STAGE 5: CORRELATE
Global Threat Intelligence & IOC Hub
Real-time feed correlation (AlienVault, VirusTotal, AbuseIPDB, MISP, Shodan), APT campaign tracking, and IOC searching across Hashes, IPs, Domains, and Mutexes.
Connected Global Threat Feeds (7 Active Feeds)
AlienVault OTX
14,208 pulses2 mins ago
VirusTotal Enterprise
89,341 pulses1 min ago
AbuseIPDB Threat Stream
34,102 pulses4 mins ago
MISP CIRCL Threat Share
6,194 pulses12 mins ago
ThreatFox Abuse.ch
24,109 pulses8 mins ago
Feodo Tracker Botnet C2
1,842 pulses15 mins ago
Shodan ICS & C2 Scanner
92,830 pulses3 mins ago
TYPE:
SAMPLE:
| Indicator Artifact | Type | Associated Sample | Threat Actor | Confidence | ASN / Geolocation | Reputation |
|---|---|---|---|---|---|---|
| 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c | HASH | WannaCry.exe | Lazarus Group | 100% | N/A (File Hash) (Global Outbreak) | Malicious |
| www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | DOMAIN | WannaCry.exe | Lazarus Group | 99% | AS13335 (Cloudflare Sinkhole) (Sinkholed / Global) | Malicious |
| Global\MsWinZonesCacheCounterMutexA | MUTEX | WannaCry.exe | Lazarus Group | 98% | N/A (Kernel Mutex) (Host Local) | Malicious |
| 192.168.195.139 | IP | SillyPutty.exe | APT29 (UNC2452) | 95% | AS-RFC1918 (Private Lab / Egress C2) | Malicious |
| 0fa642a8b30d35e1654ff4560799f2e347ad64da0ca0d5cfab4a259c7f66a2e4 | HASH | SillyPutty.exe | APT29 (UNC2452) | 96% | N/A (File Hash) (Global) | Malicious |
| update.kbfirewall.com | DOMAIN | SikoMode.exe | FIN7 | 94% | AS48002 (Hostinger) (Seychelles) | Malicious |
| 9ef39b6b7a9925f448c474d284a1e94829391029481928391829381928391829 | HASH | SikoMode.exe | FIN7 | 95% | N/A (File Hash) (Global) | Malicious |
| 185.161.248.42 | IP | RedLineStealer.exe | FIN7 / RedLine Botnet | 97% | AS49800 (Selectel) (Russian Federation) | Malicious |
| d829103948102938102938102938102938102938102938102938102938102938 | HASH | RedLineStealer.exe | FIN7 / RedLine Botnet | 98% | N/A (File Hash) (Global) | Malicious |
| 104.18.21.90 | IP | CobaltStrike_Beacon.bin | LockBit / Red Team | 99% | AS13335 (Cloudflare CDN Masquerade) (United States) | Malicious |
| d3c1938.cloudfront.net | DOMAIN | CobaltStrike_Beacon.bin | LockBit / Red Team | 99% | AS16509 (Amazon AWS) (United States) | Malicious |
| \\.\pipe\msagent_ | MUTEX | CobaltStrike_Beacon.bin | Cobalt Strike Default | 99% | N/A (Named Pipe / Mutex) (Host Local) | Malicious |