SHA256HighVerifiedSignal 85/100

`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8`

Location

Poland

First Seen

Dec 16, 2024

Last Seen

Apr 6, 2026

Dec 16

First Seen

562d ago

Apr 6

Last Seen

85d ago

Reports

source reports

85%

Confidence

high

0/75

VirusTotal

detections

Found in 6 reports. Confidence: high. · Confidence scores are heuristic. Verify before acting on results.

SHA-256 Hash

SHA-256 file hash — primary identifier for malware samples.

MISP Category

Artifacts Dropped

Hash Algorithm

SHA256

Confidence

85%

Signal Score

85 / 100

IDS Rule

Threat Context

MITRE ATT&CK TTPs

110 techniques

Feed Intelligence Summary

6 reports85% confidence

Source reports

85%

Confidence score

Category tags

.plaaaaaaaa fd00aaaa nxdomainabuseabuseipdbacademic institutionsacceptaccessaccess attaccess controlaccess ta0006access typeaccount securityactiveactive createdactive relatedactive scanactive scanningactivity beaconadded activeaddressaddress domainadobe productadobe systemsadsads infoaerospace & defenseagricultural supply chainagricultural technologyagriculture, forestry, fishing and huntingakamaiakamai rankalberta health servicesalertsalexaalexa topalf featuresalfperall scoreblueall searchall veteransallakoreamerica asnamerica cityamerica flaganalysis dateanalysis ob0002analyzer pasteanalyzer threatandarielandariel groupandroid attackandroid deviceanomalyantianti-vmantiemantiguaantisbapacheapisappdataappleapple iosapple userapple webkitapplication developmentapt10artemisasciiascii textasiaasnoneasnone germanyasnone unitedaspackattackattribaustinaustraliaautoitautomotive manufacturingautorunav detectionsav evasionavaddonavast avgavg clamavb0n timestampbabybackdoorbackendbad loginbad reputationbad trafficbankerbankingbarbuda unknownbecbeds protectorberrbillbindbittorrent dhtblockerbmp processboardbodybody doctypebody headboostbotnetbotnet activitybrandbreaking newsbrute forcebrute force attackbsjbbuilderbundledbundlerc2c2 communicationca fileca validcache entrycage01195 deccallcanada asncanada unknowncanadian universitiescapacapecapturecapture origincatalog treecdecl solcellcocentos webcertificate sniffingcertificate spoofingcertum codech uacheckcheckinchi2chromecirclecisco umbrellacivil servicescivilian societyck idck matrixck techniquesclamclamavclamav malwareclasscleantalk ipclick-based attackclosecloud infrastructurecmscn extractioncnamazon rsacnamecnccnc beaconcobalt strikecode executioncode injectioncombocommandcommand & controlcommand and controlcommand decodecommand executioncommunication protocolcommunication technologiescompromised routercomspecconfuserex modconnectwise exploitation attemptsconnectwise vulnerabilitycontacted hostscontent lengthcontent typecontrolcontrol ob0004control ta0011converter pdfcookiecopy imphashcopy md5copy sha1copy sha256copy ssdeepcorecorporate lawcountrycountry namecountry unitedcountry unknowncovenant health albertacrashcreation datecreatortoolcredential accesscredential harvestingcredential stuffingcredential theftcredit card servicescrlf linecrop productioncrowdstrikecsc corporatecurlcus cndigicertcus cngtscus oamazoncus oletcus ouservercves allcyaxpngcyber threatscyberfolkscycbotczechia unknownd4 portabledaamdatadata accessdata copyingdata encryptiondata exfiltrationdata harvestingdata oc0004data rtcursordata store exposuredata transferdata uploaddaxindbatloaderddosddos attacksdefault browserdefensedefense contractingdefense evasiondefense logisticsdefense systemsdefense technologydeletedelete cdelete filedeltadenverdenver codenver startdescription svgdetaildetection listdetectsdev0537development attdevelopment methodologiesdevopsdgadigital mediadigital signaturediscovery t1082displaynamedistributed attacksdll readdnguarddnsdns attackdnssecdockdod networkdom getdos borlanddoscom cdoscom processdotted quaddownloaderdr citydropperdrwebdvrdnsdynadot incdynamicdynamic dnsdynamicloaderdyndns domainecaccechobotedgeeducationeducational resourceseducational serviceseducational technologyelectronic health recordselectronics manufacturingemailsemails infoemotionencryptencrypt cne6encryptionenglishenigmaenomenterprise securityentertainment technologyentriesentries httpentropyenumerateeoaeeepsilon stealereraseerroret huntinget infoet intelligenceet p2pet toret trojanethiopiaetproetpro trojaneuropeeurope/asiaeva120evasion attevasion ta0005example domainexclude suggesexe uploadexecutable fileexecutable payloadexif dataexif standardexitexpirationexpiration dateexploitexploit kitexploit sourceexploitation activityexport viewexpressextortionfailedfailurefakedout threatfalsefancy bearfarahvpn vlessfarmingfastlyfastly errorfffffffilefile-hashfilerepmalwarefilesfiles cfiles domainfiles ipfiles locationfiles matchingfiles relatedfilesadobe cfinancefinance and insurancefinancial servicesfinancial technologyfindfind encryptedfinding notesfirst seenfixed lineflagflag unitedflashflooderflorence cofonofood productionfor privacyford mustangformformatformbook cncfoundframe srcfrancefromfrom sqlserverftpftp brute forcefunction readg2 issuerg2 nameg2 validg4 issuerg4 rsa4096gamesgandi sasgeckogecko httpgenaco xgeneral fullgeneric httpgeneric malwaregermanygermany asnget e simget esimget httpget httpsgif graphicsgithubglobal outageglobalsign rootgmtngna7hdugolfinggooglegoogle taggovernment impersonationgovernment of albertagovernment technologygraph summarygraphics imagegreengt convertibleguardguest systemgzip processh1 centerhackershandlehashhasheshashes fileshashes md5hat serverhcahca healthhealth care and social assistancehealth information technologyhealthcare information systemshealthy checkheighthelixhelphelp centerheurhide sampleshighhigher educationhistorical otxhistorical sslhoaxhomehomenethong konghospital managementhosthostinghostname addhostname enumerationhostname queryhours agohrefhstrhtml publichttp attackhttp brute forcehttp scannerhttponly pathhttps domainhuawei remotehumanhunkhuntinghx88x89hybridhypervi64diana registrariceraticmp trafficidentity & access exploitationidsids detecids detectionsids terseieedge chrome1ietfdtd htmliframeimage exploitimpashimphashinboundinc orgidinc usageinclude datainclude reviewindicatorindustrial automationindustrial iotindustrial productioninformation gatheringinformation ispinformation technologyinfostealerinfrastructure acquisitionreconnaissanceingress tool transferinitial accessinjection activityinjection inter processinputinput fileinput validation bypassintelintellectual property lawinter processinternet of thingsinvalid pointerinvalid urlinvolved directiocsioctypeiosiot botnetiot securityiot/ics attackiowaips initialipv4ipv4 addipv4 addressiratairfan skiljanirsirs createdisns functionisp charterisp hostnameissuer certumit infrastructurejapan unknownjavascript cjkvpnjody alaskajody huffinesjosejosephjpeg imagejujuboxk-12 educationkeeperkelihoskey algorithmkey identifierkey infokhtmlknown malicious ipknown threatknown torknown-distributorkoivmkong flagkoreanlapsuslaw practiceldaplearnlegallegal consultinglegal researchlegal serviceslegal technologyless seelevel 3light darklineline isplinkslinux mirailivestock managementloaderlocallog idlog4shelllogin attemptlooklorinlotusloudoun countylowfiluca stealerlumenm02 validitymacbook promagicmagic pe32mainmaldocmalicious activitymalicious attachmentmalicious certificatesmalicious downloadmalicious linksmalicious powershell activitymalicious sitemalicious softwaremalwaremalware attacksmalware beaconmalware distributionmalware signingmalware sitemanufacturing technologymarkmonitormarkusmaware samoemcafeemcicsmcics addressmedia & entertainmentmedia centermedia distributionmedia typemedical servicesmediummedium riskmemory oc0002meritmeta entropymeta namemetadata analysismetastealermexico unknownmfc mfcmicrosoft edgemikemilitary operationsminerminiuser avatarmirai botnetmisc attackmissionmitre attmivastmobilemobile carriersmobile networksmobile securitymobile threatmodelmodels fordmodify systemmodule loadmodules t1129moldova relatedmoldova unknownmonitoringmountain humanmovedmozillams defenderms visualmsdefender febmsdefender janmsiemsilmtb malwaremultimedia productionmusicmustang coupemutexmutexesmxndff booleannamename responsename servername serversname sha256name tacticsname valuenation-state activitynational securitynetherlandsnetherlands asnnetworknetwork bindnetwork communicationnetwork intrusionnetwork probenetwork probingnetwork scannetwork scanningnetwork securitynetwork service scanningnetwork trafficnextnext associatednext httpnext yaranidsninano datano expirationnode trafficnorth americanotes clamavnsonso groupnumberob0007 impactob0012 fileobfuscatorobjectobject movedobserved dnsoceaniaogoogle trustongoingopenopen sourceopen threatopenurl copera uaoperating systemoperating system securityorg domainsorg verizonorgidoriginos versionouserver caoutbound trafficoverlayoverview domainoverview ipovhfroxfordpandapanda bankerpanel forumpanel itempasspassive dnspassword attackspatch managementpath expiresthupath traversalpatient carepatternpattern matchpayment processingpcappdb pathpdf exploitpdf exploitationpdf processpdf reportpe32 executablepeexe processpegasuspegasus spywarephishingphishing attackphishing bankphishing emailphone clonepleaseplesk forumpolandpolicypolicy cookiepolicy imprintporkbun llcportpossible zeuspostpost httppost napost utcorepragmaprecision agriculturepresent decpresent febpresent janpresent marpresent novpresent octpresent seppriorprivacy badgerproblemprocessprocess detailsprocess hollowingprocess injectionprocess manufacturingprocess t1543process32nextwprocinproducer pdftkproducer solidproduct developmentprotocol exploitationproxyptls6public administrationpublic infrastructurepublic policypulse httppulse pulsespulse showpulse submitpulsespulses nonepulses otxpushpushdoquality assurancequality controlqueryraasransomransomwareransomware distributionratrdaprdap databasereactorreadread creadsreads softwarereconnaissancerecord typerecord valueredacted adminredacted forredacted techrefreshrefundsregszregulatory agenciesregulatory compliancerelated nidsrelated pulsesrelated tagsrelevance homeremote accessremote commandremote jobremote service exploitationremote servicesreport idreport spamreportsrequestresearchedresolved ipsrestrestartreverse dnsrgbarich perlpackrmhsrmhs articlermhs mainrmhs metarmhs ogrms modulerobots contentrockrocky mountainrole titlerolesrootkitrouterrsarsih objectrsiw numberrticon koreanrunperussiasafe sitesakulasakula ratsalitysample analysissamplessamples showsamuelsamuel tulachsan franciscosan rafaelsc onlogonscalable vectorscams & fraudscan endpointsscans showschoolscreen capturescreenshots noscribdscript domainsscript processscript scriptscript urlsscripting attackssea psearchsearch startsecure serversecurity policysecurity tlsseen asnsegoe uiselect xmrigselfsend feedbackserver headerserversserviceservice privacyservice scanset cookiesetupnsshowshow lessshow processshow techniqueshowingsignals mutexessignersigning casinkhole cookiesitesizeslcc2slf featuresslider pluginslugsmtpsmtp brute forcesnatchsoa nxdomainsocial engineeringsocial media securitysocks5 connectsoftware architecturesoftware developmentsoftware engineeringsoftware exploitationsoftware integritysoftware testingsoftware vulnerabilitiessoldiersorry somethingsouth koreaspamspam statsspanspawnsspoofsportsssdeepssh attackssl bypassssl certificatestatusstephen r 'middleton'stixstopstoragestreamstreaming servicesstringsstudiosubjectsubject publicsubmission idsubmission infosummarysupply chain attacksupply chain managementsuricata httpsuricata streamsuspsustainable agricultureswippswipp9-arinswippersymantec timesystem disruptionsystem oc0001t1003t1005t1012t1016t1018t1021t1021.001t1021.002t1021.003t1021.006t1027t1027.003t1030t1040t1041t1045t1047t1053t1055t1056t1057t1059t1059 veryt1059.001t1059.003t1059.004t1059.007t1060t1063t1064t1068t1069t1069.001t1071t1071.001t1076t1078t1078.001t1081t1082t1083 readst1086t1102t1105t1106t1110t1110.001t1110.002t1110.003t1110.004t1112t1113t1119t1129t1132t1133t1140t1143t1158t1189t1190t1192t1195t1199t1203t1204t1204.001t1204.002t1210t1480t1486t1490t1496t1498t1499.001t1499.002t1499.003t1518t1543t1547t1553t1554.001t1554.003t1555t1556t1560t1563t1565t1566t1566 phishingt1566.001t1566.002t1566.003t1566.004t1568t1569.002t1571t1573t1574.006t1583t1583.001t1587.001t1589t1589.001t1589.002t1590t1590 gathert1590.001t1595t1595.001t1595.002t1595.003t1598t1598.003ta0002 commandta0003 createtag counttag managertagstags viewporttaiwan as3462tcp connectionstelecom servicestelecommunicationstelnet logintelnet roottelnet threattelus communicationstemptext ctext processtgi huntthemidathird-party software compromisethreat actorthreat preventionthreat scoretiff imagetimetime stampingtitantitletitle addedtitle datatitle metatls handshaketls rsatls snitls webtlsv1tnull filetofseetoolstop destinationtop sourcetor analysistor nodetotaltraces aidedtraffic redirectiontrending videostrid win32trimtrojan featurestrojan malwaretrojan.morstartrojanclickertrojandroppertrojanproxytrojanspytrojanxtrustedtrusted networktsa bttl valuetulachtwittertypetype addresstype fixedtype indicatodtype indicatortypewsua platformunauthorized access attemptsunicodeunitedunited kingdomunited statesuniversity of albertaunknown nsunsafeupdaterurlsurls httpurls httpsursnifusage ffusage typeuseruser executionusersutc googlev3 serialvaluevariant cncvendor findingverifyverizonvhashvicevideosviprevirgin islandsvirtoolvitrovoidvpnvt graphvt itemvulnerabilityvulnerability scanw5k0fa2warriorwealth managementweatherweb applicationweb application attackweb application exploitationweb attackweb exploitationweb securityweb trafficwewattawhaszwhitewhoiswhois lookupwhois recordwidthwifi attackwin3 datawin32 exewin32 malwarewindirwindowwindows checkwindows controlwindows createwindows malwarewindows ntwindows servicewine emulatorwirelessdatanetworkwjdd objectwoff processworldwormwpbakery pagewpis1.jpgwritewrite cwrite filewriting guiwscriptshellx framex msedgex509 certificatex509v3 subjectx92xacxmlxportyarayara detyara detectionsyara ruleyouthyoutubez67uw7s4l7 tlshzbotzenboxzipcodezune

Activity Timeline

1 total obs

Apr 6Apr 6

Threat Activity Heatmap

· Peak: 2026-04-06

Less

Mon

Wed

Fri

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Jan

Feb

Mar

Apr

May

Jun

24h

Dormant

30d

Dormant

3mo

Minimal

Threat ScoreHigh Risk

SIGNAL

Signal Score

85%

Confidence

Reports

First seenDec 16, 2024

Last seenApr 6, 2026

Verified IOC

VirusTotal

0/ 75vendors flagged

0% detection rateJun 11, 2026

WHOIS

description: XML 1.0 document, ASCII text, with CRLF line terminators
references: https://labs.sentinelone.com/avaddon-raas-breaks-public-decryptor-continues-on-rampage/, rmhumanservices.org, http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt, ntp17.dn.n-helix.com • ntp6.n-helix.com • n-helix.com, https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian, http://www.dvrdns.net/BlackBox/google/googleMapKey.txt, http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe, http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player, http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt, http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe, http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/, https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound, https://www.mlkfoundation.net/ (Foundry DGA), remotewd.com x 34 devices, South Africa based: remote.advisoroffice.com, acc.lehigtapp.com - malware, http://watchhers.net/index.php (espionage entity /palantir relationship - seen before with palantir and Pegasus sometimes simultaneously ), Active - apple-dns.net • nr-data.net • tunes.apple.com • emails.redvue.com •, Active - pointing: https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635, http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar, http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar, Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/, https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting, YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE, acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE, http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt • www.dvrdns.net, IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2, IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P), IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname, 1.organization.api.powerplatform.partner.microsoftonline.cn, chinaeast2.admin.api.powerautomate.cn, https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/, https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A, ssa-gov.authorizeddns, hmmm…http://palander.stjernstrom.se/, https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU, autodesk.com [ Everything below was found in Autodesk [including crowdstrike & any.desk] Found in in Crowdsrike if labeled., 66.254.114.234 | reflectededge.reflected.net | reflected.net | 192.0.2.0 | https://www.brazzers.com/ | brazzers.com | brazzersnetwork.com, keezmovies.com | redtube.com | tube8.com | tube8.com | youporn.com| 0.brazzers.com | www.g-tunnel.comwww.brazzers.com |, Win32:Mystic , Win.Trojan.Xblocker-236 »FileHash-SHA256 8c59adbccc1987d13fec983f1e2be046611511b65479d1719bda77c5c90bbe21, IDS Detections: TLS Handshake Failure | Alerts: network_icmp , injection, Win32:BankerX-gen\ [Trj] » FileHash-SHA256 2e5118d15a18ae852bf94d91707ff634d9d8354fef492f5c4e1c46b9cf96184c, IDS Detections: Zeus Panda Banker / Ursnif Malicious SSL Certificate Detected TLS Handshake Failure, Alerts: network_icmp antisandbox_idletime modifies_certificates modifies_proxy_wpad disables_proxy, RedTube.com Detections: ALF:AGGR:OpcCl:95!ml , ALF:JASYP:Backdoor:Win32/Cycbot!atmn , Win.Downloader.117423-1 ,, RedTube.com Detections: Win.Trojan.Crypt-321 , Win.Trojan.FakeAV-4166 , Win.Trojan.Fakeav-10977 , Win.Trojan.Fakeav-3386, Crowdstrike: wildcard.352-445-1166.device.sim.to.img.sedoparking.com, Crowdstrike: maxfehlinger.de http://auth.cranberry.testing.maxfehlinger.de | http://latex.cranberry.testing.maxfehlinger.de |, Crowdstrike: https://traefik.cranberry.testing.maxfehlinger.de | http://traefik.cranberry.testing.maxfehlinger.de |, Crowdstrike: http://watchtower.cranberry.testing.maxfehlinger.de| https://auth.cranberry.testing.maxfehlinger.de |, Crowdstrike: auth.cranberry.testing.maxfehlinger.de | latex.cranberry.testing.maxfehlinger.de | traefik.cranberry.testing.maxfehlinger.de |, Crowdstrike: watchtower.cranberry.testing.maxfehlinger.de | https://latex.cranberry.testing.maxfehlinger.de |, Crowdstrike: https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing | https://www.anyxxxtube.net/sitemap.xml, Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brash |, Crowdstrike: autodesk.com | 0ds.autodesk.com | aknanalytics.autodesk.com | anubis.autodesk.com | autobetaint.autodesk.com, Crowdstrike: autodeskarchitecture.autodesk.com | beacon-dev3.autodesk.com | boxtooffice365.autodesk.com | brahma-studio.autodesk.com, Crowdstrike: cdc-stg-emea.autodesk.com | cloudcost.autodesk.com | cloudpc-stg.autodesk.com | d-s.autodesk.com |, Crowdstrike: daiwahouse-learning.autodesk.com| datagovernance-dev.autodesk.com | enterprise-api-np.autodesk.com, Crowdstrike: symcd.com [Certificate Subjectaltname »» anydesk.com »» http://gn.symcb.com/gn.crt Ocsp http://gn.symcd.com] ANYDESK.COM-unsigned, Crowdstrike: https://bat.bing.com/action/0?ti=12001672&tm=al001&Ver=2&mid=12436868-a484-4998-931c-980262982f67&sid=b92cd8f0483e11efa3c96fe28be413cb&vid=b92cdd10483e11efb1024309353d849f&vids=1&msclkid=N&pi=-740138922&lg=en-US&sw=800&sh=600&sc=24&tl=CrowdStrike%3A%20Stop%20breaches.%20Drive%20business.&p=https%3A%2F%2Fwww.crowdstrike.com%2Fen-us%2F&r=<=1022&pt=1721661968606, Crowdstrike: bat.bing.com, https://tulach.cc, https://otx.alienvault.com/indicator/url/http://www.hallrender.com/attorney/brian-sabey, Crowdstrike: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | https://www.pornhub.com/video/search?search=tsara+brashears | www.youtube.com/watch?v=GyuMozsVyYs | www.pornhub.com | www.youtube.com, Crowdstrike: https://hr.employmenthero.com/rs/387-SZZ-170/images/youtube-icon-emp-hero-violet.png, Crowdstrike + Autodesk.com: hallrender.com/attorney/brian-sabey www.hallrender.com/attorney/brian-sabey hallrender.com www.hallrender.com https://hallrender.com milehighmedia.com https://www.milehighmedia.com/ https://www.milehighmedia.com/legal/2257, Crowdstrike + Autodesk.com: brassiere.world mail.brassiere.world webdisk.brassiere.world webmail.brassiere.world, Crowdstrike + Autodesk.com: 128 + symcd.com some w/issues | 658 autodesk.com pulse some w/issues | removed any.desk & boot, The more I say...Any.Desk + boot.net.anydesk.com was in OG Private CrowdsStrike pulse, Above links in search results direct out with and arrow pointing out., https://otx.alienvault.com/browse/global/pulses?q=tag:%22esta%20caliente%22&include_inactive=0&sort=-modified&page=1&limit=10&indicatorsSearch=esta%20caliente, Above link opened 'esta caliente'= 'it's hot'| I did NOT do that | All connected links gone. This has become common., I didn't add pertinent findings back to Pulse. Pulse comp,eyes says ago . Couldn't submit. It's was actually a tiny pulse of autodesk.com with crowdstrike relationship references,, boot.net.anydesk.com removed from my Pulse below, https://otx.alienvault.com/pulse/66d4c125ad61ee5577639a2d, http://[email protected]/, 91.229.22.126, https://kgp.poczta.policja.gov.pl/mail/848189N.nsf/0/undefined/$File/Wpis1.jpg?OpenElement&FileName=Wpis1.jpg&cdafn, podszywanie sie i przywlaszczenie tozsamosci.pdf, https://www.virustotal.com/graph/gf34facc3e02443c08083040f0af890b75ee78d3e132c4fd69d0c3eddf9db51ac, https://www.virustotal.com/graph/g808ee4b1b8454204b3663e11889c74e7054dda38b3ba4e44893825a74410df38, https://github.com/MSUDenverSystemsEngineering/Salt-Instructional-18/tree/master/AppDeployToolkit, Andariel group » State-sponsored threat actor & Defense media, IDS Detections: Possible Zbot Activity Common Download Struct Zbot Generic URI/Header Struct .bin, Alerts: nids_malware_alert network_icmp dumped_buffer2 allocates_execute_remote_process, Alerts: persistence_autorun creates_user_folder_exe injection_createremotethread, Alerts: injection_modifies_memory injection_write_memory modifies_proxy_wpad packer_polymorphic self_delete_bat banker_zeus_p2p, PWS:Win32/Zbot!CI: FileHash-SHA256 edfec48c5b9a18add8442f19cf8ecd8457af25a7251cb34fe2d20616dcf315ef, Domains Contacted: crl.microsoft.com blackmarket.ogspy.net, FileHash-SHA256 e5c584fdb2a3684a52edb41836436bb3d88221ffd3eb252516e1ca6dc879f8f9, TrojanDownloader:Win32/Cutwail: IDS Detections: W32/Zbot.InfoStealer WindowsUpdate Connectivity Check With Opera UA Possible Zeus GameOver Connectivity Check 2, NSO Group auto populated/relevant to research results. For several year we've seen evidence of Pegasus attacks on Americans., Apple:appleremotesupport.com | appleid.cdn-appme.com | appleid.cdn-aqple.com | www.ns1.bdn-apple.com, Used as Apple IP's : 160.153.62.66 | 162.255.119.21 | 192.64.119.254, Apple: ns2.usm87.siteground.biz | ns2.usm87.siteground.biz | Hostnme www.appleremotesupport.com, ISP: Charter Communications Inc Usage Type Fixed Line ISP, dnvrco-pub-iedge-vip.email.rr.com spectrum.com Denver, Colorado USA, dnscache2b.cdptpa dnvrco-oms2ims-mta-svip-01.email dnvrco-queue04-ac.email dnvrco-ring-a62.email dnvrco-smss-f01-ac.email dnvrco-west-dhcpw-02., Reverse DNS dnvrco-pub-iedge-vip.email.rr.com, Crypt3.COYL FileHash - SHA256 cb536e2e5eb3b23a74702f80832ab964e7dfe07763300437b5ba581f464a108e, IDS Detections: Suspicious double Server Header Possible Kelihos, IDS Detections: Possible Kelihos Infection Executable Download With Malformed Header, telemetry-incoming.r53-2.services.mozilla.com, https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel, http://www.door.net/ARISBE/arisbe.htm, talk.plesk.com | 4evermusic.pl | nist.gov | alaska.gov.inbound10.mxlogic.net | publicfiles.fcc.gov, https://cdns.directv.com/resources/js/dtv/framework/plugins/jquery.placeholder.min.js | peri.com.pl, Researched: 174.192.0.0 AS 6167 (CELLCO-PART) US | Swipper | Loudon County, Va | Ongoing attacks 174.215.26.0, uat.drw.hcahealthcare.cloud US Admin Email: [email protected] Admin Organization: HCA - Information Technology & Services, Inc., OrgTechEmail: [email protected] [email protected] [email protected] [email protected], [email protected] [email protected] CIDR 174.192.0.0/10, Antivirus Detections: Win.Malware.Vtflooder-9783271-0 , Trojan:Win32/Vflooder.B, IDS Detections: Win32/Vflooder.B Checkin Generic HTTP EXE Upload Inbound Generic HTTP EXE Upload Outbound, Yara Detections: SUSP_Imphash_Mar23_2, Alerts: cape_detected_threat, http://www.govexec.com/dailyfed/0906/091806ol.htm, Researched: trueupdater.exe - FileHash-SHA256 000381f55a6406f9448533be6c87481da162f0efe7da60d6f3d8a5401ef6f66b, *https://identity.cnw.hcahealthcare.cloud/Account/ForgotPassword * identity.cnw.hcahealthcare.cloud *uat.drw.hcahealthcare.cloud, "NetRange: 174.192.0.0 - 174.255.255.255 CIDR: 174.192.0.0/10 NetName: WIRELESSDATANETWORK, *NetHandle: NET-174-192-0-0-1 Parent: NET174 (NET-174-0-0-0-0) NetType: Direct Allocation Organization: Verizon Business (MCICS), *RegDate: 2008-12-16 Updated: 2022-05-31 Ref: https://rdap.arin.net/registry/ip/174.192.0.0 OrgName: Verizon Business, *OrgId: MCICS Address: 22001 Loudoun County Pkwy City: Ashburn StateProv: VA PostalCode: 20147 Country:, *US RegDate: 2006-05-30 Updated: 2024-02-12 Ref: https://rdap.arin.net/registry/entity/MCICS, *OrgAbuseHandle: ABUSE3-ARIN OrgAbuseName: abuse OrgAbusePhone: +1-800-900-0241 OrgAbuseEmail: [email protected], *OrgAbuseRef: https://rdap.arin.net/registry/entity/ABUSE3-ARIN OrgDNSHandle: VZDNS1-ARIN OrgDNSName: VZ-DNSADMIN, *OrgDNSPhone: +1-800-900-0241 OrgDNSEmail: [email protected], *OrgTechEmail: [email protected] OrgTechRef: https://rdap.arin.net/registry/entity/SWIPP9-ARIN, *OrgDNSRef: https://rdap.arin.net/registry/entity/VZDNS1-ARIN OrgAbuseHandle: ABUSE5603-ARIN OrgAbuseName, https://www.virustotal.com/gui/collection/27233a89c864ba0e77e672a8909fd63b4a8b6d457c9e4ff219f2a3e47db13376, https://www.virustotal.com/gui/collection/50919d9e9d6d71522b641a3907ed32093293c400a2ae4faaab142f175c48de4b, https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb, https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783, https://www.virustotal.com/gui/collection/bd65940df2423788fcc8623495dfdafdfd4236d93533db0256db5ff4347b65f9, https://www.virustotal.com/gui/collection/2c8e8189f77f80c97f4192dff56750f9603651db2cc6cca045f53e274f4b090e, https://www.virustotal.com/gui/collection/be10f2ed2776b9b4028ac868814ab14bdd576ca5e5bce877ac2954389ba9d328, https://www.virustotal.com/gui/collection/33a61b144ffdece76551464e76866ab59346f0fa3f1f97380b401c1ac3f0d305, https://www.virustotal.com/gui/collection/d142f78015e1c929cedae31dba7e5b735b6dedfc31e4759d8ec5f02c16328b98, https://www.virustotal.com/gui/collection/02bef6a3cf1a035ad5bfb238cac2e913f4ed9425847d7cec5e7dc4097aa3c352, https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327/summary, https://www.virustotal.com/gui/collection/3bf1c0922ee6f4d041effbf9f72a21a1e9f4b38d0593cfbeaca24851cf712eac, https://www.virustotal.com/gui/collection/2cdadbf6aa2ec4f9815c038b0e9375b1475ac7e049fd123861d6e925e7802c6a, https://www.virustotal.com/gui/collection/ba238f4d585b87abb85c126f927090cb866facfa9e4e2e0db8e307aff553397d, https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5/summary, https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2, https://www.virustotal.com/gui/collection/343b947063e58a53ca281f5ad54a72a7fa1b9b6e4c1ca84de6202b99e3126327, https://www.virustotal.com/gui/collection/fd8ebe64d72b2ad9e90773791522c3ec5863868dc3b9c58a929c6b4e01bb3042, https://www.virustotal.com/gui/collection/8d65d93130b4775903adbffbb53820d40bb9425dcf1848b806ffee65ee883984, https://www.virustotal.com/gui/collection/385f419c1c3733dd9dd151d4403bdb38cb24d12c21f18ce8f4f41d818d7a12a5, https://www.virustotal.com/gui/collection/6434f0cf09638991baf3be289834696b46e11c4c6cbe1e7b9548f9ac27372b53, https://www.virustotal.com/gui/collection/bc7e252dcc07855314e153efe890d70e7a7e9b8a743e171eac31e5951260c1b7, https://www.virustotal.com/gui/collection/dbf356b0a281fa94308e2e24738d839491491bfb2defa4e6c42662646e52c8f8, https://www.virustotal.com/gui/collection/f60b8061133367a1047262a1e90d54cd72de4d59885c267906c6eeb557a35500, https://www.virustotal.com/gui/collection/da124f42943c08f1cafdc1c42635457b0c69ccce41b4031263af3235717996a2/summary, https://www.virustotal.com/gui/collection/daab0521ae533cbdfeec047e51a9499aedfd27c8cc05c644950126c1947131f9, https://www.virustotal.com/gui/collection/12100cb4982365cfe5122fcedda2c084d60cebe09314846cae980c36fc90fc8c/iocs, https://www.virustotal.com/graph/embed/g9219350397134ff3a645319a88b67833077c9cf0f50d4979aa0239a3d0b6ecea?theme=dark, https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602, https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/graph, https://www.virustotal.com/gui/collection/c1ea74232c607b23ded09484664f00ae58f911ccb82433d042056cbb84c9d602/iocs, https://www.virustotal.com/gui/collection/da35693aa528a682ca91aee332c8155d99ac8e4a13077cc73b2a8921c8fea36b, https://www.virustotal.com/gui/collection/1497c56a475d73236c67292964eabd7f8961f88c57fa5a2e3f30720dc29a51e7, https://www.virustotal.com/gui/collection/8228434e85241bd42ae063de8cf2ee2afb86f0848675ed11e3f33b967e8c3c7c, https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188, https://www.virustotal.com/gui/collection/6a4e699473879d39e15ed7cd130f2ee9543f842b92c9ad8b78e310968f4b086f, https://www.virustotal.com/graph/embed/g3dae42eb79cc447182e3a3dd746e462f0903d71c784d4f5cacf970954deea221?theme=dark, https://www.virustotal.com/graph/embed/gc0d82762363b4aa88991027c391afdbfe9585395bd8d4273bbe09907fbfaf532?theme=light, https://www.virustotal.com/graph/embed/g78ea5ea9b68b4a4bbcd2bc078e23b321985e72d90da146c19d8d80ede366c1fa?theme=dark, https://www.virustotal.com/gui/collection/8f89eb9579ca53d15294ec27a4c1e763998ce57d3644ea746621d9fe0cb57e55/iocs, https://www.virustotal.com/graph/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076, https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f/iocs, https://www.virustotal.com/graph/g38632f8b939b443ab3b69f6a3171d02ffd2696a0f3714325a84b9a5f227a7d1c, https://www.virustotal.com/gui/user/jwanihad, https://www.virustotal.com/gui/collection/4b166c2c1752d85215da951b15a065688bfe24ea92c65228a45ded6f2d94685b/iocs, https://www.virustotal.com/graph/embed/g798b5e01446c4711ba22802009d71f5ba78553df16794088a907ae7456e2a017?theme=dark, https://www.virustotal.com/gui/collection/86f3d77a28744357c14d92dba7ac6302d57700308c64b641513119d8fcad411f, https://www.virustotal.com/gui/collection/a6a81c8412b19ac6357a7c6e978c31a38d52a75fbb3b2e44f0f1a2bf0deb8a58/iocs, https://www.virustotal.com/graph/embed/g699a7b9bfb324855859555181d01666c372310cf233441e08a095459b3394dea?theme=dark, https://www.virustotal.com/graph/embed/g6a67af8ffa22446da35d6989d7d0bc47efcd295eb893471e9b4912080c1dddef?theme=dark, https://www.virustotal.com/graph/embed/g23481631a7c745c6ba19f72ce9f853643d17706c08ab44eb8851eb5c56c0f073?theme=dark, https://www.virustotal.com/graph/embed/g3b316b58b8c54064b322b2e186d62950d7632add2f3f408f8d8a1706563fd3c0?theme=dark, https://www.virustotal.com/graph/embed/g994d0094226240eba65c081dfbc3e4936aa010abf4db48049e3a964e7c5ad076?theme=dark, https://www.virustotal.com/graph/g40f442f2b5d64cba818cac88855ba4ce274d109ce4ef4fb496f1af4efb993886, https://www.virustotal.com/gui/collection/0c9360cb9f8601bd6cdf912eb414d67902487f0c4eec96e952377e300ff4e983/iocs, https://www.virustotal.com/gui/collection/a1866f4c7dbc79920d0c7e914a3bace0d3dc424a2aac06bf30bf724c6c8b0375/iocs, https://www.virustotal.com/gui/collection/82dc29932b9184d02b037289fd4605c158e96a57f376b08a8b2b94e43d0ae18b/iocs, jwanihad - _No Problems__ Investigation of Distribution Vectors and Threat Network Infrastructure - files.stix, jwanihad - _No Problems__ Investigation of Distribution Vectors and Threat Network Infrastructure - domains.stix, https://ualbertaca-my.sharepoint.com/:f:/g/personal/jwanihad_ualberta_ca/EhLQD31IDHxMo2_PJev991AB8axG-g39-7GRT4V2KfX9Cg?e=FHpCUr

`165c5c883fd4fd36758bcba6baf2faffb77d2f4872ffd5ee918a16f91de5a8a8`

MITRE ATT&CK TTPs

Feed Intelligence Summary

Activity Timeline

Threat Activity Heatmap

VirusTotal

WHOIS

Export & API

IOC Journey