virtool", "cryp", "as19527 google", "win32", "related pulses", "file samples", "files matching", "date hash", "trojan features", "entries", "search otx", "telper", "worm", "copyright", "levelblue", "files domain", "files related", "pulses none", "accept accept", "as16625 akamai", "as20940", "asnone united", "nxdomain", "expiration date", "as21342", "as132147", "china", "as9808 china", "body", "all scoreblue", "backdoor", "alf features", "all search", "domain", "as15133 verizon", "as16552 tiggee", "url https", "http", "hostname", "ninite", "united states", "scan endpoints", "show", "showing", "next", "united", "as54113", "github pages", "formbook cnc", "checkin", "mtb aug", "a domains", "class", "twitter", "certificate", "record value", "pulse pulses", "overview ip", "address", "related nids", "files location", "div div", "github", "meta", "homepage", "form", "as36459", "g2 tls", "rsa sha256", "as29791", "dynamicloader", "medium", "yara detections", "dynamic", "filehash", "sha256", "february", "copy", "otx telemetry", "related tags", "a li", "span p", "dj ai", "dongjun jeong", "a h2", "writeups", "infosec journey", "script urls", "netherlands", "a nxdomain", "aaaa nxdomain", "cloudfront", "trojandropper", "china unknown", "msie", "chrome", "ipv4", "noobyprotect", "files", "peeringdb", "sign", "github copilot", "view", "notifications", "branches tags", "code issues", "pull", "write", "star", "code", "stars", "python", "shell", "footer", "meta name", "robots content", "x ua", "ieedge chrome1", "incapsula", "as62597 nsone", "dnssec", "win32mydoom sep", "windows nt", "wow64", "khtml", "gecko", "query", "jpn write", "e0e8e", "observed dns", "expiro", "defender", "malware", "possible", "suspicious", "activity dns", "mtb may", "sameorigin", "domain name", "error", "moved", "server", "mtb sep", "win32cve sep", "cloud provider", "reverse dns", "america asn", "dns resolutions", "domains top", "level", "unique tlds", "pulses", "default", "yara rule", "high", "cnc checkin", "cape", "powershell", "vmprotect", "local", "agent", "domainabuse", "su liao", "zhi pin", "application", "expiro malware", "anomalous file", "june", "fakedout threat", "analyzer paste", "iocs", "samples", "exploit", "germany unknown", "as14636", "russia unknown", "as9123 timeweb", "as45102 alibaba", "as43830", "read c", "write c", "process32nextw", "regsetvalueexa", "regdword", "installcore", "format", "delphi", "stack", "downloader", "urls http", "delete c", "tls handshake", "number", "failure", "delete", "ids detections", "fadok", "template", "slcc2", "media center", "contacted", "ollydbg", "internal", "simda", "brian sabey", "going dark", "stop", "as14061", "hostnames", "as48287 jsc", "as50340", "czechia unknown", "date" ], "references": [ "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088", "GitHub - peeringdb/peeringdb-py: PeeringDB python client", "00-skillsetparadesarrollo.zendesk.com", "https://github.com/peeringdb/peeringdb-py", "From the lovely Cyber Folks .PL Cover" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Poland", "Australia", "Austria", "Canada", "Netherlands", "China" ], "malware_families": [ { "id": "CVE-2023-22518", "display_name": "CVE-2023-22518", "target": null }, { "id": "CVE-2023-4966", "display_name": "CVE-2023-4966", "target": null }, { "id": "FakeAV.FOR", "display_name": "FakeAV.FOR", "target": null }, { "id": "TELPER:HSTR:CLEAN:Ninite", "display_name": "TELPER:HSTR:CLEAN:Ninite", "target": null }, { "id": "VirTool:Win32/Obfuscator", "display_name": "VirTool:Win32/Obfuscator", "target": "/malware/VirTool:Win32/Obfuscator" }, { "id": "Trojan:Win32/Dridex", "display_name": "Trojan:Win32/Dridex", "target": "/malware/Trojan:Win32/Dridex" }, { "id": "Worm:Win32/Autorun", "display_name": "Worm:Win32/Autorun", "target": "/malware/Worm:Win32/Autorun" }, { "id": "Malware:AddsCopyToStartup", "display_name": "Malware:AddsCopyToStartup", "target": null }, { "id": "Trojan:Win32/Cobaltstrike", "display_name": "Trojan:Win32/Cobaltstrike", "target": "/malware/Trojan:Win32/Cobaltstrike" }, { "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9", "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9", "target": null }, { "id": "Trojan:Win32/Startpage", "display_name": "Trojan:Win32/Startpage", "target": "/malware/Trojan:Win32/Startpage" }, { "id": "Backdoor:Win32/Zegost", "display_name": "Backdoor:Win32/Zegost", "target": "/malware/Backdoor:Win32/Zegost" }, { "id": "Trojan:Win32/Fanop", "display_name": "Trojan:Win32/Fanop", "target": "/malware/Trojan:Win32/Fanop" }, { "id": "Trojan:Win32/Neconyd", "display_name": "Trojan:Win32/Neconyd", "target": "/malware/Trojan:Win32/Neconyd" }, { "id": "Trojan:Win32/Zombie", "display_name": "Trojan:Win32/Zombie", "target": "/malware/Trojan:Win32/Zombie" }, { "id": "Win.Trojan.Generic-9935365-0", "display_name": "Win.Trojan.Generic-9935365-0", "target": null }, { "id": "Ninite", "display_name": "Ninite", "target": null }, { "id": "NoobyProtect", "display_name": "NoobyProtect", "target": null }, { "id": "TEL:Trojan:Win64/GoCLR", "display_name": "TEL:Trojan:Win64/GoCLR", "target": null }, { "id": "ALF:HeraklezEval:Ransom:Win32/CVE", "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE", "target": null }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4891, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2436, "CVE": 3, "FileHash-MD5": 2510, "FileHash-SHA1": 2063, "FileHash-SHA256": 4054, "hostname": 1788, "URL": 1228, "email": 16 }, "indicator_count": 14098, "is_author": false, "is_subscribing": null, "subscriber_count": 244, "modified_text": "584 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "soccersuck.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "soccersuck.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780242196.3768888 }