[
  {
    "id": 4368571174,
    "indicator": "11b07ef51fda4ff3c1063f579cb72542",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "MD5 of 2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571175,
    "indicator": "36dec15d87647786d954c3d681ae27b9",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "MD5 of f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571176,
    "indicator": "378cf21d5d2f72ae1aefe3c4418cb5ca",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "MD5 of 281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571177,
    "indicator": "3dbd6f4826765e00ac2012ee8a2f99ff",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "MD5 of d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571178,
    "indicator": "4bd2b8f4795c9817ac26f5e620b46aff",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "MD5 of 971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571179,
    "indicator": "8c0807260135014e429f5f6faf7ba242",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "MD5 of 691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571180,
    "indicator": "a8b11209654053bd898e3aacb63bb8b4",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "MD5 of 1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571181,
    "indicator": "cd765071a18484d24387d11ef7a4b61b",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "MD5 of 9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571182,
    "indicator": "e372813c16b0cc0f6e449197bce74f4f",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "MD5 of ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571183,
    "indicator": "f0740c1f9e075d6f920a489592e7a7fe",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "MD5 of 9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571184,
    "indicator": "fab452b48aceecffb16a288a3b3267a5",
    "type": "FileHash-MD5",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "MD5 of a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571185,
    "indicator": "088a0c11517c63e75455414178a2ae95e110304c",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "SHA1 of a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571186,
    "indicator": "20460b496c530918f705a9f8ce9f020e6ddcc4e0",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "SHA1 of 9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571187,
    "indicator": "490ab9213ce0bf7689dd5f40e8217b1818f9f0c4",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "SHA1 of 2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571188,
    "indicator": "4b7cde173da1d8d8f45efe1d8bef8491dc941ebe",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "SHA1 of ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571189,
    "indicator": "4f4bbcb2f7e8d7e7cd367f178462bd7ef442b765",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "SHA1 of d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571190,
    "indicator": "5009379fa6f260e87fc22b1c87cce0b39f89a2cc",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "SHA1 of 1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571191,
    "indicator": "56d6d789f6215aeb84e2ccaf4a19473461d46f75",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "SHA1 of 691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571192,
    "indicator": "5724a9d251997adc83fd50d117fb4c106cb3dcc8",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "SHA1 of f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571193,
    "indicator": "6b152b4e1e86bd5ccf4703158b21c9cde5b3fe36",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "SHA1 of 281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571194,
    "indicator": "8281e972aa8dc69a888a797739b5195b63b38a3d",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "SHA1 of 9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4368571195,
    "indicator": "b4d8c1ccb773b737b4fe80940e20991045aca63e",
    "type": "FileHash-SHA1",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "SHA1 of 971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154336,
    "indicator": "1bd0a200528c82c6488b4f48dd6dbc818d48782a2e25ccd22781c5718c3f62f5",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154337,
    "indicator": "2172dae9a5a695e00e0e4609e7db0207d8566d225f7e815fada246ae995c0f9b",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154338,
    "indicator": "281b970f281dbea3c0e8cfc68b2e9939b253e5d3de52265b454d8f0f578768a2",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154339,
    "indicator": "691896c7be87e47f3e9ae914d76caaf026aaad0a1034e9f396c2354245215dc3",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154340,
    "indicator": "971198ff86aeb42739ba9381923d0bc6f847a91553ec57ea6bae5becf80f8759",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154341,
    "indicator": "9aab30a3190301016c79f8a7f8edf45ec088ceecad39926cfcf3418145f3d614",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154342,
    "indicator": "9fda1ddb1acf8dd3685ec31b0b07110855832e3bed28a0f3b81c57fe7fe3ac20",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154343,
    "indicator": "a9f529a5cbc1f3ee80f785b22e0c472953e6cb226952218aecc7ab07ca328abd",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154344,
    "indicator": "ab0fa760bd037a95c4dee431e649e0db860f7cdad6428895b9a399b6991bf3cd",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "ALF:HSTR:Trojan:MSIL/Nagoot.S04",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154345,
    "indicator": "d11938f14499de03d6a02b5e158782afd903460576e9227e0a15d960a2e9c02c",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154346,
    "indicator": "f76ba1a4650d8cafb6d3ff071688c5db6fd37e165050f03cece693826f51d346",
    "type": "FileHash-SHA256",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "SUSP_XORed_URL_In_EXE",
    "description": "",
    "expiration": null,
    "is_active": 1
  },
  {
    "id": 4361154335,
    "indicator": "194.87.92.109",
    "type": "IPv4",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "CC=RU ASN=AS48347 jsc mediasoft ekspert",
    "expiration": "2026-06-20T16:00:00",
    "is_active": 1
  },
  {
    "id": 4363944703,
    "indicator": "http://194.87.92.109/i.php",
    "type": "URL",
    "created": "2026-05-21T16:13:28",
    "content": "",
    "title": "",
    "description": "",
    "expiration": null,
    "is_active": 1
  }
]