{ "type": "Domain", "indicator": "xml.org", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/xml.org", "alexa": "http://www.alexa.com/siteinfo/xml.org", "indicator": "xml.org", "type": "domain", "type_title": "Domain", "validation": [ { "source": "majestic", "message": "Whitelisted domain xml.org", "name": "Whitelisted domain" } ], "base_indicator": { "id": 1544658355, "indicator": "xml.org", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 17, "pulses": [ { "id": "69eb39604a42b712d8ed5faa", "name": "Why Join The Navy When You Can Be A Pirate?", "description": "[TNT - why join the navy if you can be a pirate - has been described as a \"troll\" by the Royal Navy and its chief of staff, Sir John Chilcot.] This certificate is still validating though untrusted further supportint the broken seal and belasco chain. Rec: 40 cryptographic specialists and 2 weeks. If not that, distrust it, if you can.", "modified": "2026-05-26T00:15:15.088000", "created": "2026-04-24T09:35:28.283000", "tags": [ "issuer tnt", "valid from", "valid", "thumbprint", "serial number" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 15, "hostname": 36, "FilePath": 1, "FileHash-MD5": 12, "FileHash-SHA256": 209, "URL": 122, "domain": 15, "URI": 1, "CVE": 2 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a00eef29b122fc211e1a85c", "name": "Copy of 5[.]1[.]0[.]0 - 05.10.26", "description": "If I didn't know better, I would guess that is AWS, Fastly, Cloudflare botnet activity Targetting Urkraine\n\nOrigin: Edmonton, Alnerta", "modified": "2026-05-10T20:47:46.993000", "created": "2026-05-10T20:47:46.993000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/gd6bc2ac4a2bd4707b7287f9643acea44af35721b1f3243b385313ddc60862e0a?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "Ukraine" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 29, "FileHash-SHA256": 370, "IPv4": 572, "IPv6": 1, "URL": 77, "domain": 35, "hostname": 134 }, "indicator_count": 1250, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3843cba399db62eeae702", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:28.397000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 509, "FileHash-SHA256": 539, "URL": 387, "hostname": 361, "domain": 100, "CIDR": 1, "email": 1 }, "indicator_count": 2679, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3843b5a1ded80a61cb9fa", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:27.893000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 252, "FileHash-SHA1": 48, "FileHash-SHA256": 44, "URL": 108, "hostname": 131, "domain": 9 }, "indicator_count": 592, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d379cd3bba574ce989a64b", "name": "VirusTotal report\n for base.apk", "description": "https://www.virustotal.com/gui/file/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743/details", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T09:15:57.936000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 81, "FileHash-MD5": 2, "FileHash-SHA1": 2, "URL": 56, "domain": 6, "hostname": 19 }, "indicator_count": 166, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3796fc3fdb987f491d635", "name": "VirusTotal report\n for base.apk", "description": "https://www.virustotal.com/gui/file/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743/details", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T09:14:23.776000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 243, "FileHash-MD5": 6, "FileHash-SHA1": 6, "URL": 78, "domain": 10, "hostname": 25 }, "indicator_count": 368, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e36a79b52e21105f258e6e", "name": "Vasyaperskyi from Russia mrt.exe urls in memory", "description": "VirusTotal Graph (miniuser, 2025)", "modified": "2025-11-05T07:02:18.726000", "created": "2025-10-06T07:06:33.301000", "tags": [ "entity" ], "references": [ "https://www.virustotal.com/graph/embed/g421f9bbfc29448f8acd6e6e0eaa616e332de270d8f5c4b34bcfc69f325a7bbc7?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 86, "FileHash-MD5": 43, "FileHash-SHA1": 43, "FileHash-SHA256": 135, "domain": 6, "hostname": 39 }, "indicator_count": 352, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68be993e9615b0e3e813b707", "name": "MalBeacon - Apple Tor Project | Hostile", "description": "Google.com is the world's largest web server, with an address address of 2.5 million users.. and a domain of 1.6 million servers. \u00c2\u00a31.3bn", "modified": "2025-10-08T08:03:50.685000", "created": "2025-09-08T08:52:14.428000", "tags": [ "present mar", "present aug", "present jun", "france unknown", "present jan", "present dec", "present may", "present apr", "passive dns", "tor exit", "ipv4", "reverse dns", "location france", "france asn", "as15557", "courier", "accept", "genco labs", "comments", "authority", "fileversion", "g2 c", "llc st", "md5 add", "lowfi", "united", "backdoor", "win32", "hacktool", "trojan", "present sep", "aaaa", "moved", "ip address", "apache", "ipv4 add", "america flag", "gaithersburg", "united states", "yara detections", "malware", "port", "destination", "read c", "msie", "windows nt", "wow64", "hostile", "write", "markus", "local", "unknown", "apple", "urls", "domain", "x apple", "unknown aaaa", "hostname add", "files", "files ip", "delete c", "crlf line", "cheat service", "checkin", "high", "total", "delete", "python", "learn", "ck id", "name tactics", "suspicious", "informative", "spawns", "command", "found", "defense evasion", "t1480 execution", "command decode", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "general", "path", "click", "strings", "meta", "thus", "contact", "main", "dynamicloader", "medium", "wine emulator", "dynamic", "reads", "patchcache", "pe section", "code overlap", "blackie virus", "intel", "ms windows", "pe32", "regsetvalueexa", "regdword", "pe32 executable", "delphi", "dock", "execution", "explorer", "next", "evasion att", "file defense", "dynamic api", "discovery att", "prefetch8", "prefetch1", "mitre att", "ck matrix", "localappdata", "yara signature", "process", "a domains", "malbeacon", "about contact", "portal open", "menu close", "menu home", "content home", "portal", "beaconing", "internet", "dark", "type indicator", "added active", "related pulses", "url https", "url http", "china unknown", "location china", "china asn", "as174 cogent", "twitter", "virgin islands", "creation date", "germany unknown", "unknown ns", "domain add", "tulach type", "response ip", "address google", "safe browsing", "status", "search", "date", "name servers", "showing", "record value", "error", "code", "content type", "access", "length", "title", "mtb may", "useragent", "next associated", "gmt cache", "sameorigin", "mozilla", "trojandropper", "monitored target", "packed" ], "references": [ "80.125.71.115", "Yara Detections: Armadillov171", "https://malbeacon.com/", "prod-lt-playstoregatewayadapter-pa.googleapis.com \u2022 redirector.gvt1.com \u2022 torexit.net-137.ampr.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Shodi", "display_name": "Win.Trojan.Shodi", "target": null }, { "id": "HackTool:Win64/Patcher!MSR", "display_name": "HackTool:Win64/Patcher!MSR", "target": "/malware/HackTool:Win64/Patcher!MSR" }, { "id": "Win.Malware.Lazy", "display_name": "Win.Malware.Lazy", "target": null }, { "id": "VirTool:MSIL/CryptInject.YA!MTB", "display_name": "VirTool:MSIL/CryptInject.YA!MTB", "target": "/malware/VirTool:MSIL/CryptInject.YA!MTB" }, { "id": "Ransom:Win32/Gojdue", "display_name": "Ransom:Win32/Gojdue", "target": "/malware/Ransom:Win32/Gojdue" }, { "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb", "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb", "target": null }, { "id": "Meredrop", "display_name": "Meredrop", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "AutoRun", "display_name": "AutoRun", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 852, "FileHash-MD5": 508, "FileHash-SHA1": 407, "FileHash-SHA256": 4566, "URL": 3778, "domain": 789, "email": 8, "SSLCertFingerprint": 2 }, "indicator_count": 10910, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "237 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682c13f55aa5148885011347", "name": "STEALER remotely attacks US iOS devices", "description": "(trojan.convagent/nekark)\nCrowdsourced Sigma Rules || System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali\n| Regsvr32 DLL Execution With Uncommon Extension by Florian Roth (Nextron Systems\nBehavior Tags #calls-wmi #checks-network-adapters %checks-user-input #detect-debug-environment || Datasetactions| System Property Lookups > WbemServices::Connect\nIWbemServices::ExecQuery - root\\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMedia", "modified": "2025-06-19T04:00:22.753000", "created": "2025-05-20T05:32:36.181000", "tags": [ "vmware http", "vmware", "windows nt", "win64", "khtml", "gecko", "post http", "request", "host", "contentlength", "accept texthtml", "connection", "md5 code", "win32 exe", "pe32", "intel", "ms windows", "generic windos", "executable", "dos executable", "generic", "pe32 installer", "inno setup", "delphi", "udp a83f8110" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 257, "URL": 134, "domain": 75, "hostname": 49, "FileHash-MD5": 27, "FileHash-SHA1": 12 }, "indicator_count": 554, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67980c317b7bb954fd0cc8ab", "name": "https://vuldb.com/ http://www.scip.ch http://cvedetails.com", "description": "", "modified": "2025-05-14T20:42:29.121000", "created": "2025-01-27T22:44:01.462000", "tags": [ "sha256", "imphasz", "pejzasz", "wirustotal", "wysoki", "baseseverity", "google android", "tempseverity", "redni", "limit", "znaleziono luk", "zostaa", "cwe787", "vuldb", "impact", "android", "scip", "scip ag", "zurich", "switzerland", "swiss", "security", "contact", "vulnerability", "news", "us news", "history data", "privacy notice", "offense defense", "locations blog", "defense", "alexa", "google play", "cve pliki", "krytyczny", "androidem", "aosp", "imagination", "zabezpiecze z", "problemy", "typ poziom", "protect", "mainline", "pixel", "ssdeep", "z\u00fcrich", "schweiz", "magazin bcher", "business firma", "news vortrge", "aktuell archiv", "anfahrt blog", "blog aktuell", "archiv", "vulnerability database", "vulnerability data feed", "vdb", "vulndb", "cve", "nvd", "cyber threat intelligence", "hack", "hacking", "it-security", "information security", "infosec", "cybersecurity", "exploit", "exploiting", "open-source", "team", "tenda cp3", "vuldb mod", "cti team", "intelligence", "please", "abb flxeon", "latest", "exploits", "sliver", "download", "sha1" ], "references": [ "https://source.android.com/security/bulletin/2021", "http://www.scip.ch", "http://vuldb.com", "http://cvedetails.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 140, "URL": 605, "CVE": 37, "domain": 68, "FileHash-SHA256": 653, "FileHash-MD5": 52, "FileHash-SHA1": 82, "IPv4": 6, "email": 1 }, "indicator_count": 1644, "is_author": false, "is_subscribing": null, "subscriber_count": 125, "modified_text": "384 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66f235b9a7a94a6a61acd651", "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan", "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.", "modified": "2025-03-07T08:38:08.584000", "created": "2024-09-24T03:44:57.902000", "tags": [ "geoip", "public url", "as16509", "amazon02", "as20940", "akamaiasn1", "as8075", "as15169", "google", "akamaias", "facebook", "telecom", "twitter", "media", "win64", "level3", "mini", "ukraine", "proton", "ghost", "win32", "cuba", "mexico", "indonesia", "seznam", "as3359", "as852" ], "references": [ "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1", "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c", "https://n0paste.eu/UH6n5pD/" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Anguilla", "Poland", "Aruba", "Australia", "Barbados", "Costa Rica", "Guatemala", "Philippines", "Panama", "Sint Maarten (Dutch part)", "Saint Martin (French part)", "Cayman Islands", "Cura\u00e7ao", "Mexico", "Saint Vincent and the Grenadines", "Saint Kitts and Nevis", "Tanzania, United Republic of", "Netherlands", "Ukraine", "Trinidad and Tobago", "Japan", "Bahamas", "United Kingdom of Great Britain and Northern Ireland", "Georgia" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Government", "Telecommunications", "Healthcare" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1, "CIDR": 1186, "CVE": 4, "FileHash-MD5": 29, "FileHash-SHA1": 3, "URL": 25493, "domain": 5396, "email": 10, "hostname": 10770 }, "indicator_count": 42892, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "452 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "670e79d0083d46c0532d2602", "name": "5[.]1[.]0[.]0 - Windows NT & Program Files IE - 10.15.24", "description": "Hgkghk, \u00c2\u00a31.1m, is the latest in a series of names to be added to the list of domain names that can be used to track users' activity.\nWorking my way around this Pesky IP", "modified": "2024-11-14T14:02:16.695000", "created": "2024-10-15T14:18:56.639000", "tags": [ "entity", "Windows NT", "Internet Explorer", "Program Files" ], "references": [ "https://www.virustotal.com/graph/embed/g4ba19a7ec3564c599b1b8d19935cc3ccb7b538708e9b4a3b9048ec86e0062e01?theme=dark", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/iocs", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/community", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/graph" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 77, "FileHash-MD5": 41, "FileHash-SHA1": 38, "FileHash-SHA256": 256, "domain": 21, "hostname": 131 }, "indicator_count": 564, "is_author": false, "is_subscribing": null, "subscriber_count": 133, "modified_text": "565 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66cbb85a6cfde70987049f81", "name": "Hijacked Android: CryptInject | Dridex | Spyware", "description": "Hijacked basic android phone purchased in US directly from vendor not carrier. Spyware, SQL and other malware found. \nIt's a bit confusing IC3 is typically synonymous with United States FBI cyber security complaint division. Issue appear to be originating from China. This is interesting. Microsoft Teams CN have login, password, account, modification privileges as well as an 'audience'. \nVictim contacted IC3, received no response when contacting IC3 from personal devices. Calls are being made from phone as well as many other intrusive activities.\nOriginated from an IP address found on phone with a SWIPPER dba Verizon Business with a Hurricane Electric BGP relationship.", "modified": "2024-09-24T21:00:32.174000", "created": "2024-08-25T23:03:54.460000", "tags": [ "windows", "service", "shellexecuteexw", "writeconsolew", "registry", "modify existing", "dock", "write", "malware", "binary_yara", "yara rule", "binary file", "all scoreblue", "av detections", "ids detections", "yara detections", "alerts", "all search", "otx scoreblue", "analysis date", "risk", "show", "filehash", "april", "trojanspy", "file score", "june", "passive dns", "urls", "hostname", "url analysis", "domain", "china unknown", "as133775", "as4847 china", "united", "as4811 china", "as4837 china", "as54994 quantil", "as133774", "cname", "aaaa", "as20940", "registrar", "unknown related", "pulses otx", "tags", "present", "issuer cus", "odigicert inc", "road", "beijing country", "blue cloud", "apnic person", "cn phone", "ip information", "quick stats", "ip location", "china", "ltd asn", "whois lookup", "bluecloud descr", "shanghai blue", "ltd descr", "apnic irt", "beijing email", "whois lookups", "country", "filtered role", "abuse cnniccn", "algorithm", "key usage", "first", "v3 serial", "number", "cus odigicert", "inc cndigicert", "basic rsa", "cn ca", "g2 validity", "status hostname", "query type", "address first", "seen last", "country unknown", "files ip", "sql client", "historical ssl", "referrer", "win32", "entries", "scan endpoints", "pulse pulses", "copy" ], "references": [ "ic3he-ge.teams.trafficmanager.cn | ic3he-ge.teams.trafficmanager.cn | partnerapi.trafficmanager.cn | 001-ea3.chn.cos.audience.teams.microsoftonline.cn | eventsync.trafficmanager.cn", "Yara Detections: ProcessInjector_Gen , stack_string , Cabinet_Archive , VM_Unknown , UPX", "bjb.webshell.suite.partner.microsoftonline.cn | Shanghai Blue", "001-ea3.chn.cos.audience.teams.microsoftonline.cn | 001-no3.chn.cos.audience.teams.microsoftonline.cn", "https://callcontroller.cnea3-02.ic3-calling-callcontroller.chinaeast3-gallatin.cosmic.partner.outlook.cn", "partnerapi.trafficmanager.cn | 001-ea3.chn.cos.audience.teams.microsoftonline.cn | eventsync.trafficmanager.cn", "http://callcontroller.cnea3-02.ic3-calling-callcontroller.chinaeast3-gallatin.cosmic.partner.outlook.cn", "http://callcontroller.cnno3-02.ic3-calling-callcontroller.chinanorth3-gallatin.cosmic.partner.outlook.cn", "ic3-media-audiencebot.chn-ea3-001.ic3-media-audiencebot.chinaeast3-gallatin.cosmic.partner.outlook.cn", "ic3-media-mpaas-ivr.chn-no3-002.ic3-media-mpaas-ivr.chinanorth3-gallatin.cosmic.partner.outlook.cn", "ic3-media-audiencebot.chn-no3-001.ic3-media-audiencebot.chinanorth3-gallatin.cosmic.partner.outlook.cn", "http://w.cn4e.com/login/bc.jsp?p=vfqFFKW%2BIGfiCD65IDGjyLxM2SI6T01nMjOHYnstwLOHKIWDgmOKTOF1xSdw9Gcgk3Vsw%2BiMEMZg0exeBk76yA%3D%3D%26njqroJJefuLemxYifUtAyeML%2FLMURbuIPYQZrlWic%2BL8e8HVbJO9uR2YxwgfwZct39x09olEQGUt7c7AUR5VeQ%3D%3D%26KwZ41toCvJmi5lujp8N8y8fB65auqmMzD93Hpf2Y7lSTCl0TqvssvQvyWAsH9sX6ykvG0puC%2FCCRD48L9J5YjQ%3D%3D%26ck6ZnzP%2FWNQV%2BmK5uOzxgB9XdQbUEnnpNXUT0vCUKGpoDcmpZLuzbmyzsZfKKGyzo8r7L0Qwfw2mff0zdyc5BA%3D%3D&d=yongstextile.com", "http://www.forensickb.com/2013/03/file-entropy-explained.html", "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.forensickb.com/2013/03/file-entropy-explained.html", "http://phoenix.yizimg.com/alabiaga/androidx/commit/d7e342ef6cfe5885f1bb786f1912a039422b9251", "TrojanSpy:Win32/Rebhip.F: http://w.cn4e.com/login/bc.jsp?p=ix5KZDRKcnWBJ6ajdBhecP1lMuzLoE1s0C1i9+ksxWcZJK/hYGZdXSDPe3xCp02xzq0EXsDt+GEIykVMplIPKA==&4lC8a2Py9lOxeYnfOWCZPU0VlLoLx7fVrfU2hBe8CgagrYeJS+SoNc3W34M2h/kbKz5RbH+OFy2SfjMAmGu74w==&A9VopQG0dDxhY+Ku/NF1C8FGNvIhy36pnzqkS4GgTjwsbI8ok+B5K8FXJW2kEIlJxYQu19lSwkqKJu+UtcZvfg==&G/9EanSL/XFEPUA7CiWzOg/9sPYcdFKz90x7wGXCESBsMdCvrrldf9ZZrjBpUx8XdG6aK/wR8sqSksJ5wA9Y6Q==&YRQGDPQJkCxAmK4eNjFDC7I0arWP+eE6UIJHCPmv/HXDcxRWPDOXlzXK7uvuVDkjA1llh8gOam+rpWLXZTx+uQ==&d=sicoto", "TrojanSpy:Win32/Rebhip.F: 5586f9b1a688d58ead675547231f84daf30c0c1c18fc6584fb37cfdaa5125fea", "VirTool:MSIL/CryptInject!: FileHash-SHA256 bbabbbdfbb40016ed75a7ceb3f983c58797577247ffba74a1d0aab46b72b0643", "Yara Detections ConventionEngine_Keyword_Launch , MS_Visual_Cpp_2003 , Cabinet_Archive , Nullsoft_NSIS", "tokenencryption.mam.manage-ppe.microsoftonline.cn | https://encrypt.enterpriseregistration.partner.microsoftonline.cn", "http://virii.es/U/Using Entropy Analysis to Find Encrypted and Packed Malware.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:AGGR:Mytonel_Obfuscator", "display_name": "ALF:AGGR:Mytonel_Obfuscator", "target": null }, { "id": "Win.Malware.Generic-9870238-0", "display_name": "Win.Malware.Generic-9870238-0", "target": null }, { "id": "ALF:HeraklezEval:TrojanSpy:Win32/Rebhip.F", "display_name": "ALF:HeraklezEval:TrojanSpy:Win32/Rebhip.F", "target": null }, { "id": "TrojanSpy", "display_name": "TrojanSpy", "target": null }, { "id": "Win.Malware.Zusy-9875693-0", "display_name": "Win.Malware.Zusy-9875693-0", "target": null }, { "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Dridex!rfn", "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Dridex!rfn", "target": null }, { "id": "ALF:JASYP:VirTool:MSIL/CryptInject!atmn", "display_name": "ALF:JASYP:VirTool:MSIL/CryptInject!atmn", "target": null } ], "attack_ids": [ { "id": "T1031", "name": "Modify Existing Service", "display_name": "T1031 - Modify Existing Service" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1505.001", "name": "SQL Stored Procedures", "display_name": "T1505.001 - SQL Stored Procedures" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" }, { "id": "T1564.005", "name": "Hidden File System", "display_name": "T1564.005 - Hidden File System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1673, "FileHash-SHA1": 1344, "FileHash-SHA256": 3753, "domain": 224, "hostname": 613, "URL": 490, "email": 8, "CIDR": 1 }, "indicator_count": 8106, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "616 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c52fe96ef88583efb8484f", "name": "Compromised Host - Malwarebytes | Injector | Simba | System Hijacking", "description": "", "modified": "2024-09-15T07:02:25.374000", "created": "2024-08-21T00:08:09.738000", "tags": [ "historical ssl", "threat network", "infrastructure", "referrer", "adversaries", "information", "win32diskdrive", "win32processor", "windows", "registry run", "registers", "flow t1574", "dll sideloading", "powershell", "window", "modify registry", "e1203 windows", "catalog tree", "analysis ob0001", "b0001 memory", "b0002 guard", "virtual machine", "detection b0009", "check registry", "check", "cnamazon rsa", "m02 oamazon", "number", "cus subject", "data", "m01 oamazon", "dns resolutions", "ip traffic", "memory pattern", "domains", "hashes", "user", "peexe c", "text c", "menu c", "menuprograms c", "games c", "text", "ttf c", "file system", "defender c", "desktop", "analyzer paste", "iocs", "hostnames", "url https", "samples", "generic malware", "tag count", "tue apr", "analyzer threat", "url summary", "ip summary", "summary", "sample", "first", "generic", "united", "mail spammer", "host", "cins active", "poor reputation", "detection list", "ip address", "blacklist", "malicious host", "team http", "cisco umbrella", "site", "safe site", "alexa top", "million", "fuery", "malware", "presenoker", "team", "riskware", "artemis", "passive dns", "as44273 host", "urls", "scan endpoints", "all scoreblue", "pulse pulses", "files", "domain", "files ip", "unknown", "germany unknown", "bq aug", "virtool", "ipv4", "main", "related pulses", "file samples", "files matching", "show", "search", "date hash", "showing", "next", "win32", "nxdomain", "ip related", "gmt content", "type", "x frame", "sameorigin x", "xss protection", "encrypt", "asnone united", "title error", "pulse submit", "url analysis", "date", "status", "creation date", "name servers", "hostname", "urls http", "msie", "windows nt", "slcc2", "media center", "suspicious", "verisign", "simda", "copy", "possible", "class", "write", "code", "win32 exe", "available from", "services", "registry tech", "server", "registrar abuse", "dnssec", "registrant name", "ninite", "dns replication", "technology", "bq jun", "bq jul", "domain status", "domain name", "contact email", "contact phone", "full name", "algorithm", "v3 serial", "key algorithm", "key identifier", "subject key", "identifier", "x509v3 key", "usage", "info", "avast avg", "entries", "exclusionpath", "created", "shell commands", "processes tree", "silent log", "norestart", "k wersvcgroup", "pss s", "k wsappx", "signals mutexes", "mutexes", "global", "synchronization", "dataset", "system property", "lookups", "select index", "macaddress", "adaptertypeid0", "win32bios", "index0", "where index0", "select uuid", "self-delete", "persistence", "macro-powershell", "long-sleeps", "calls-wmi", "checks-bios", "checks-disk-space", "checks-memory-available", "checks-network-adapters", "checks-usb-bus", "checks-user-input", "crypto", "detect-debug-environment", "dos batch", "file type", "pe resource", "malicious", "socks5systemz", "nushell", "autodiscovery", "cookietheft", "twitter ad", "dos batch file", "t1064 executes", "mitre att", "ta0002 command", "t1059 uses", "dlls privilege", "dlls defense", "evasion ta0005" ], "references": [ "Researched: Malwarebytes.Premium.v5.1.6.RePack.by.xetrin.zip", "MALWARE BANKER TROJAN EVADER Researched: block.malwarebytes.com", "Crowdsourced IDS rules: Matches rule (port_scan) UDP portsweep", "Crowdsourced Sigma: Matches rule Registry Persistence via Service in Safe Mode by frack113", "Crowdsourced Sigma: Matches rule Hiding Files with Attrib.exe by Sami Ruohonen | Matches rule Non Interactive PowerShell Process Spawned by Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements", "Crowdsourced Sigma: Matches rule New Root Certificate Installed Via Certutil.EXE by oscd.community, @redcanary, Zach Stanford @svch0st", "Crowdsourced Sigma: Matches rule Powershell Defender Exclusion by Florian Roth (Nextron Systems)", "Crowdsourced Sigma: Matches rule Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea)", "Crowdsourced Sigma: Matches rule Potential Persistence Via Custom Protocol Handler by Nasreddine Bencherchali (Nextron Systems)", "VirTool:Win32/Injector.gen!BQ - FileHash-SHA256 e3244c33eac9709cac1840b1b131ea25bb7c32652c7badbefe94a06038e2778e", "Antivirus Detections: Win.Trojan.Carberp-6809884-0 , VirTool:Win32/Injector.gen!BQ Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0 Yara Detections generic_shellcode_downloader Alerts injection_inter_process injection_create_remote_thread cape_detected_threat", "IDS Detections: Backdoor.Win32.Shiz.ivr Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "IDS Detections: Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0", "Yara Detections: generic_shellcode_downloader", "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat cape_extracted_content", "Silent Uninstalling.cmd | DosS | PUA.HackTool | FileHash-SHA256 26b6f985a431cbb246f62f6058958990bb468a79487c502e5815e78d6e88fe53" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Win.Trojan.Agent-316098", "display_name": "Win.Trojan.Agent-316098", "target": null }, { "id": "Win.Trojan.Istbar-231", "display_name": "Win.Trojan.Istbar-231", "target": null }, { "id": "ALF:JASYP:PUAWin32/Bibado!atmn", "display_name": "ALF:JASYP:PUAWin32/Bibado!atmn", "target": null }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" }, { "id": "Backdoor.Win32.Shiz.ivr", "display_name": "Backdoor.Win32.Shiz.ivr", "target": null }, { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "Win.Trojan.Agent-316117", "display_name": "Win.Trojan.Agent-316117", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "66bf266b6fcd9faea7066e4a", "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1848, "FileHash-MD5": 1826, "FileHash-SHA1": 1296, "domain": 152, "hostname": 265, "URL": 132, "email": 2 }, "indicator_count": 5521, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "625 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66bf266b6fcd9faea7066e4a", "name": "Malwarebytes - Compromised Host | Injector | Simba | System Hijacking", "description": "\"Bundled Files: Malwarebytes.Premium.prem.com:\nMalicious noses sound in Malwarebytes with capabilities to infect entire system, bios (all). Complete CnC. High priority malicious.\nALF:JASYP:PUAWin32/Bibado!atmn\nBackdoor.Win32.Shiz.ivr\nGeneric\nSimda\nVirTool:Win32/Injector.gen!BQ\nWin.Trojan.Agent-316098\nWin.Trojan.Agent-316117", "modified": "2024-09-15T07:02:25.374000", "created": "2024-08-16T10:14:03.907000", "tags": [ "historical ssl", "threat network", "infrastructure", "referrer", "adversaries", "information", "win32diskdrive", "win32processor", "windows", "registry run", "registers", "flow t1574", "dll sideloading", "powershell", "window", "modify registry", "e1203 windows", "catalog tree", "analysis ob0001", "b0001 memory", "b0002 guard", "virtual machine", "detection b0009", "check registry", "check", "cnamazon rsa", "m02 oamazon", "number", "cus subject", "data", "m01 oamazon", "dns resolutions", "ip traffic", "memory pattern", "domains", "hashes", "user", "peexe c", "text c", "menu c", "menuprograms c", "games c", "text", "ttf c", "file system", "defender c", "desktop", "analyzer paste", "iocs", "hostnames", "url https", "samples", "generic malware", "tag count", "tue apr", "analyzer threat", "url summary", "ip summary", "summary", "sample", "first", "generic", "united", "mail spammer", "host", "cins active", "poor reputation", "detection list", "ip address", "blacklist", "malicious host", "team http", "cisco umbrella", "site", "safe site", "alexa top", "million", "fuery", "malware", "presenoker", "team", "riskware", "artemis", "passive dns", "as44273 host", "urls", "scan endpoints", "all scoreblue", "pulse pulses", "files", "domain", "files ip", "unknown", "germany unknown", "bq aug", "virtool", "ipv4", "main", "related pulses", "file samples", "files matching", "show", "search", "date hash", "showing", "next", "win32", "nxdomain", "ip related", "gmt content", "type", "x frame", "sameorigin x", "xss protection", "encrypt", "asnone united", "title error", "pulse submit", "url analysis", "date", "status", "creation date", "name servers", "hostname", "urls http", "msie", "windows nt", "slcc2", "media center", "suspicious", "verisign", "simda", "copy", "possible", "class", "write", "code", "win32 exe", "available from", "services", "registry tech", "server", "registrar abuse", "dnssec", "registrant name", "ninite", "dns replication", "technology", "bq jun", "bq jul", "domain status", "domain name", "contact email", "contact phone", "full name", "algorithm", "v3 serial", "key algorithm", "key identifier", "subject key", "identifier", "x509v3 key", "usage", "info", "avast avg", "entries", "exclusionpath", "created", "shell commands", "processes tree", "silent log", "norestart", "k wersvcgroup", "pss s", "k wsappx", "signals mutexes", "mutexes", "global", "synchronization", "dataset", "system property", "lookups", "select index", "macaddress", "adaptertypeid0", "win32bios", "index0", "where index0", "select uuid", "self-delete", "persistence", "macro-powershell", "long-sleeps", "calls-wmi", "checks-bios", "checks-disk-space", "checks-memory-available", "checks-network-adapters", "checks-usb-bus", "checks-user-input", "crypto", "detect-debug-environment", "dos batch", "file type", "pe resource", "malicious", "socks5systemz", "nushell", "autodiscovery", "cookietheft", "twitter ad", "dos batch file", "t1064 executes", "mitre att", "ta0002 command", "t1059 uses", "dlls privilege", "dlls defense", "evasion ta0005" ], "references": [ "Researched: Malwarebytes.Premium.v5.1.6.RePack.by.xetrin.zip", "MALWARE BANKER TROJAN EVADER Researched: block.malwarebytes.com", "Crowdsourced IDS rules: Matches rule (port_scan) UDP portsweep", "Crowdsourced Sigma: Matches rule Registry Persistence via Service in Safe Mode by frack113", "Crowdsourced Sigma: Matches rule Hiding Files with Attrib.exe by Sami Ruohonen | Matches rule Non Interactive PowerShell Process Spawned by Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements", "Crowdsourced Sigma: Matches rule New Root Certificate Installed Via Certutil.EXE by oscd.community, @redcanary, Zach Stanford @svch0st", "Crowdsourced Sigma: Matches rule Powershell Defender Exclusion by Florian Roth (Nextron Systems)", "Crowdsourced Sigma: Matches rule Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea)", "Crowdsourced Sigma: Matches rule Potential Persistence Via Custom Protocol Handler by Nasreddine Bencherchali (Nextron Systems)", "VirTool:Win32/Injector.gen!BQ - FileHash-SHA256 e3244c33eac9709cac1840b1b131ea25bb7c32652c7badbefe94a06038e2778e", "Antivirus Detections: Win.Trojan.Carberp-6809884-0 , VirTool:Win32/Injector.gen!BQ Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0 Yara Detections generic_shellcode_downloader Alerts injection_inter_process injection_create_remote_thread cape_detected_threat", "IDS Detections: Backdoor.Win32.Shiz.ivr Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz", "IDS Detections: Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0", "Yara Detections: generic_shellcode_downloader", "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat cape_extracted_content", "Silent Uninstalling.cmd | DosS | PUA.HackTool | FileHash-SHA256 26b6f985a431cbb246f62f6058958990bb468a79487c502e5815e78d6e88fe53" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic", "display_name": "Generic", "target": null }, { "id": "Win.Trojan.Agent-316098", "display_name": "Win.Trojan.Agent-316098", "target": null }, { "id": "Win.Trojan.Istbar-231", "display_name": "Win.Trojan.Istbar-231", "target": null }, { "id": "ALF:JASYP:PUAWin32/Bibado!atmn", "display_name": "ALF:JASYP:PUAWin32/Bibado!atmn", "target": null }, { "id": "VirTool:Win32/Injector.gen!BQ", "display_name": "VirTool:Win32/Injector.gen!BQ", "target": "/malware/VirTool:Win32/Injector.gen!BQ" }, { "id": "Backdoor.Win32.Shiz.ivr", "display_name": "Backdoor.Win32.Shiz.ivr", "target": null }, { "id": "Simda", "display_name": "Simda", "target": null }, { "id": "Win.Trojan.Agent-316117", "display_name": "Win.Trojan.Agent-316117", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1120", "name": "Peripheral Device Discovery", "display_name": "T1120 - Peripheral Device Discovery" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1848, "FileHash-MD5": 1826, "FileHash-SHA1": 1296, "domain": 152, "hostname": 265, "URL": 132, "email": 2 }, "indicator_count": 5521, "is_author": false, "is_subscribing": null, "subscriber_count": 232, "modified_text": "625 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "669dc20b2ec2a686e9ed843e", "name": "Windows NT - C:/Program Files (x86)/Windows NT", "description": "Malicious: 7Zip.zip, a free version of the Windows NT operating system, has been detected by a Malware Analysis Service (Sigma) lab in the United States and Canada. (Autopopulated?). Just another weird folder to add to the mix that was not previously accessible. 5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221\nWindows NT[.]zip file", "modified": "2024-08-21T03:00:33.424000", "created": "2024-07-22T02:20:59.937000", "tags": [ "please", "javascript", "pe file", "found", "pe32", "intel", "ms windows", "crlf line", "unicode text", "utf16", "drops pe", "sample", "persistence", "window", "malicious", "next" ], "references": [ "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b", "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b/iocs", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721614596&Signature=WubzxRzhz06z30Pgd8w6R%2BdwGreVCl76oWHIBJW%2FPhuiahy%2BKPBa0Y1cptDoHe%2FSnD5OwFE3uPWg18sU0SXZO7CUEtodS%2FYZlMce7FgIxwCsUqvh7%2BkILBPNPDsGrIfexaXhe641XUTko%2Fo%2Fcars0iVw6CnukWiv0DnK1t1zKGMCls%2FHoGmwpyHek%2FkQ2sca268dQOUMVSVzxE9QbDQ0E%2BNihVlMHPtAEEdg%2BurasEZODt", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721614830&Signature=NTWjzMWu2x%2FkDLDFhG9X9xvH6EZ0IW%2FisoVAx0C3qvHgB4TTNcLON9vnq3O9jZ0bTh%2Fwk5dkL5cDMsNvLvGR1B%2FrpzsoMpuK9Mmg50INMJTbjwZ5Vu2XEWp1V%2FrexsvVs82X6Oa1HcECHD4hXmOLuoSIaacahnbPmR%2BBKib%2B2f1TrM6b0yuDq%2BOHT4zcR6v4bo69uM4AJFjzW%2BNA4dsxYMrU8G0doh%2BEFIK2CyZvmw", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721615193&Signature=PbnANR1kKnesU7akusFUK8oBOXYVc4hPuTdStvFSFM%2BnDu9vfEsXFjD1zEiZCSxoM%2B0A1GMGPJArkT6FN%2By%2F0N%2FbxIAAMzxWRmHRd4YFeONRu9C2vCHf%2F6JD634xZLjfXPCf6nwhhTyAug1taMd8v2JJ33lGG5T3AAlP7Bc3ounfWTA291yHU%2Br59ufC1oQWOiyy3eGpGeDHl1cNiX%2F40yJu0JHNayirdVkD5lwHuYjYPl", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721615218&Signature=YjJ0hU1H00M55fIA41nFsmUizSBNr3FtpSLt0GV61jRcAh5OxSIIYGN3kT%2FWr%2BG%2FKqVVk1grZTqOYJrD3YeacZViaR%2FIVGlXeXI5E3eEeaAUVETcHpkg6Mwc0FfXOjI6P84PAOdrlUO2EmvpdwLw2O24jeenYvzirj1GT0QoWcJ5HVxbf44kkgMmkFnwmVi0PSoEd81v%2FVt5gk3mIvduX4TqxQsFn9DexYVu3DAwat%2BGZG%2BBn8d3rhTb", "https://www.virustotal.com/graph/embed/g55a5bfd817c3452fbde7286cc24f2a257fad6ebbf582418fa2844e88137bed40?theme=dark", "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b/graph", "https://viz.greynoise.io/analysis/2e808001-e8be-4300-9fb5-8304538c9cf6", "https://tria.ge/240722-engzhawdmf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0030", "name": "Defense Evasion", "display_name": "TA0030 - Defense Evasion" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "T1574.002", "name": "DLL Side-Loading", "display_name": "T1574.002 - DLL Side-Loading" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "T1070.006", "name": "Timestomp", "display_name": "T1070.006 - Timestomp" }, { "id": "T1001", "name": "Data Obfuscation", "display_name": "T1001 - Data Obfuscation" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" } ], "industries": [ "Technology", "Education", "Healthcare", "Telecommunications", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 7958, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 280, "FileHash-SHA1": 165, "FileHash-SHA256": 754, "hostname": 195, "URL": 367, "domain": 111 }, "indicator_count": 1872, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "650 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6443fc0a12315ea70966d1fa", "name": "smarthost.maedler.de v2 all", "description": "", "modified": "2023-04-22T15:24:10.853000", "created": "2023-04-22T15:23:54.659000", "tags": [ "memoryfile scan", "runtime data", "ck id", "windir", "mitre att", "ck matrix", "y ansi", "x ansi", "double", "suspicious", "path", "sicil", "format", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/a41ab2eca1f39a88465daddff328b6bb98a3598f8583e673ded8bd2e98a527c1/644051a3b2e8ea46fc08422b" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1074", "name": "Data Staged", "display_name": "T1074 - Data Staged" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1213", "name": "Data from Information Repositories", "display_name": "T1213 - Data from Information Repositories" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 130, "hostname": 64, "domain": 22, "IPv4": 1, "FileHash-SHA256": 3, "FileHash-MD5": 2, "FileHash-SHA1": 2, "email": 1 }, "indicator_count": 225, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://callcontroller.cnea3-02.ic3-calling-callcontroller.chinaeast3-gallatin.cosmic.partner.outlook.cn", "https://source.android.com/security/bulletin/2021", "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c", "https://malbeacon.com/", "http://phoenix.yizimg.com/alabiaga/androidx/commit/d7e342ef6cfe5885f1bb786f1912a039422b9251", "https://www.virustotal.com/graph/embed/g4ba19a7ec3564c599b1b8d19935cc3ccb7b538708e9b4a3b9048ec86e0062e01?theme=dark", "http://www.forensickb.com/2013/03/file-entropy-explained.html", "http://www.scip.ch", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/community", "http://vuldb.com", "Crowdsourced Sigma: Matches rule New Root Certificate Installed Via Certutil.EXE by oscd.community, @redcanary, Zach Stanford @svch0st", "Silent Uninstalling.cmd | DosS | PUA.HackTool | FileHash-SHA256 26b6f985a431cbb246f62f6058958990bb468a79487c502e5815e78d6e88fe53", "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b/graph", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%", "https://tria.ge/240722-engzhawdmf", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "http://callcontroller.cnea3-02.ic3-calling-callcontroller.chinaeast3-gallatin.cosmic.partner.outlook.cn", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721615218&Signature=YjJ0hU1H00M55fIA41nFsmUizSBNr3FtpSLt0GV61jRcAh5OxSIIYGN3kT%2FWr%2BG%2FKqVVk1grZTqOYJrD3YeacZViaR%2FIVGlXeXI5E3eEeaAUVETcHpkg6Mwc0FfXOjI6P84PAOdrlUO2EmvpdwLw2O24jeenYvzirj1GT0QoWcJ5HVxbf44kkgMmkFnwmVi0PSoEd81v%2FVt5gk3mIvduX4TqxQsFn9DexYVu3DAwat%2BGZG%2BBn8d3rhTb", "IDS Detections: Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/iocs", "Antivirus Detections: Win.Trojan.Carberp-6809884-0 , VirTool:Win32/Injector.gen!BQ Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz Unsupported/Fake Internet Explorer Version MSIE 2. Unsupported/Fake Windows NT Version 5.0 Yara Detections generic_shellcode_downloader Alerts injection_inter_process injection_create_remote_thread cape_detected_threat", "Crowdsourced IDS rules: Matches rule (port_scan) UDP portsweep", "TrojanSpy:Win32/Rebhip.F: 5586f9b1a688d58ead675547231f84daf30c0c1c18fc6584fb37cfdaa5125fea", "partnerapi.trafficmanager.cn | 001-ea3.chn.cos.audience.teams.microsoftonline.cn | eventsync.trafficmanager.cn", "001-ea3.chn.cos.audience.teams.microsoftonline.cn | 001-no3.chn.cos.audience.teams.microsoftonline.cn", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "ic3he-ge.teams.trafficmanager.cn | ic3he-ge.teams.trafficmanager.cn | partnerapi.trafficmanager.cn | 001-ea3.chn.cos.audience.teams.microsoftonline.cn | eventsync.trafficmanager.cn", "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.forensickb.com/2013/03/file-entropy-explained.html", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721614830&Signature=NTWjzMWu2x%2FkDLDFhG9X9xvH6EZ0IW%2FisoVAx0C3qvHgB4TTNcLON9vnq3O9jZ0bTh%2Fwk5dkL5cDMsNvLvGR1B%2FrpzsoMpuK9Mmg50INMJTbjwZ5Vu2XEWp1V%2FrexsvVs82X6Oa1HcECHD4hXmOLuoSIaacahnbPmR%2BBKib%2B2f1TrM6b0yuDq%2BOHT4zcR6v4bo69uM4AJFjzW%2BNA4dsxYMrU8G0doh%2BEFIK2CyZvmw", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721614596&Signature=WubzxRzhz06z30Pgd8w6R%2BdwGreVCl76oWHIBJW%2FPhuiahy%2BKPBa0Y1cptDoHe%2FSnD5OwFE3uPWg18sU0SXZO7CUEtodS%2FYZlMce7FgIxwCsUqvh7%2BkILBPNPDsGrIfexaXhe641XUTko%2Fo%2Fcars0iVw6CnukWiv0DnK1t1zKGMCls%2FHoGmwpyHek%2FkQ2sca268dQOUMVSVzxE9QbDQ0E%2BNihVlMHPtAEEdg%2BurasEZODt", "80.125.71.115", "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1", "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b", "http://w.cn4e.com/login/bc.jsp?p=vfqFFKW%2BIGfiCD65IDGjyLxM2SI6T01nMjOHYnstwLOHKIWDgmOKTOF1xSdw9Gcgk3Vsw%2BiMEMZg0exeBk76yA%3D%3D%26njqroJJefuLemxYifUtAyeML%2FLMURbuIPYQZrlWic%2BL8e8HVbJO9uR2YxwgfwZct39x09olEQGUt7c7AUR5VeQ%3D%3D%26KwZ41toCvJmi5lujp8N8y8fB65auqmMzD93Hpf2Y7lSTCl0TqvssvQvyWAsH9sX6ykvG0puC%2FCCRD48L9J5YjQ%3D%3D%26ck6ZnzP%2FWNQV%2BmK5uOzxgB9XdQbUEnnpNXUT0vCUKGpoDcmpZLuzbmyzsZfKKGyzo8r7L0Qwfw2mff0zdyc5BA%3D%3D&d=yongstextile.com", "Crowdsourced Sigma: Matches rule Powershell Defender Exclusion by Florian Roth (Nextron Systems)", "ic3-media-audiencebot.chn-no3-001.ic3-media-audiencebot.chinanorth3-gallatin.cosmic.partner.outlook.cn", "Researched: Malwarebytes.Premium.v5.1.6.RePack.by.xetrin.zip", "Yara Detections: Armadillov171", "Yara Detections ConventionEngine_Keyword_Launch , MS_Visual_Cpp_2003 , Cabinet_Archive , Nullsoft_NSIS", "https://hybrid-analysis.com/sample/a41ab2eca1f39a88465daddff328b6bb98a3598f8583e673ded8bd2e98a527c1/644051a3b2e8ea46fc08422b", "https://www.virustotal.com/gui/collection/a5dc2ae56e9df5e39030274a91a061120d8e57309aed6be14334f7bfd5264726/graph", "bjb.webshell.suite.partner.microsoftonline.cn | Shanghai Blue", "https://vtbehaviour.commondatastorage.googleapis.com/5aa3fc90d8b22602c17059a562f58587f4c25c0bac42b5c2681fb098cac16221_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1721615193&Signature=PbnANR1kKnesU7akusFUK8oBOXYVc4hPuTdStvFSFM%2BnDu9vfEsXFjD1zEiZCSxoM%2B0A1GMGPJArkT6FN%2By%2F0N%2FbxIAAMzxWRmHRd4YFeONRu9C2vCHf%2F6JD634xZLjfXPCf6nwhhTyAug1taMd8v2JJ33lGG5T3AAlP7Bc3ounfWTA291yHU%2Br59ufC1oQWOiyy3eGpGeDHl1cNiX%2F40yJu0JHNayirdVkD5lwHuYjYPl", "https://n0paste.eu/UH6n5pD/", "tokenencryption.mam.manage-ppe.microsoftonline.cn | https://encrypt.enterpriseregistration.partner.microsoftonline.cn", "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "prod-lt-playstoregatewayadapter-pa.googleapis.com \u2022 redirector.gvt1.com \u2022 torexit.net-137.ampr.org", "http://callcontroller.cnno3-02.ic3-calling-callcontroller.chinanorth3-gallatin.cosmic.partner.outlook.cn", "http://virii.es/U/Using Entropy Analysis to Find Encrypted and Packed Malware.pdf", "ic3-media-mpaas-ivr.chn-no3-002.ic3-media-mpaas-ivr.chinanorth3-gallatin.cosmic.partner.outlook.cn", "VirTool:MSIL/CryptInject!: FileHash-SHA256 bbabbbdfbb40016ed75a7ceb3f983c58797577247ffba74a1d0aab46b72b0643", "https://viz.greynoise.io/analysis/2e808001-e8be-4300-9fb5-8304538c9cf6", "Yara Detections: generic_shellcode_downloader", "Crowdsourced Sigma: Matches rule Potential Persistence Via Custom Protocol Handler by Nasreddine Bencherchali (Nextron Systems)", "Alerts: injection_inter_process injection_create_remote_thread cape_detected_threat cape_extracted_content", "https://www.virustotal.com/gui/collection/f5f44695fd1867e0fff2ea76012911e5f5cab334910729fb71a9bc62bd3b918b/iocs", "Crowdsourced Sigma: Matches rule Hiding Files with Attrib.exe by Sami Ruohonen | Matches rule Non Interactive PowerShell Process Spawned by Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements", "TrojanSpy:Win32/Rebhip.F: http://w.cn4e.com/login/bc.jsp?p=ix5KZDRKcnWBJ6ajdBhecP1lMuzLoE1s0C1i9+ksxWcZJK/hYGZdXSDPe3xCp02xzq0EXsDt+GEIykVMplIPKA==&4lC8a2Py9lOxeYnfOWCZPU0VlLoLx7fVrfU2hBe8CgagrYeJS+SoNc3W34M2h/kbKz5RbH+OFy2SfjMAmGu74w==&A9VopQG0dDxhY+Ku/NF1C8FGNvIhy36pnzqkS4GgTjwsbI8ok+B5K8FXJW2kEIlJxYQu19lSwkqKJu+UtcZvfg==&G/9EanSL/XFEPUA7CiWzOg/9sPYcdFKz90x7wGXCESBsMdCvrrldf9ZZrjBpUx8XdG6aK/wR8sqSksJ5wA9Y6Q==&YRQGDPQJkCxAmK4eNjFDC7I0arWP+eE6UIJHCPmv/HXDcxRWPDOXlzXK7uvuVDkjA1llh8gOam+rpWLXZTx+uQ==&d=sicoto", "https://www.virustotal.com/graph/embed/g55a5bfd817c3452fbde7286cc24f2a257fad6ebbf582418fa2844e88137bed40?theme=dark", "MALWARE BANKER TROJAN EVADER Researched: block.malwarebytes.com", "https://www.virustotal.com/graph/embed/gd6bc2ac4a2bd4707b7287f9643acea44af35721b1f3243b385313ddc60862e0a?theme=dark", "https://www.virustotal.com/graph/embed/g421f9bbfc29448f8acd6e6e0eaa616e332de270d8f5c4b34bcfc69f325a7bbc7?theme=dark", "Yara Detections: ProcessInjector_Gen , stack_string , Cabinet_Archive , VM_Unknown , UPX", "VirTool:Win32/Injector.gen!BQ - FileHash-SHA256 e3244c33eac9709cac1840b1b131ea25bb7c32652c7badbefe94a06038e2778e", "Crowdsourced Sigma: Matches rule Registry Persistence via Service in Safe Mode by frack113", "Crowdsourced Sigma: Matches rule Windows Defender Exclusions Added - PowerShell by Tim Rauch, Elastic (idea)", "http://cvedetails.com", "ic3-media-audiencebot.chn-ea3-001.ic3-media-audiencebot.chinaeast3-gallatin.cosmic.partner.outlook.cn", "IDS Detections: Backdoor.Win32.Shiz.ivr Checkin Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Tulach", "Win.malware.lazy", "Win.trojan.agent-316117", "Win.trojan.shodi", "Alf:heraklezeval:trojanspy:win32/rebhip.f", "Alf:jasyp:puawin32/bibado!atmn", "Trojanspy", "Simda", "Autorun", "Meredrop", "Alf:aggr:mytonel_obfuscator", "Win.malware.zusy-9875693-0", "Win.trojan.istbar-231", "Ransom:win32/gojdue", "Alf:heraklezeval:trojandownloader:html/adodb", "Alf:jasyp:virtool:msil/cryptinject!atmn", "Generic", "Hacktool:win64/patcher!msr", "Virtool:win32/injector.gen!bq", "Virtool:msil/cryptinject.ya!mtb", "Win.trojan.agent-316098", "Alf:heraklezeval:trojandownloader:win32/dridex!rfn", "Win.malware.generic-9870238-0", "Backdoor.win32.shiz.ivr" ], "industries": [ "Technology", "Healthcare", "Telecommunications", "Government", "Education" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 17, "pulses": [ { "id": "69eb39604a42b712d8ed5faa", "name": "Why Join The Navy When You Can Be A Pirate?", "description": "[TNT - why join the navy if you can be a pirate - has been described as a \"troll\" by the Royal Navy and its chief of staff, Sir John Chilcot.] This certificate is still validating though untrusted further supportint the broken seal and belasco chain. Rec: 40 cryptographic specialists and 2 weeks. If not that, distrust it, if you can.", "modified": "2026-05-26T00:15:15.088000", "created": "2026-04-24T09:35:28.283000", "tags": [ "issuer tnt", "valid from", "valid", "thumbprint", "serial number" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 15, "hostname": 36, "FilePath": 1, "FileHash-MD5": 12, "FileHash-SHA256": 209, "URL": 122, "domain": 15, "URI": 1, "CVE": 2 }, "indicator_count": 413, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a00eef29b122fc211e1a85c", "name": "Copy of 5[.]1[.]0[.]0 - 05.10.26", "description": "If I didn't know better, I would guess that is AWS, Fastly, Cloudflare botnet activity Targetting Urkraine\n\nOrigin: Edmonton, Alnerta", "modified": "2026-05-10T20:47:46.993000", "created": "2026-05-10T20:47:46.993000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/gd6bc2ac4a2bd4707b7287f9643acea44af35721b1f3243b385313ddc60862e0a?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "Ukraine" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 32, "FileHash-SHA1": 29, "FileHash-SHA256": 370, "IPv4": 572, "IPv6": 1, "URL": 77, "domain": 35, "hostname": 134 }, "indicator_count": 1250, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3843cba399db62eeae702", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:28.397000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 781, "FileHash-SHA1": 509, "FileHash-SHA256": 539, "URL": 387, "hostname": 361, "domain": 100, "CIDR": 1, "email": 1 }, "indicator_count": 2679, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3843b5a1ded80a61cb9fa", "name": "CAPE Sandbox - Stalking", "description": "A full report on the latest Android operating system: PK.3.4.5.1 (c) on 1 January, 2026, to be published by the Google Research Institute (GRI).", "modified": "2026-05-06T10:13:24.260000", "created": "2026-04-06T10:00:27.893000", "tags": [ "renewed", "8gbram", "windows10", "19inlcdmonitor", "desktop pc", "package", "intel core", "hard drive", "dvdrw", "wifi", "title", "blink", "date", "meta", "elite", "body", "https", "mitre attack", "network info", "tls version", "united", "overview", "zenbox android", "verdict", "guest system", "ultimate file", "fraud", "cloud", "next", "program", "processes extra", "overview zenbox", "info file", "file type", "default", "parent pid", "full path", "command line", "registry keys", "commands c", "k dcomlaunch", "files c", "devicecng c", "read registry" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/2533042959ad1fe050d14ab7536126910a2d240992bff397640382472b6a7c69_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469608&Signature=fK1I2%2FxXVm0l3ZiELwtstes8iVN402Ww%2By%2BgvxYOB0LiC2iO3J9cedWJk1hMIr4IfLSGKprfui8vANzR%2BkWfSd594S%2FFe9A59YKyOA2MFmQTBRXVy6O3xF1e1lPETp5Md%2FbGJCOzrZxdHyReyuk7cgdDDBAewptjJhfTYxql7F9X%2FB4qe9BYWPrvned2fFWfU%2F4G%2F4UBqY9Jj%2BG1CTP%2FaGqOdWFs0Q5cPYZ4bytp", "https://vtbehaviour.commondatastorage.googleapis.com/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743_Zenbox%20android.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469752&Signature=Df%2Bamm33qFPdsDg6nWC5FQjse7h4fksSXqONp4nMEItb0gpBwqx66TqcCnFzQplUk6ExMge79qNZR2OElv63sX54D4fSGwI9nvHYhQoiVdZIgf4ct8dIAr%2BYO9jSx0WpPUVFsvf%2FXtXvm6jM5n5v7CGiyFRyAz8PES5g%2FcOlLt%2BDhsc8bhi%2FMU9mAkyyr5nFVPcTmUSHOTNXOeKDUlyRkQE6b9FEbFhUL1h3%2B%2FBVtysh", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469810&Signature=Mj5ODxCW7tD5UNn6P11Ta7F2cmDLSJuEB7JSLFg%2FERfANmnRR5L7XzDwXxI5G48vkQFx0%2FBMtjMLwWHn6ZHKlt13rfzkvoOu5fJ%2Fb5lMJqUp1rSQIG0JLL80QAnXyJf2W8pL7MvK97Tr4jsCIUfd8ezliJtV5SmahV6Q8lYu2KJUnANrHkA10RFrcT4O26Vk7gbDsuC7caDXC6U9KXTTB0cpC77%2FV7w86ftN2JPXx6oEHUvSj02qsvhKwKQvmM", "https://vtbehaviour.commondatastorage.googleapis.com/5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775469831&Signature=ZlRZLvCaJ%2F9niupu9DFCvXvfgFpDEOsK%2FsH46CB2zEVUDjcQRNMDp9XXKKx0dekmHQbhl02yqygHPOA8Wty5duGtK216QCvKNkYpbpdOjN7xgAg3AsldciWbqeJr8N4I%2F1%2FPRSdVfB%2BNGaBJKxZG1RQkX206MSvX%2BeY%2FdeEYpq3NYdrPWlxdV0pa3yaqcMrf2s%2FCFSM%2FdO3xt5PKyXWG%2FDCNM5iiuXh8OT2ckhZhf%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1221", "name": "Template Injection", "display_name": "T1221 - Template Injection" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 252, "FileHash-SHA1": 48, "FileHash-SHA256": 44, "URL": 108, "hostname": 131, "domain": 9 }, "indicator_count": 592, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d379cd3bba574ce989a64b", "name": "VirusTotal report\n for base.apk", "description": "https://www.virustotal.com/gui/file/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743/details", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T09:15:57.936000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 81, "FileHash-MD5": 2, "FileHash-SHA1": 2, "URL": 56, "domain": 6, "hostname": 19 }, "indicator_count": 166, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69d3796fc3fdb987f491d635", "name": "VirusTotal report\n for base.apk", "description": "https://www.virustotal.com/gui/file/6c39ae0368703f254070a0648c0066115140c3e762d9bf5b52833a037a1e3743/details", "modified": "2026-05-06T00:02:38.802000", "created": "2026-04-06T09:14:23.776000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1422", "name": "System Network Configuration Discovery", "display_name": "T1422 - System Network Configuration Discovery" }, { "id": "T1426", "name": "System Information Discovery", "display_name": "T1426 - System Information Discovery" }, { "id": "T1430", "name": "Location Tracking", "display_name": "T1430 - Location Tracking" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 243, "FileHash-MD5": 6, "FileHash-SHA1": 6, "URL": 78, "domain": 10, "hostname": 25 }, "indicator_count": 368, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68e36a79b52e21105f258e6e", "name": "Vasyaperskyi from Russia mrt.exe urls in memory", "description": "VirusTotal Graph (miniuser, 2025)", "modified": "2025-11-05T07:02:18.726000", "created": "2025-10-06T07:06:33.301000", "tags": [ "entity" ], "references": [ "https://www.virustotal.com/graph/embed/g421f9bbfc29448f8acd6e6e0eaa616e332de270d8f5c4b34bcfc69f325a7bbc7?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 86, "FileHash-MD5": 43, "FileHash-SHA1": 43, "FileHash-SHA256": 135, "domain": 6, "hostname": 39 }, "indicator_count": 352, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68be993e9615b0e3e813b707", "name": "MalBeacon - Apple Tor Project | Hostile", "description": "Google.com is the world's largest web server, with an address address of 2.5 million users.. and a domain of 1.6 million servers. \u00c2\u00a31.3bn", "modified": "2025-10-08T08:03:50.685000", "created": "2025-09-08T08:52:14.428000", "tags": [ "present mar", "present aug", "present jun", "france unknown", "present jan", "present dec", "present may", "present apr", "passive dns", "tor exit", "ipv4", "reverse dns", "location france", "france asn", "as15557", "courier", "accept", "genco labs", "comments", "authority", "fileversion", "g2 c", "llc st", "md5 add", "lowfi", "united", "backdoor", "win32", "hacktool", "trojan", "present sep", "aaaa", "moved", "ip address", "apache", "ipv4 add", "america flag", "gaithersburg", "united states", "yara detections", "malware", "port", "destination", "read c", "msie", "windows nt", "wow64", "hostile", "write", "markus", "local", "unknown", "apple", "urls", "domain", "x apple", "unknown aaaa", "hostname add", "files", "files ip", "delete c", "crlf line", "cheat service", "checkin", "high", "total", "delete", "python", "learn", "ck id", "name tactics", "suspicious", "informative", "spawns", "command", "found", "defense evasion", "t1480 execution", "command decode", "et tor", "known tor", "misc attack", "relayrouter", "exit", "node traffic", "general", "path", "click", "strings", "meta", "thus", "contact", "main", "dynamicloader", "medium", "wine emulator", "dynamic", "reads", "patchcache", "pe section", "code overlap", "blackie virus", "intel", "ms windows", "pe32", "regsetvalueexa", "regdword", "pe32 executable", "delphi", "dock", "execution", "explorer", "next", "evasion att", "file defense", "dynamic api", "discovery att", "prefetch8", "prefetch1", "mitre att", "ck matrix", "localappdata", "yara signature", "process", "a domains", "malbeacon", "about contact", "portal open", "menu close", "menu home", "content home", "portal", "beaconing", "internet", "dark", "type indicator", "added active", "related pulses", "url https", "url http", "china unknown", "location china", "china asn", "as174 cogent", "twitter", "virgin islands", "creation date", "germany unknown", "unknown ns", "domain add", "tulach type", "response ip", "address google", "safe browsing", "status", "search", "date", "name servers", "showing", "record value", "error", "code", "content type", "access", "length", "title", "mtb may", "useragent", "next associated", "gmt cache", "sameorigin", "mozilla", "trojandropper", "monitored target", "packed" ], "references": [ "80.125.71.115", "Yara Detections: Armadillov171", "https://malbeacon.com/", "prod-lt-playstoregatewayadapter-pa.googleapis.com \u2022 redirector.gvt1.com \u2022 torexit.net-137.ampr.org" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Trojan.Shodi", "display_name": "Win.Trojan.Shodi", "target": null }, { "id": "HackTool:Win64/Patcher!MSR", "display_name": "HackTool:Win64/Patcher!MSR", "target": "/malware/HackTool:Win64/Patcher!MSR" }, { "id": "Win.Malware.Lazy", "display_name": "Win.Malware.Lazy", "target": null }, { "id": "VirTool:MSIL/CryptInject.YA!MTB", "display_name": "VirTool:MSIL/CryptInject.YA!MTB", "target": "/malware/VirTool:MSIL/CryptInject.YA!MTB" }, { "id": "Ransom:Win32/Gojdue", "display_name": "Ransom:Win32/Gojdue", "target": "/malware/Ransom:Win32/Gojdue" }, { "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb", "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb", "target": null }, { "id": "Meredrop", "display_name": "Meredrop", "target": null }, { "id": "Tulach", "display_name": "Tulach", "target": null }, { "id": "AutoRun", "display_name": "AutoRun", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1067", "name": "Bootkit", "display_name": "T1067 - Bootkit" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 852, "FileHash-MD5": 508, "FileHash-SHA1": 407, "FileHash-SHA256": 4566, "URL": 3778, "domain": 789, "email": 8, "SSLCertFingerprint": 2 }, "indicator_count": 10910, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "237 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682c13f55aa5148885011347", "name": "STEALER remotely attacks US iOS devices", "description": "(trojan.convagent/nekark)\nCrowdsourced Sigma Rules || System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali\n| Regsvr32 DLL Execution With Uncommon Extension by Florian Roth (Nextron Systems\nBehavior Tags #calls-wmi #checks-network-adapters %checks-user-input #detect-debug-environment || Datasetactions| System Property Lookups > WbemServices::Connect\nIWbemServices::ExecQuery - root\\CIMV2 : SELECT SerialNumber FROM Win32_PhysicalMedia", "modified": "2025-06-19T04:00:22.753000", "created": "2025-05-20T05:32:36.181000", "tags": [ "vmware http", "vmware", "windows nt", "win64", "khtml", "gecko", "post http", "request", "host", "contentlength", "accept texthtml", "connection", "md5 code", "win32 exe", "pe32", "intel", "ms windows", "generic windos", "executable", "dos executable", "generic", "pe32 installer", "inno setup", "delphi", "udp a83f8110" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 257, "URL": 134, "domain": 75, "hostname": 49, "FileHash-MD5": 27, "FileHash-SHA1": 12 }, "indicator_count": 554, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67980c317b7bb954fd0cc8ab", "name": "https://vuldb.com/ http://www.scip.ch http://cvedetails.com", "description": "", "modified": "2025-05-14T20:42:29.121000", "created": "2025-01-27T22:44:01.462000", "tags": [ "sha256", "imphasz", "pejzasz", "wirustotal", "wysoki", "baseseverity", "google android", "tempseverity", "redni", "limit", "znaleziono luk", "zostaa", "cwe787", "vuldb", "impact", "android", "scip", "scip ag", "zurich", "switzerland", "swiss", "security", "contact", "vulnerability", "news", "us news", "history data", "privacy notice", "offense defense", "locations blog", "defense", "alexa", "google play", "cve pliki", "krytyczny", "androidem", "aosp", "imagination", "zabezpiecze z", "problemy", "typ poziom", "protect", "mainline", "pixel", "ssdeep", "z\u00fcrich", "schweiz", "magazin bcher", "business firma", "news vortrge", "aktuell archiv", "anfahrt blog", "blog aktuell", "archiv", "vulnerability database", "vulnerability data feed", "vdb", "vulndb", "cve", "nvd", "cyber threat intelligence", "hack", "hacking", "it-security", "information security", "infosec", "cybersecurity", "exploit", "exploiting", "open-source", "team", "tenda cp3", "vuldb mod", "cti team", "intelligence", "please", "abb flxeon", "latest", "exploits", "sliver", "download", "sha1" ], "references": [ "https://source.android.com/security/bulletin/2021", "http://www.scip.ch", "http://vuldb.com", "http://cvedetails.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 140, "URL": 605, "CVE": 37, "domain": 68, "FileHash-SHA256": 653, "FileHash-MD5": 52, "FileHash-SHA1": 82, "IPv4": 6, "email": 1 }, "indicator_count": 1644, "is_author": false, "is_subscribing": null, "subscriber_count": 125, "modified_text": "384 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "xml.org", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "xml.org", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780436578.5353746 }