Tortoiseshell: New Toolset and Operational Infrastructure Exposed

Domains/Urls

neexportfolio.com

neexportfolio.azurewebsites.net

neexportfolio.eastus.cloudapp.azure.com

locat.sbs

tiktok-u.sbs

jp2.tiktok-u.sbs

uk2.locat.sbs

can2.tiktok-u.sbs

uae7.locat.sbs

uae5.locat.sbs

sau3.locat.sbs

uae14.locat.sbs

uae2.locat.sbs

uae1.locat.sbs

au1.tiktok-u.sbs

uae4.locat.sbs

uae12.locat.sbs

uae3.locat.sbs

cloud.tiktok-u.sbs

5orka.tiktok-u.sbs

uae11.locat.sbs

sau1.locat.sbs

uk2.tiktok-u.sbs

uae8.tiktok-u.sbs

can2.locat.sbs

uae12.tiktok-u.sbs

au1.locat.sbs

5orka.locat.sbs

bel1.locat.sbs

uae2.tiktok-u.sbs

sau2.locat.sbs

uae13.locat.sbs

uae9.tiktok-u.sbs

uk1.locat.sbs

uae7.tiktok-u.sbs

uae6.tiktok-u.sbs

uae1.tiktok-u.sbs

uae4.tiktok-u.sbs

uae11.tiktok-u.sbs

uae5.tiktok-u.sbs

uae10.tiktok-u.sbs

uk1.tiktok-u.sbs

jp2.locat.sbs

bridge1.locat.sbs

bel1.tiktok-u.sbs

uae13.tiktok-u.sbs

uae14.tiktok-u.sbs

sau2.tiktok-u.sbs

uae9.locat.sbs

uae3.tiktok-u.sbs

sau1.tiktok-u.sbs

sau3.tiktok-u.sbs

uae8.locat.sbs

cloud.locat.sb

bridge1.tiktok-u.sbs

uae6.locat.sb

uae10.locat.sbs

IP Address

172.86.98.113

185.66.68.213

185.253.116.71

185.253.116.242

185.253.118.246

94.126.227.20

89.44.80.42

91.193.16.187

89.44.80.234

89.44.80.61

94.126.227.119

89.44.80.86

89.44.80.6

185.253.116.99

89.44.80.56

95.174.68.199

185.253.116.166

139.84.202.187

188.119.149.200

85.208.86.140

89.44.80.96

185.253.116.81

79.141.167.230

95.85.235.9

167.179.89.68

89.44.80.168

72.56.34.52

Hash

db58adc4a6c192520ed509b20a928279

07dd28b748656e9e1a870c538d6df68c

597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437

d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b

Detection Query 1 :

domainname like "uae14.locat.sbs" or url like "uae14.locat.sbs" or siteurl like "uae14.locat.sbs" or domainname like "au1.tiktok-u.sbs" or url like "au1.tiktok-u.sbs" or siteurl like "au1.tiktok-u.sbs" or domainname like "uae13.locat.sbs" or url like "uae13.locat.sbs" or siteurl like "uae13.locat.sbs" or domainname like "uae6.tiktok-u.sbs" or url like "uae6.tiktok-u.sbs" or siteurl like "uae6.tiktok-u.sbs" or domainname like "uae2.tiktok-u.sbs" or url like "uae2.tiktok-u.sbs" or siteurl like "uae2.tiktok-u.sbs" or domainname like "sau2.locat.sbs" or url like "sau2.locat.sbs" or siteurl like "sau2.locat.sbs" or domainname like "bridge1.tiktok-u.sbs" or url like "bridge1.tiktok-u.sbs" or siteurl like "bridge1.tiktok-u.sbs" or domainname like "sau3.locat.sbs" or url like "sau3.locat.sbs" or siteurl like "sau3.locat.sbs" or domainname like "5orka.locat.sbs" or url like "5orka.locat.sbs" or siteurl like "5orka.locat.sbs" or domainname like "can2.tiktok-u.sbs" or url like "can2.tiktok-u.sbs" or siteurl like "can2.tiktok-u.sbs" or domainname like "bridge1.locat.sbs" or url like "bridge1.locat.sbs" or siteurl like "bridge1.locat.sbs" or domainname like "uae5.locat.sbs" or url like "uae5.locat.sbs" or siteurl like "uae5.locat.sbs" or domainname like "uae4.locat.sbs" or url like "uae4.locat.sbs" or siteurl like "uae4.locat.sbs" or domainname like "bel1.locat.sbs" or url like "bel1.locat.sbs" or siteurl like "bel1.locat.sbs" or domainname like "sau1.tiktok-u.sbs" or url like "sau1.tiktok-u.sbs" or siteurl like "sau1.tiktok-u.sbs" or domainname like "jp2.tiktok-u.sbs" or url like "jp2.tiktok-u.sbs" or siteurl like "jp2.tiktok-u.sbs" or domainname like "uae3.tiktok-u.sbs" or url like "uae3.tiktok-u.sbs" or siteurl like "uae3.tiktok-u.sbs" or domainname like "jp2.locat.sbs" or url like "jp2.locat.sbs" or siteurl like "jp2.locat.sbs" or domainname like "uk2.tiktok-u.sbs" or url like "uk2.tiktok-u.sbs" or siteurl like "uk2.tiktok-u.sbs" or domainname like "uk1.locat.sbs" or url like "uk1.locat.sbs" or siteurl like "uk1.locat.sbs" or domainname like "uae12.locat.sbs" or url like "uae12.locat.sbs" or siteurl like "uae12.locat.sbs" or domainname like "uae3.locat.sbs" or url like "uae3.locat.sbs" or siteurl like "uae3.locat.sbs" or domainname like "uae10.tiktok-u.sbs" or url like "uae10.tiktok-u.sbs" or siteurl like "uae10.tiktok-u.sbs" or domainname like "uae11.locat.sbs" or url like "uae11.locat.sbs" or siteurl like "uae11.locat.sbs" or domainname like "uae9.locat.sbs" or url like "uae9.locat.sbs" or siteurl like "uae9.locat.sbs" or domainname like "uae9.tiktok-u.sbs" or url like "uae9.tiktok-u.sbs" or siteurl like "uae9.tiktok-u.sbs" or domainname like "can2.locat.sbs" or url like "can2.locat.sbs" or siteurl like "can2.locat.sbs" or domainname like "uae7.tiktok-u.sbs" or url like "uae7.tiktok-u.sbs" or siteurl like "uae7.tiktok-u.sbs" or domainname like "uae10.locat.sbs" or url like "uae10.locat.sbs" or siteurl like "uae10.locat.sbs" or domainname like "5orka.tiktok-u.sbs" or url like "5orka.tiktok-u.sbs" or siteurl like "5orka.tiktok-u.sbs" or domainname like "neexportfolio.eastus.cloudapp.azure.com" or url like "neexportfolio.eastus.cloudapp.azure.com" or siteurl like "neexportfolio.eastus.cloudapp.azure.com" or domainname like "uae7.locat.sbs" or url like "uae7.locat.sbs" or siteurl like "uae7.locat.sbs" or domainname like "uae12.tiktok-u.sbs" or url like "uae12.tiktok-u.sbs" or siteurl like "uae12.tiktok-u.sbs" or domainname like "uae4.tiktok-u.sbs" or url like "uae4.tiktok-u.sbs" or siteurl like "uae4.tiktok-u.sbs" or domainname like "uae11.tiktok-u.sbs" or url like "uae11.tiktok-u.sbs" or siteurl like "uae11.tiktok-u.sbs" or domainname like "cloud.tiktok-u.sbs" or url like "cloud.tiktok-u.sbs" or siteurl like "cloud.tiktok-u.sbs" or domainname like "locat.sbs" or url like "locat.sbs" or siteurl like "locat.sbs" or domainname like "sau1.locat.sbs" or url like "sau1.locat.sbs" or siteurl like "sau1.locat.sbs" or domainname like "uae2.locat.sbs" or url like "uae2.locat.sbs" or siteurl like "uae2.locat.sbs" or domainname like "uae1.locat.sbs" or url like "uae1.locat.sbs" or siteurl like "uae1.locat.sbs" or domainname like "sau2.tiktok-u.sbs" or url like "sau2.tiktok-u.sbs" or siteurl like "sau2.tiktok-u.sbs" or domainname like "uae6.locat.sb" or url like "uae6.locat.sb" or siteurl like "uae6.locat.sb" or domainname like "bel1.tiktok-u.sbs" or url like "bel1.tiktok-u.sbs" or siteurl like "bel1.tiktok-u.sbs" or domainname like "uk2.locat.sbs" or url like "uk2.locat.sbs" or siteurl like "uk2.locat.sbs" or domainname like "uae5.tiktok-u.sbs" or url like "uae5.tiktok-u.sbs" or siteurl like "uae5.tiktok-u.sbs" or domainname like "cloud.locat.sb" or url like "cloud.locat.sb" or siteurl like "cloud.locat.sb" or domainname like "tiktok-u.sbs" or url like "tiktok-u.sbs" or siteurl like "tiktok-u.sbs" or domainname like "au1.locat.sbs" or url like "au1.locat.sbs" or siteurl like "au1.locat.sbs" or domainname like "uae13.tiktok-u.sbs" or url like "uae13.tiktok-u.sbs" or siteurl like "uae13.tiktok-u.sbs" or domainname like "neexportfolio.com" or url like "neexportfolio.com" or siteurl like "neexportfolio.com" or domainname like "uk1.tiktok-u.sbs" or url like "uk1.tiktok-u.sbs" or siteurl like "uk1.tiktok-u.sbs" or domainname like "uae8.tiktok-u.sbs" or url like "uae8.tiktok-u.sbs" or siteurl like "uae8.tiktok-u.sbs" or domainname like "sau3.tiktok-u.sbs" or url like "sau3.tiktok-u.sbs" or siteurl like "sau3.tiktok-u.sbs" or domainname like "uae1.tiktok-u.sbs" or url like "uae1.tiktok-u.sbs" or siteurl like "uae1.tiktok-u.sbs" or domainname like "uae14.tiktok-u.sbs" or url like "uae14.tiktok-u.sbs" or siteurl like "uae14.tiktok-u.sbs" or domainname like "uae8.locat.sbs" or url like "uae8.locat.sbs" or siteurl like "uae8.locat.sbs" or domainname like "neexportfolio.azurewebsites.net" or url like "neexportfolio.azurewebsites.net" or siteurl like "neexportfolio.azurewebsites.net"

Detection Query 2 :

dstipaddress IN ("95.85.235.9","185.66.68.213","89.44.80.86","94.126.227.20","95.174.68.199","94.126.227.119","85.208.86.140","89.44.80.168","89.44.80.234","167.179.89.68","89.44.80.56","91.193.16.187","89.44.80.6","188.119.149.200","185.253.116.242","89.44.80.61","72.56.34.52","172.86.98.113","139.84.202.187","185.253.118.246","185.253.116.99","89.44.80.96","185.253.116.71","185.253.116.81","79.141.167.230","89.44.80.42","185.253.116.166") or srcipaddress IN ("95.85.235.9","185.66.68.213","89.44.80.86","94.126.227.20","95.174.68.199","94.126.227.119","85.208.86.140","89.44.80.168","89.44.80.234","167.179.89.68","89.44.80.56","91.193.16.187","89.44.80.6","188.119.149.200","185.253.116.242","89.44.80.61","72.56.34.52","172.86.98.113","139.84.202.187","185.253.118.246","185.253.116.99","89.44.80.96","185.253.116.71","185.253.116.81","79.141.167.230","89.44.80.42","185.253.116.166")

Detection Query 3 :

md5hash IN ("db58adc4a6c192520ed509b20a928279","07dd28b748656e9e1a870c538d6df68c")

Detection Query 4 :

sha256hash IN ("d23c1b7b917f53e4e5a608e9870e574f7461eead277726249c4acf4a2b0bef4b","597c40e0b23f38f30a3c85be0510b14985b2948895819c899e3f3c8f200aa437")