Public Export

What you see below are the top 50 entries associated with this search in the Orange Cyberdefense Datalake Threat Intelligence database.
You can download all results in a file in CSV format.

This view is limited, and more information is available with a commercial subscription to the Datalake service. With premium access you are able to see all events associated with an observable, additional intelligence data, DNS telemetry and more.

If you are interested in a premium access, please contact: info.cert@fr.orangecyberdefense.com

Showing: 50 threats out of: 1074 results.

Download CSV with all results

THREAT: 172.232.172.125

atom details

IP: 172.232.172.125

First seen: 02 Nov 2023, 04:48:39

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 1

Phishing 0

Scan 17

Scam -

Spam -

THREAT: 42beac1265e0efc220ed63526f5b475c70621...

atom details

File: 42beac1265e0efc220ed63526f5b475c70621...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 8f9289915b3c6f8bf9a71d0a2d5aeb79ff024...

atom details

File: 8f9289915b3c6f8bf9a71d0a2d5aeb79ff024...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 47bfa21aaf31f2c1612e395db37b7677

atom details

File: 47bfa21aaf31f2c1612e395db37b7677

First seen: 26 Jun 2023, 03:20:12

Last updated by source: 26 Jun 2023, 03:20:12

Events: 1

Sources: 1

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Play ransomware

Malware: Playcrypt

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 17

Phishing -

Scan -

Scam -

Spam -

THREAT: 176476f9d924d83343a51a90ade097d12b759...

atom details

File: 176476f9d924d83343a51a90ade097d12b759...

First seen: 28 Nov 2022, 09:12:38

Last updated by source: 28 Nov 2022, 09:12:38

Events: 1

Sources: 1

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Play ransomware

Malware: Playcrypt

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 12

Phishing -

Scan -

Scam -

Spam -

THREAT: 73baa040cd6879d1d83c5afab29f61c373413...

atom details

File: 73baa040cd6879d1d83c5afab29f61c373413...

First seen: 06 Apr 2022, 10:35:40

Last updated by source: 21 Nov 2023, 10:25:51

Events: 7

Sources: 5

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: AsyncRAT

Malware: BitRAT

Malware: Blister

Malware: Dridex

Malware: Emotet - S0367

Malware: LockBit (Windows)

Malware: Play ransomware

Malware: Playcrypt

Malware: Socgholish

Malware: Zeon/Royal Ransomware

Threat Actor: BITWISE SPIDER

Tool: AsyncRAT - S1087

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 19

Phishing 12

Scan 24

Scam -

Spam -

THREAT: 3bc8ce92409876526ad6f48df44de3bd1e24a...

atom details

File: 3bc8ce92409876526ad6f48df44de3bd1e24a...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: aserpo.xyz

atom details

Domain: aserpo.xyz

First seen: 19 Jul 2023, 10:27:12

Last updated by source: 31 Jan 2025, 15:02:56

Events: 13

Sources: 9

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1471

Attack Pattern: Data Encrypted for Impact - T1486

Attack Pattern: Domain Generation Algorithms - T1568.002

Location: Turkey

Malware: BlackCat

Malware: Clop (Windows)

Malware: Conti

Malware: GootKit

Malware: GootLoader

Malware: IcedID - S0483

Malware: Matanbuchus

Malware: Meterpreter (Windows)

Malware: Nemty

Malware: Nokoyawa

Malware: Play ransomware

Malware: Playcrypt

Malware: REvil - S0496

Malware: RansomEXX (ELF)

Malware: Ryuk - S0446

Malware: TrickBot - S0266

Malware: Zeon/Royal Ransomware

Malware: metasploit

OCD - Threat pattern: Command and Control [C2]

Threat Actor: ALPHA SPIDER

Threat Actor: DEMON SPIDER

Threat Actor: FIN11

Threat Actor: GRIM SPIDER

Threat Actor: Karakurt

Threat Actor: PINCHY SPIDER

Threat Actor: RECESS SPIDER

Threat Actor: ShadowSyndicate

Threat Actor: TRAVELING SPIDER

Threat Actor: WIZARD SPIDER

Tool: Cobalt Strike - S0154

Tool: Sliver - S0633

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 19

Phishing 10

Scan 1

Scam -

Spam -

THREAT: angelbusinessteam.com

atom details

Domain: angelbusinessteam.com

First seen: 16 Jun 2023, 00:00:00

Last updated by source: 25 Mar 2025, 07:24:59

Events: 12

Sources: 7

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 15

Phishing 14

Scan 1

Scam -

Spam -

THREAT: 745a3dcdda16b93fedac8d7eefd1df32a7255...

atom details

File: 745a3dcdda16b93fedac8d7eefd1df32a7255...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: b4505ab44108e27d8a5311fe5ba32e2db88e7...

atom details

File: b4505ab44108e27d8a5311fe5ba32e2db88e7...

First seen: 17 Jan 2025, 15:09:09

Last updated by source: 27 Jan 2025, 13:15:54

Events: 2

Sources: 2

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Grixba

Malware: Play ransomware

Malware: Playcrypt

Tool: Net - S0039

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan -

Scam -

Spam -

THREAT: 53121c9c5164d8680ae1b88d95018a553dff8...

atom details

File: 53121c9c5164d8680ae1b88d95018a553dff8...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: websterbarn.com

atom details

Domain: websterbarn.com

First seen: 21 Feb 2015, 14:13:46

Last updated by source: 11 Apr 2025, 05:49:31

Events: 14

Sources: 5

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS 0

Fraud 0

Hack 0

Leak 0

Malware 20

Phishing 13

Scan 1

Scam 0

Spam 0

THREAT: 19c36a672d575d84f7f522a98829eb65343dc81f

atom details

File: 19c36a672d575d84f7f522a98829eb65343dc81f

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 45.182.189.105

atom details

IP: 45.182.189.105

First seen: 09 Feb 2023, 08:31:12

Last updated by source: 19 Mar 2025, 00:54:23

Events: 43

Sources: 20

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1471

Attack Pattern: Data Encrypted for Impact - T1486

Location: Turkey

Malware: Agent Tesla - S0331

Malware: BlackCat

Malware: Clop (Windows)

Malware: Conti

Malware: Emotet - S0367

Malware: GootKit

Malware: GootLoader

Malware: IcedID - S0483

Malware: Matanbuchus

Malware: Meterpreter (Windows)

Malware: NanoCore - S0336

Malware: Nemty

Malware: Nokoyawa

Malware: Pay2Key - S0556

Malware: Pikabot

Malware: Play ransomware

Malware: Playcrypt

Malware: REvil - S0496

Malware: RansomEXX (ELF)

Malware: Ryuk - S0446

Malware: TrickBot - S0266

Malware: Zeon/Royal Ransomware

Malware: metasploit

OCD - Threat pattern: Command and Control [C2]

Threat Actor: ALPHA SPIDER

Threat Actor: COBALT SPIDER

Threat Actor: DEMON SPIDER

Threat Actor: FIN11

Threat Actor: GRIM SPIDER

Threat Actor: Karakurt

Threat Actor: PINCHY SPIDER

Threat Actor: RECESS SPIDER

Threat Actor: ShadowSyndicate

Threat Actor: TA577

Threat Actor: TRAVELING SPIDER

Threat Actor: WIZARD SPIDER

Tool: Cobalt Strike - S0154

Tool: Sliver - S0633

Scores:

DDoS 1

Fraud -

Hack 1

Leak -

Malware 12

Phishing 0

Scan 1

Scam -

Spam -

THREAT: aeecc65ac8f0f6e10e95a898b60b43bf6ba9e...

atom details

File: aeecc65ac8f0f6e10e95a898b60b43bf6ba9e...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: dmdz.res4f.com

atom details

FQDN: dmdz.res4f.com

First seen: 18 Jan 2024, 10:24:49

Last updated by source: 30 Mar 2024, 03:49:46

Events: 7

Sources: 5

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 2

Phishing -

Scan 2

Scam -

Spam -

THREAT: tigx.xsefbe.com

atom details

FQDN: tigx.xsefbe.com

First seen: 18 Jan 2024, 10:24:49

Last updated by source: 30 Mar 2024, 03:49:47

Events: 8

Sources: 6

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Location: Turkey

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 2

Phishing 1

Scan 2

Scam -

Spam -

THREAT: 6daa94a36c8ccb9442f40c81a18b8501aa360...

atom details

File: 6daa94a36c8ccb9442f40c81a18b8501aa360...

First seen: 13 Sep 2024, 12:27:50

Last updated by source: 27 Nov 2024, 17:29:12

Events: 3

Sources: 3

Threat Entities:

Attack Pattern: PowerShell - T1086

Malware: Play ransomware

Malware: STOP

Threat Actor: RECESS SPIDER

Tool: Radmin

Vulnerability: [74995] Progress WhatsUp Gold - Multiple SQL Injections Vulnerabilities Fixed by 2024.0.0

Scores:

DDoS -

Fraud -

Hack 24

Leak -

Malware 51

Phishing 24

Scan 48

Scam -

Spam -

THREAT: 513c17ab6d8ec79ea6c5e196da67722c

atom details

File: 513c17ab6d8ec79ea6c5e196da67722c

First seen: 26 Feb 2023, 06:19:46

Last updated by source: 20 Mar 2025, 19:11:40

Events: 25

Sources: 19

Threat Entities:

Attack Pattern: Account Discovery - T1087

Attack Pattern: Archive Collected Data - T1560

Attack Pattern: Archive via Utility - T1560.001

Attack Pattern: Clear Windows Event Logs - T1070.001

Attack Pattern: Data Encrypted for Impact - T1486

Attack Pattern: Disable or Modify Tools - T1562.001

Attack Pattern: Exfiltration Over Alternative Protocol - T1048

Attack Pattern: Exploit Public-Facing Application - T1190

Attack Pattern: External Remote Services - T1133

Attack Pattern: Financial Theft - T1657

Attack Pattern: Group Policy Modification - T1484.001

Attack Pattern: Lateral Tool Transfer - T1570

Attack Pattern: Phishing - T1566

Attack Pattern: PowerShell - T1086

Attack Pattern: Process Injection - T1055

Attack Pattern: Security Software Discovery - T1518.001

Attack Pattern: Software Discovery - T1518

Attack Pattern: System Network Configuration Discovery - T1016

Attack Pattern: Unsecured Credentials - T1552

Attack Pattern: Valid Accounts - T1078

Malware: Impact

Malware: MimiKatz

Malware: Play ransomware

Malware: Playcrypt

Malware: PsExec

Malware: SystemBC

Threat Actor: RECESS SPIDER

Tool: AdFind - S0552

Tool: BloodHound - S0521

Tool: Cobalt Strike - S0154

Tool: Mimikatz - S0002

Tool: PsExec - S0029

Tool: Winscp

Scores:

DDoS -

Fraud -

Hack 55

Leak -

Malware 52

Phishing 12

Scan 24

Scam -

Spam -

THREAT: c92c158d7c37fea795114fa6491fe5f145ad2...

atom details

File: c92c158d7c37fea795114fa6491fe5f145ad2...

First seen: 15 Feb 2021, 04:18:40

Last updated by source: 01 May 2021, 00:34:51

Events: 7

Sources: 6

Threat Entities:

Attack Pattern: Application Layer Protocol - T1437

Attack Pattern: Boot or Logon Autostart Execution - T1547

Attack Pattern: Command-Line Interface - T1605

Attack Pattern: Create or Modify System Process - T1543

Attack Pattern: Data Encoding - T1132

Attack Pattern: Hide Artifacts - T1564

Attack Pattern: Native API - T1106

Attack Pattern: Network Share Discovery - T1135

Attack Pattern: Permission Groups Discovery - T1069

Attack Pattern: Phishing - T1566

Attack Pattern: Process Discovery - T1057

Attack Pattern: Query Registry - T1012

Attack Pattern: Remote Services - T1021

Attack Pattern: System Information Discovery - T1082

Attack Pattern: System Network Configuration Discovery - T1016

Attack Pattern: System Owner/User Discovery - T1033

Attack Pattern: Windows Management Instrumentation - T1047

Identity: Chemical

Location: France

Malware: Play ransomware

Threat Actor: Lazarus (umbrella)

Threat Actor: RECESS SPIDER

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 20

Phishing -

Scan -

Scam -

Spam -

THREAT: 83c121db96d99f0d99b9e7a2384386f3f6deb...

atom details

File: 83c121db96d99f0d99b9e7a2384386f3f6deb...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 015bd2e799049f5e474b80cbbdcd592ce4e2d...

atom details

File: 015bd2e799049f5e474b80cbbdcd592ce4e2d...

First seen: 16 Jul 2024, 13:06:52

Last updated by source: 22 Jul 2024, 08:25:39

Events: 4

Sources: 3

Threat Entities:

Attack Pattern: BadPack

Attack Pattern: Phishing - T1566

Malware: BianLian (Android)

Malware: Cerberus - S0480

Malware: Demo

Malware: Play ransomware

Malware: Playcrypt

Malware: WildFire

Threat Actor: MASKED SPIDER

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 48

Phishing -

Scan 48

Scam -

Spam -

THREAT: f982dfc0a0984f317460ca6d27d72ad6b3274...

atom details

File: f982dfc0a0984f317460ca6d27d72ad6b3274...

First seen: 27 Mar 2025, 14:01:54

Last updated by source: 27 Mar 2025, 14:01:54

Events: 1

Sources: 1

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: BianLian (Android)

Malware: EDRKillShifter

Malware: Grixba

Malware: Medusa Blog

Malware: Play ransomware

Malware: Playcrypt

Malware: Scransom

Malware: SystemBC

Threat Actor: MASKED SPIDER

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 90

Phishing -

Scan -

Scam -

Spam -

THREAT: 51f44e31b0f3718a5d145a1f77fd79cbd7ff2...

atom details

File: 51f44e31b0f3718a5d145a1f77fd79cbd7ff2...

First seen: 28 Nov 2022, 09:12:55

Last updated by source: 28 Nov 2022, 09:12:55

Events: 1

Sources: 1

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Play ransomware

Malware: Playcrypt

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 12

Phishing -

Scan -

Scam -

Spam -

THREAT: 71.19.250.242

atom details

IP: 71.19.250.242

First seen: 18 Jan 2024, 10:24:49

Last updated by source: 26 Feb 2025, 13:16:49

Events: 7

Sources: 5

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 8

Phishing 8

Scan 1

Scam -

Spam -

THREAT: 8e6c0d338f201630b5c5ba4f1757e931bc065...

atom details

File: 8e6c0d338f201630b5c5ba4f1757e931bc065...

First seen: 06 Apr 2022, 10:35:58

Last updated by source: 21 Nov 2023, 10:25:51

Events: 7

Sources: 5

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: AsyncRAT

Malware: BitRAT

Malware: Blister

Malware: Dridex

Malware: Emotet - S0367

Malware: LockBit (Windows)

Malware: Play ransomware

Malware: Playcrypt

Malware: Socgholish

Malware: Zeon/Royal Ransomware

Threat Actor: BITWISE SPIDER

Tool: AsyncRAT - S1087

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 19

Phishing 12

Scan 24

Scam -

Spam -

THREAT: dyanoe.com

atom details

Domain: dyanoe.com

First seen: 16 Aug 2021, 00:00:00

Last updated by source: 14 Apr 2025, 15:35:07

Events: 24

Sources: 12

Threat Entities:

Attack Pattern: Domain Generation Algorithms - T1520

Attack Pattern: Domain Generation Algorithms - T1568.002

Attack Pattern: Phishing - T1566

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

Malware: Virut

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS 0

Fraud 0

Hack 1

Leak 0

Malware 0

Phishing 13

Scan 1

Scam 13

Spam 0

THREAT: formulaautoparts.com

atom details

Domain: formulaautoparts.com

First seen: 13 Sep 2023, 10:47:35

Last updated by source: 26 Mar 2025, 04:13:11

Events: 10

Sources: 6

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 16

Phishing 14

Scan 1

Scam -

Spam -

THREAT: 96ebacf48656b804aed9979c2c4b651bbb1bc...

atom details

File: 96ebacf48656b804aed9979c2c4b651bbb1bc...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 149.154.158.222

atom details

IP: 149.154.158.222

First seen: 11 May 2024, 18:47:39

Last updated by source: 11 Apr 2025, 20:50:01

Events: 12

Sources: 7

Threat Entities:

Attack Pattern: Account Discovery - T1087

Attack Pattern: Acquire Infrastructure - T1583

Attack Pattern: Application Layer Protocol - T1437

Attack Pattern: Brute Force - T1110

Attack Pattern: Data Destruction - T1485

Attack Pattern: Data Encrypted for Impact - T1486

Attack Pattern: Data from Local System - T1005

Attack Pattern: Data from Network Shared Drive - T1039

Attack Pattern: Disable or Modify Tools - T1562.001

Attack Pattern: Domain Accounts - T1078.002

Attack Pattern: Execution Guardrails - T1480

Attack Pattern: Financial Theft - T1657

Attack Pattern: Malware - T1587.001

Attack Pattern: Malware - T1588.001

Attack Pattern: Non-Standard Encoding - T1132.002

Attack Pattern: PowerShell - T1059.001

Attack Pattern: Process Discovery - T1057

Attack Pattern: Remote Desktop Protocol - T1021.001

Attack Pattern: SMB/Windows Admin Shares - T1021.002

Attack Pattern: Safe Mode Boot - T1562.009

Attack Pattern: System Binary Proxy Execution - T1218

Attack Pattern: Tool - T1588.002

Attack Pattern: Transfer Data to Cloud Account - T1537

Attack Pattern: Upload Malware - T1608.001

Attack Pattern: Upload Tool - T1608.002

Attack Pattern: Valid Accounts - T1078

Attack Pattern: Windows Command Shell - T1059.003

Location: Turkey

Malware: BianLian (Android)

Malware: EDRKillShifter

Malware: Medusa Blog

Malware: Play ransomware

Malware: RansomHub

Threat Actor: MASKED SPIDER

Threat Actor: RECESS SPIDER

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 100

Phishing 1

Scan 1

Scam -

Spam -

THREAT: esoftwareupdates.com

atom details

Domain: esoftwareupdates.com

First seen: 04 Dec 2022, 20:18:26

Last updated by source: 11 Apr 2025, 00:40:09

Events: 36

Sources: 21

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1471

Attack Pattern: Data Encrypted for Impact - T1486

Location: Turkey

Malware: BlackCat

Malware: Clop (Windows)

Malware: Conti

Malware: GootKit

Malware: GootLoader

Malware: IcedID - S0483

Malware: Matanbuchus

Malware: Meterpreter (Windows)

Malware: Nemty

Malware: Nokoyawa

Malware: Play ransomware

Malware: Playcrypt

Malware: REvil - S0496

Malware: RansomEXX (ELF)

Malware: Ryuk - S0446

Malware: TrickBot - S0266

Malware: Zeon/Royal Ransomware

Malware: metasploit

OCD - Threat pattern: Command and Control [C2]

Threat Actor: ALPHA SPIDER

Threat Actor: DEMON SPIDER

Threat Actor: FIN11

Threat Actor: GRIM SPIDER

Threat Actor: Karakurt

Threat Actor: PINCHY SPIDER

Threat Actor: RECESS SPIDER

Threat Actor: ShadowSyndicate

Threat Actor: TRAVELING SPIDER

Threat Actor: WIZARD SPIDER

Tool: Cobalt Strike - S0154

Tool: Sliver - S0633

Scores:

DDoS 0

Fraud 0

Hack 1

Leak 0

Malware 19

Phishing 7

Scan 1

Scam 0

Spam 0

THREAT: edd2ed2.online

atom details

Domain: edd2ed2.online

First seen: 24 May 2023, 00:00:00

Last updated by source: 14 Apr 2025, 15:36:01

Events: 12

Sources: 8

Threat Entities:

Attack Pattern: Domain Generation Algorithms - T1568.002

Attack Pattern: Phishing - T1566

Malware: Play ransomware

Malware: Playcrypt

Malware: RedLine Stealer

Malware: rilide

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 1

Phishing 15

Scan 1

Scam 14

Spam -

THREAT: 6743bb204fc3004046ed8c7f4e8d9a921b3d568e

atom details

File: 6743bb204fc3004046ed8c7f4e8d9a921b3d568e

First seen: 11 Apr 2022, 14:59:55

Last updated by source: 21 Nov 2023, 10:25:51

Events: 5

Sources: 3

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: BitRAT

Malware: Blister

Malware: Dridex

Malware: Emotet - S0367

Malware: LockBit (Windows)

Malware: Play ransomware

Malware: Playcrypt

Malware: Socgholish

Malware: Zeon/Royal Ransomware

Threat Actor: BITWISE SPIDER

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack 19

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: a9ea85481e178cd35ae323410d619e97f4913...

atom details

File: a9ea85481e178cd35ae323410d619e97f4913...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 6030c4381b8b5d5c5734341292316723a89f1...

atom details

File: 6030c4381b8b5d5c5734341292316723a89f1...

First seen: 07 May 2025, 13:14:02

Last updated by source: 09 May 2025, 09:11:26

Events: 2

Sources: 2

Threat Entities:

Malware: Grixba

Malware: PipeMagic

Malware: Play ransomware

Malware: Playcrypt

Threat Actor: RECESS SPIDER

Threat Actor: Storm-2460

Vulnerability: [95221] Microsoft CLFS - Privileges Escalation Vulnerability Fixed by April 2025 Patch Day

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan 100

Scam -

Spam -

THREAT: xihb.bhowljw1.com

atom details

FQDN: xihb.bhowljw1.com

First seen: 18 Jan 2024, 10:24:49

Last updated by source: 30 Mar 2024, 03:49:47

Events: 9

Sources: 7

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Location: France

Location: Turkey

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 1

Phishing 1

Scan 2

Scam -

Spam -

THREAT: 207.38.87.205

atom details

IP: 207.38.87.205

First seen: 10 Jun 2019, 09:49:19

Last updated by source: 18 Jan 2024, 13:51:16

Events: 10

Sources: 5

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 1

Phishing -

Scan 1

Scam -

Spam -

THREAT: 84.239.41.12

atom details

IP: 84.239.41.12

First seen: 20 Mar 2024, 06:42:20

Last updated by source: 17 Apr 2025, 18:58:09

Events: 6

Sources: 5

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Grixba

Malware: Play ransomware

Malware: Playcrypt

Tool: Net - S0039

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 72

Phishing 1

Scan -

Scam -

Spam 1

THREAT: 2b254ae6690c9e37fa7d249e8578ee27393e4...

atom details

File: 2b254ae6690c9e37fa7d249e8578ee27393e4...

First seen: 03 Oct 2024, 13:57:39

Last updated by source: 08 Nov 2024, 19:46:29

Events: 7

Sources: 5

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Location: United States of America

Location: americas (victim)

Location: north-america (victim)

Malware: Chisel

Malware: Dtrack - S0567

Malware: IMPACKET

Malware: Maui Ransomware

Malware: MimiKatz

Malware: Play ransomware

Malware: Playcrypt

Malware: PsExec

Malware: Sality

Malware: Xbot

Threat Actor: Lazarus (umbrella)

Threat Actor: RECESS SPIDER

Threat Actor: SILENT CHOLLIMA

Tool: Cobalt Strike - S0154

Tool: Impacket - S0357

Tool: Mimikatz - S0002

Tool: PsExec - S0029

Tool: Putty

Tool: Sliver - S0633

Scores:

DDoS -

Fraud -

Hack 43

Leak -

Malware 73

Phishing -

Scan 53

Scam -

Spam -

THREAT: promedia-usa.com

atom details

Domain: promedia-usa.com

First seen: 09 Feb 2020, 00:00:00

Last updated by source: 06 Feb 2025, 07:28:27

Events: 8

Sources: 5

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS 0

Fraud 0

Hack 0

Leak 0

Malware 18

Phishing 14

Scan 1

Scam 0

Spam 0

THREAT: 99f337a4a8f1edf8243e2b64620a1c0f23034d8d

atom details

File: 99f337a4a8f1edf8243e2b64620a1c0f23034d8d

First seen: 25 Apr 2023, 09:41:19

Last updated by source: 25 Apr 2023, 09:41:19

Events: 1

Sources: 1

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1486

Malware: Play ransomware

Malware: Playcrypt

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 100

Phishing -

Scan -

Scam -

Spam -

THREAT: pandoramain-1794008345.us-west-2.elb....

atom details

FQDN: pandoramain-1794008345.us-west-2.elb....

First seen: 05 Jun 2023, 04:00:00

Last updated by source: 17 Apr 2025, 14:08:56

Events: 17

Sources: 6

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Phishing - T1566

Attack Pattern: Resource Hijacking - T1496

Location: France

Location: Turkey

Malware: Mirai

Malware: Pandora ransomware

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 15

Phishing 15

Scan 2

Scam 11

Spam -

THREAT: jdl.hgdsd.com

atom details

FQDN: jdl.hgdsd.com

First seen: 18 Jan 2024, 10:24:49

Last updated by source: 05 Mar 2025, 20:36:05

Events: 9

Sources: 6

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 8

Phishing 17

Scan 2

Scam -

Spam -

THREAT: 2230d95e2845a41330677fab95fa6af4

atom details

File: 2230d95e2845a41330677fab95fa6af4

First seen: 08 Mar 2023, 17:43:21

Last updated by source: 21 Nov 2023, 10:25:51

Events: 4

Sources: 4

Threat Entities:

Attack Pattern: Phishing - T1566

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 18

Phishing -

Scan 24

Scam -

Spam -

THREAT: 977cac98290faf0eb83c707d46249bdae9bddf43

atom details

File: 977cac98290faf0eb83c707d46249bdae9bddf43

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: 81.19.136.251

atom details

IP: 81.19.136.251

First seen: 27 Sep 2023, 00:49:54

Last updated by source: 21 Feb 2025, 11:46:37

Events: 16

Sources: 9

Threat Entities:

Attack Pattern: Data Encrypted for Impact - T1471

Attack Pattern: Data Encrypted for Impact - T1486

Location: Turkey

Malware: BlackCat

Malware: Clop (Windows)

Malware: Conti

Malware: GootKit

Malware: GootLoader

Malware: IcedID - S0483

Malware: Matanbuchus

Malware: Meterpreter (Windows)

Malware: Nemty

Malware: Nokoyawa

Malware: Play ransomware

Malware: Playcrypt

Malware: REvil - S0496

Malware: RansomEXX (ELF)

Malware: Ryuk - S0446

Malware: TrickBot - S0266

Malware: Zeon/Royal Ransomware

Malware: metasploit

OCD - Threat pattern: Command and Control [C2]

Threat Actor: ALPHA SPIDER

Threat Actor: DEMON SPIDER

Threat Actor: FIN11

Threat Actor: GRIM SPIDER

Threat Actor: Karakurt

Threat Actor: PINCHY SPIDER

Threat Actor: RECESS SPIDER

Threat Actor: ShadowSyndicate

Threat Actor: TRAVELING SPIDER

Threat Actor: WIZARD SPIDER

Tool: Cobalt Strike - S0154

Tool: Sliver - S0633

Vulnerability: [60102] Aiohttp - Multiple Vulnerabilities Fixed by 3.9.2

Scores:

DDoS -

Fraud -

Hack 1

Leak -

Malware 20

Phishing 9

Scan 1

Scam -

Spam -

THREAT: 7f71d316c197e4e0aa1fce9d40c6068ada424...

atom details

File: 7f71d316c197e4e0aa1fce9d40c6068ada424...

First seen: 03 Nov 2023, 17:34:06

Last updated by source: 21 Nov 2023, 10:25:51

Events: 2

Sources: 2

Threat Entities:

Malware: BitRAT

Malware: Blister

Malware: Play ransomware

Malware: Playcrypt

Malware: Zeon/Royal Ransomware

Tool: Cobalt Strike - S0154

Tool: Mythic

Tool: Putty

Scores:

DDoS -

Fraud -

Hack -

Leak -

Malware 24

Phishing -

Scan 24

Scam -

Spam -

THREAT: abcr.ftsym1.com

atom details

FQDN: abcr.ftsym1.com

First seen: 06 Sep 2023, 16:49:58

Last updated by source: 23 Oct 2024, 11:47:23

Events: 19

Sources: 7

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Location: France

Location: Turkey

Malware: Mirai

Malware: Pandora ransomware

Malware: Play ransomware

Malware: Playcrypt

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 9

Phishing 17

Scan 2

Scam -

Spam -

THREAT: 71.19.252.13

atom details

IP: 71.19.252.13

First seen: 07 Sep 2023, 08:00:00

Last updated by source: 30 Mar 2024, 03:49:46

Events: 9

Sources: 6

Threat Entities:

Attack Pattern: Debugger Evasion - T1622

Attack Pattern: Dynamic Linker Hijacking - T1574.006

Attack Pattern: Exfiltration Over C2 Channel - T1041

Attack Pattern: Network Denial of Service - T1464

Attack Pattern: Resource Hijacking - T1496

Location: France

Malware: Mirai

Malware: Play ransomware

Malware: Playcrypt

Malware: QakBot - S0650

Malware: Tsunami (ELF)

OCD - Threat pattern: Command and Control [C2]

OCD - Threat pattern: ddos

Scores:

DDoS -

Fraud -

Hack 2

Leak -

Malware 0

Phishing -

Scan 1

Scam -

Spam -