{ "type": "Domain", "indicator": "suscom.net", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/suscom.net", "alexa": "http://www.alexa.com/siteinfo/suscom.net", "indicator": "suscom.net", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2129296905, "indicator": "suscom.net", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "691e2279ac1ef8b9dbfbc2b3", "name": "Mirai \u2022 Neurotox Institute", "description": "Found in peripheral. Lazarus. Related tomOperation Endgame. Strangely related to the entertainment industry. \nRelated to treatments facilities where a target I\u2019ve been researching received \u2018care\u2019. Also links to Major Entertainment conglomerate : not surprisingly Hall Render and Foundry.\nPage was stated to expire 11/21 | expired after I was able to capture a live screenshot (not updated for years) \n\n[The Neurotoxin Institute (NTI) is a multidisciplinary organization created to serve as a comprehensive independent source of information related to the basic science and the clinical applications of neurotoxins. The Institute fosters the learning and teaching of both theory and practical techniques, and encourages further research in support of these goals.\nExperimental Biology (EB)\nwww.aapmr.org]", "modified": "2025-12-19T19:00:18.927000", "created": "2025-11-19T20:03:05.195000", "tags": [ "united", "link", "virtool", "meta", "atom", "pragma", "dynamicloader", "msie", "windows nt", "tls handshake", "failure", "tlsv1", "forbidden", "ogoogle trust", "encrypt", "possible", "write", "malware", "consumed", "netherlands", "united kingdom", "read c", "sality", "delphi", "win32", "strings", "xserver", "post http", "post method", "cryptexportkey", "ocloudflare", "cryptgenkey", "calgrc4", "persistence", "execution", "div div", "script script", "span a", "a li", "unknown ns", "span", "april", "passive dns", "hosting", "reverse dns", "hostname add", "files ip", "asn as32475", "address domain", "mirai", "united states", "facebook", "twitter", "youtube", "ck ids", "mh may", "t1204 technique", "user execution", "suggested", "port", "destination", "telnet login", "high", "tcp syn", "infectednight", "resolverror", "suspicious path", "ids detections", "yara detections", "sinkhole cookie", "file score", "detections sf", "value snkz", "forbidden tls", "et trojan", "value", "et info", "et", "present oct", "domain", "title", "present sep", "moved", "server", "next associated", "ipv4 add", "urls", "files", "trojan", "cookie", "predict70 sep", "next http", "scans record", "forbidden date", "gmt content", "type", "unix", "namecheap url", "forward elf", "md5 add", "less see", "contacted", "pulse pulses", "av detections", "analysis date", "virus", "ee fc", "unknown", "yara rule", "ff d5", "search", "show", "suspicious", "fbq object", "ide value", "source level", "url text", "line", "allow attribute", "mootools", "class function", "chain", "options", "elements", "garbage", "drag", "xhr function", "ajax", "itemid14", "kb image", "kb script", "b image", "b stylesheet", "b script", "kb stylesheet", "stylesheet", "redirect chain", "path size", "type mimetype", "resource", "general full", "montreal", "canada", "asn16276", "debian", "url http", "hash", "main", "cookie object", "dns any", "date", "entries", "url https", "Foundry", "Lazarus", "Endgame", "Neurotoxin Institute", "Hall Render", "Brian Sabey", "UC Health", "Britney Spears Official" ], "references": [ "https://www.neurotoxininstitute.com/", "Backdoor.Win32.Pushdo.s Checkin", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "http://appelfarm.org", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "Interesting Strings : 13.79.87.163", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "https://britneyspears.com/", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/" ], "public": 1, "adversary": "Lazarus", "targeted_countries": [ "United States of America", "Japan", "France", "Germany", "Canada", "Netherlands", "United Kingdom of Great Britain and Northern Ireland", "New Zealand", "Italy", "Aruba", "Poland", "Singapore", "T\u00fcrkiye", "Indonesia", "Spain", "Hong Kong" ], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Netherlands", "display_name": "Netherlands", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null }, { "id": "Virus:Win32/Krepper.30760", "display_name": "Virus:Win32/Krepper.30760", "target": "/malware/Virus:Win32/Krepper.30760" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "target": null }, { "id": "Suggested", "display_name": "Suggested", "target": null }, { "id": "VirTool:Win32/VBInject.gen!MH", "display_name": "VirTool:Win32/VBInject.gen!MH", "target": "/malware/VirTool:Win32/VBInject.gen!MH" }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Softcnapp", "display_name": "Softcnapp", "target": null }, { "id": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "display_name": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "target": null }, { "id": "Win32:Zbot-RUV", "display_name": "Win32:Zbot-RUV", "target": null }, { "id": "Win32:Evo-gen", "display_name": "Win32:Evo-gen", "target": null }, { "id": "Win32:Kryptik", "display_name": "Win32:Kryptik", "target": null }, { "id": "Trojan:Win32/Bulta", "display_name": "Trojan:Win32/Bulta", "target": "/malware/Trojan:Win32/Bulta" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 511, "hostname": 198, "domain": 471, "FileHash-SHA256": 1442, "FileHash-MD5": 183, "FileHash-SHA1": 79, "email": 5, "SSLCertFingerprint": 63 }, "indicator_count": 2952, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "125 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b6b54d59d24b1522364fd6", "name": "AiCloud - Comcast Dnspionage", "description": "AiCloud, a cloud-based app that connects to Apple and Google, has been compromised by a malicious virus.", "modified": "2024-02-27T19:04:14.842000", "created": "2024-01-28T20:13:01.311000", "tags": [ "prefetch8", "command decode", "prefetch1", "suricata ipv4", "suricata udpv4", "mitre att", "united", "ck id", "show technique", "ck matrix", "date", "hybrid", "general", "click", "strings", "contact", "passive dns", "as7922 comcast", "x ua", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "meta", "status", "creation date", "search", "record value", "expiration date", "name servers", "next", "ai cloud", "cname", "as7018 att", "win32", "entries", "unknown", "body", "no redirect", "dynamicloader", "msie", "windows nt", "as16509", "medium", "default", "show", "copy", "powershell", "write", "pegasus", "apple mobile", "content", "nso group", "apple web", "apple app capable", "typosquatting", "spyware", "epoch" ], "references": [ "c-67-181-73-197.hsd1.ca.comcast.net", "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259", "identity_helper.exe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Pegasus", "display_name": "Pegasus", "target": null }, { "id": "AndroidOverlayMalware - MOB-S0012", "display_name": "AndroidOverlayMalware - MOB-S0012", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 522, "URL": 1194, "domain": 440, "FileHash-SHA256": 1528, "CVE": 1, "email": 2, "FileHash-MD5": 297, "FileHash-SHA1": 297 }, "indicator_count": 4281, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "786 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b806e2724db65b47cf66e0", "name": "AiCloud - Comcast Dnspionage", "description": "", "modified": "2024-02-27T19:04:14.842000", "created": "2024-01-29T20:13:22.271000", "tags": [ "prefetch8", "command decode", "prefetch1", "suricata ipv4", "suricata udpv4", "mitre att", "united", "ck id", "show technique", "ck matrix", "date", "hybrid", "general", "click", "strings", "contact", "passive dns", "as7922 comcast", "x ua", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "meta", "status", "creation date", "search", "record value", "expiration date", "name servers", "next", "ai cloud", "cname", "as7018 att", "win32", "entries", "unknown", "body", "no redirect", "dynamicloader", "msie", "windows nt", "as16509", "medium", "default", "show", "copy", "powershell", "write", "pegasus", "apple mobile", "content", "nso group", "apple web", "apple app capable", "typosquatting", "spyware", "epoch" ], "references": [ "c-67-181-73-197.hsd1.ca.comcast.net", "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259", "identity_helper.exe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Pegasus", "display_name": "Pegasus", "target": null }, { "id": "AndroidOverlayMalware - MOB-S0012", "display_name": "AndroidOverlayMalware - MOB-S0012", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": "65b6b54d59d24b1522364fd6", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 522, "URL": 1194, "domain": 440, "FileHash-SHA256": 1528, "CVE": 1, "email": 2, "FileHash-MD5": 297, "FileHash-SHA1": 297 }, "indicator_count": 4281, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "786 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "Interesting Strings : 13.79.87.163", "identity_helper.exe", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "Backdoor.Win32.Pushdo.s Checkin", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "https://britneyspears.com/", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "c-67-181-73-197.hsd1.ca.comcast.net", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "http://appelfarm.org", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "https://www.neurotoxininstitute.com/", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Lazarus" ], "malware_families": [ "Et", "Win32:kryptik", "Win32:evo-gen", "Trojan:win32/bulta", "Androidoverlaymalware - mob-s0012", "Virus:win32/krepper.30760", "Sality", "Alf:rpf:peattr_sigattr:predict:70", "Suggested", "Win32:zbot-ruv", "Pegasus", "Trojandownloader:win32/cutwail", "Netherlands", "Softcnapp", "Mirai", "Alf:heraklezeval:backdoor:linux/mirai.a!rf", "Virtool:win32/vbinject.gen!mh" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "691e2279ac1ef8b9dbfbc2b3", "name": "Mirai \u2022 Neurotox Institute", "description": "Found in peripheral. Lazarus. Related tomOperation Endgame. Strangely related to the entertainment industry. \nRelated to treatments facilities where a target I\u2019ve been researching received \u2018care\u2019. Also links to Major Entertainment conglomerate : not surprisingly Hall Render and Foundry.\nPage was stated to expire 11/21 | expired after I was able to capture a live screenshot (not updated for years) \n\n[The Neurotoxin Institute (NTI) is a multidisciplinary organization created to serve as a comprehensive independent source of information related to the basic science and the clinical applications of neurotoxins. The Institute fosters the learning and teaching of both theory and practical techniques, and encourages further research in support of these goals.\nExperimental Biology (EB)\nwww.aapmr.org]", "modified": "2025-12-19T19:00:18.927000", "created": "2025-11-19T20:03:05.195000", "tags": [ "united", "link", "virtool", "meta", "atom", "pragma", "dynamicloader", "msie", "windows nt", "tls handshake", "failure", "tlsv1", "forbidden", "ogoogle trust", "encrypt", "possible", "write", "malware", "consumed", "netherlands", "united kingdom", "read c", "sality", "delphi", "win32", "strings", "xserver", "post http", "post method", "cryptexportkey", "ocloudflare", "cryptgenkey", "calgrc4", "persistence", "execution", "div div", "script script", "span a", "a li", "unknown ns", "span", "april", "passive dns", "hosting", "reverse dns", "hostname add", "files ip", "asn as32475", "address domain", "mirai", "united states", "facebook", "twitter", "youtube", "ck ids", "mh may", "t1204 technique", "user execution", "suggested", "port", "destination", "telnet login", "high", "tcp syn", "infectednight", "resolverror", "suspicious path", "ids detections", "yara detections", "sinkhole cookie", "file score", "detections sf", "value snkz", "forbidden tls", "et trojan", "value", "et info", "et", "present oct", "domain", "title", "present sep", "moved", "server", "next associated", "ipv4 add", "urls", "files", "trojan", "cookie", "predict70 sep", "next http", "scans record", "forbidden date", "gmt content", "type", "unix", "namecheap url", "forward elf", "md5 add", "less see", "contacted", "pulse pulses", "av detections", "analysis date", "virus", "ee fc", "unknown", "yara rule", "ff d5", "search", "show", "suspicious", "fbq object", "ide value", "source level", "url text", "line", "allow attribute", "mootools", "class function", "chain", "options", "elements", "garbage", "drag", "xhr function", "ajax", "itemid14", "kb image", "kb script", "b image", "b stylesheet", "b script", "kb stylesheet", "stylesheet", "redirect chain", "path size", "type mimetype", "resource", "general full", "montreal", "canada", "asn16276", "debian", "url http", "hash", "main", "cookie object", "dns any", "date", "entries", "url https", "Foundry", "Lazarus", "Endgame", "Neurotoxin Institute", "Hall Render", "Brian Sabey", "UC Health", "Britney Spears Official" ], "references": [ "https://www.neurotoxininstitute.com/", "Backdoor.Win32.Pushdo.s Checkin", "IDS Detections: Backdoor.Win32.Pushdo.s Checkin Possible Compromised Host AnubisNetworks", "IDS Detections: Sinkhole Cookie Value Snkz 403 Forbidden TLS Handshake Failure", "IDS Detections: ET TROJAN Possible Compromised Host AnubisNetworks Sinkhole", "IDS Detections: Cookie Value btst ET INFO Namecheap URL Forward", "IDS Detections : SUSPICIOUS Path to BusyBox root login TELNET login failed", "http://appelfarm.org", "IDS Signatures : root login 175.203.174.23 \u2022 192.168.122.52", "IDS Signatures :TELNET login failed\t77.66.206.206 \u2022 192.168.122.52", "IDS Signatures : SUSPICIOUS Path to BusyBox\t192.168.122.52\t\u2022 77.66.206.206", "Interesting Strings : 13.79.87.163", "https://urlscan.io/screenshots/32b0614f-1148-49ea-aed4-4f23afd33e56.png", "https://otx.alienvault.com/pulse/68d0f099f60e98e6c4ffc1e5", "https://otx.alienvault.com/pulse/68b5e672f492fdc96cf997aa", "https://otx.alienvault.com/pulse/68d12dd7e357755235f007e8", "https://britneyspears.com/", "hallrender.com \u2022 https://hallrender.com/resources/blog/ \u2022 https://urlmail.hallrender.com \u2022 https://urlwww.hallrender.com", "https://citrix.hallrender.com/vpn/install/ \u2022 https://citrix.hallrender.com/vpn/install/mac.htm \u2022 https://www.hallrender.com/attorney/brian-sabey/Accept", "http://hallrender.com/attorney/brian-sabey \u2022 http://hallrender.com/attorney/brian-sabey/", "http://elite.hallrender.com/TE_3E_PROD/web/ui/dashboard/ActionList_CCC", "https://elite.hallrender.com \u2022 https://hallrender.com/attorney/gregg-m-wallander/", "brian-sabey-anyxxxtube.net \u2022 hallrender.com", "dev.hallrender.com \u2022 elite.hallrender.com \u2022 image.marketing.hallrender.com", "Now https://urlscan.io/liveshot/?width=1600&height=1200&url=http%3A%2F%2Fwww.neurotoxininstitute.com%2Findex.php%3Foption%5C%3Dcom_content%26view%5C%3Darticle%26id%5C%3D70%26Itemid%5C%3D14", "feastfoundry.com\t\u2022 https://www.feastfoundry.com/ \u2022 https://www.feastfoundry.com/mini-apple-pies/" ], "public": 1, "adversary": "Lazarus", "targeted_countries": [ "United States of America", "Japan", "France", "Germany", "Canada", "Netherlands", "United Kingdom of Great Britain and Northern Ireland", "New Zealand", "Italy", "Aruba", "Poland", "Singapore", "T\u00fcrkiye", "Indonesia", "Spain", "Hong Kong" ], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Netherlands", "display_name": "Netherlands", "target": null }, { "id": "Sality", "display_name": "Sality", "target": null }, { "id": "Virus:Win32/Krepper.30760", "display_name": "Virus:Win32/Krepper.30760", "target": "/malware/Virus:Win32/Krepper.30760" }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "display_name": "ALF:HeraklezEval:Backdoor:Linux/Mirai.A!rf", "target": null }, { "id": "Suggested", "display_name": "Suggested", "target": null }, { "id": "VirTool:Win32/VBInject.gen!MH", "display_name": "VirTool:Win32/VBInject.gen!MH", "target": "/malware/VirTool:Win32/VBInject.gen!MH" }, { "id": "ET", "display_name": "ET", "target": null }, { "id": "Softcnapp", "display_name": "Softcnapp", "target": null }, { "id": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "display_name": "ALF:RPF:PEATTR_SIGATTR:PREDICT:70", "target": null }, { "id": "Win32:Zbot-RUV", "display_name": "Win32:Zbot-RUV", "target": null }, { "id": "Win32:Evo-gen", "display_name": "Win32:Evo-gen", "target": null }, { "id": "Win32:Kryptik", "display_name": "Win32:Kryptik", "target": null }, { "id": "Trojan:Win32/Bulta", "display_name": "Trojan:Win32/Bulta", "target": "/malware/Trojan:Win32/Bulta" } ], "attack_ids": [ { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 511, "hostname": 198, "domain": 471, "FileHash-SHA256": 1442, "FileHash-MD5": 183, "FileHash-SHA1": 79, "email": 5, "SSLCertFingerprint": 63 }, "indicator_count": 2952, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "125 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b6b54d59d24b1522364fd6", "name": "AiCloud - Comcast Dnspionage", "description": "AiCloud, a cloud-based app that connects to Apple and Google, has been compromised by a malicious virus.", "modified": "2024-02-27T19:04:14.842000", "created": "2024-01-28T20:13:01.311000", "tags": [ "prefetch8", "command decode", "prefetch1", "suricata ipv4", "suricata udpv4", "mitre att", "united", "ck id", "show technique", "ck matrix", "date", "hybrid", "general", "click", "strings", "contact", "passive dns", "as7922 comcast", "x ua", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "meta", "status", "creation date", "search", "record value", "expiration date", "name servers", "next", "ai cloud", "cname", "as7018 att", "win32", "entries", "unknown", "body", "no redirect", "dynamicloader", "msie", "windows nt", "as16509", "medium", "default", "show", "copy", "powershell", "write", "pegasus", "apple mobile", "content", "nso group", "apple web", "apple app capable", "typosquatting", "spyware", "epoch" ], "references": [ "c-67-181-73-197.hsd1.ca.comcast.net", "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259", "identity_helper.exe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Pegasus", "display_name": "Pegasus", "target": null }, { "id": "AndroidOverlayMalware - MOB-S0012", "display_name": "AndroidOverlayMalware - MOB-S0012", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 522, "URL": 1194, "domain": 440, "FileHash-SHA256": 1528, "CVE": 1, "email": 2, "FileHash-MD5": 297, "FileHash-SHA1": 297 }, "indicator_count": 4281, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "786 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65b806e2724db65b47cf66e0", "name": "AiCloud - Comcast Dnspionage", "description": "", "modified": "2024-02-27T19:04:14.842000", "created": "2024-01-29T20:13:22.271000", "tags": [ "prefetch8", "command decode", "prefetch1", "suricata ipv4", "suricata udpv4", "mitre att", "united", "ck id", "show technique", "ck matrix", "date", "hybrid", "general", "click", "strings", "contact", "passive dns", "as7922 comcast", "x ua", "scan endpoints", "all octoseek", "ipv4", "pulse pulses", "urls", "files", "meta", "status", "creation date", "search", "record value", "expiration date", "name servers", "next", "ai cloud", "cname", "as7018 att", "win32", "entries", "unknown", "body", "no redirect", "dynamicloader", "msie", "windows nt", "as16509", "medium", "default", "show", "copy", "powershell", "write", "pegasus", "apple mobile", "content", "nso group", "apple web", "apple app capable", "typosquatting", "spyware", "epoch" ], "references": [ "c-67-181-73-197.hsd1.ca.comcast.net", "https://www.hybrid-analysis.com/sample/dc5ce323e37bebef2abbd0374249e12355c84dba32f40511eceafa29b57e3872/65b5134ce0242fd6e30b7259", "identity_helper.exe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrojanDownloader:Win32/Cutwail", "display_name": "TrojanDownloader:Win32/Cutwail", "target": "/malware/TrojanDownloader:Win32/Cutwail" }, { "id": "Pegasus", "display_name": "Pegasus", "target": null }, { "id": "AndroidOverlayMalware - MOB-S0012", "display_name": "AndroidOverlayMalware - MOB-S0012", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" } ], "industries": [], "TLP": "white", "cloned_from": "65b6b54d59d24b1522364fd6", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 522, "URL": 1194, "domain": 440, "FileHash-SHA256": 1528, "CVE": 1, "email": 2, "FileHash-MD5": 297, "FileHash-SHA1": 297 }, "indicator_count": 4281, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "786 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "suscom.net", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "suscom.net", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1777008619.457143 }