{
  "type": "Domain",
  "indicator": "10yearsofborn.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/10yearsofborn.com",
    "alexa": "http://www.alexa.com/siteinfo/10yearsofborn.com",
    "indicator": "10yearsofborn.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3355122753,
      "indicator": "10yearsofborn.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "66e6547f22d43d6d149cac7a",
          "name": "RedCap Abuse | The 1st Pulse was deleted from OTX . AlienVault",
          "description": "Another example of target working with a hacker impersonating some7he.sje was not. The hackers had the perfect opportunity to stay attached to Dropbox, photos. microphone and highlighted heavily targets location. || Target was suspicious about several issues related to pair. Hacker has only one piece of equipment for project. Target basically had to give him all , tips, cues and direction for project. If this Pulse is deleted I don't know what to think.",
          "modified": "2024-10-15T02:02:53.504000",
          "created": "2024-09-15T03:29:03.699000",
          "tags": [
            "urls",
            "passive dns",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "process32nextw",
            "intel",
            "ms windows",
            "united",
            "pe32",
            "search",
            "module load",
            "t1129",
            "read c",
            "default",
            "path",
            "write",
            "malware",
            "copy",
            "win32",
            "suspicious",
            "unknown",
            "united kingdom",
            "set cookie",
            "as43350 nforce",
            "script urls",
            "as55286",
            "status",
            "cookie",
            "trojan",
            "template",
            "showing",
            "entries",
            "body",
            "ransom",
            "meta",
            "a div",
            "div div",
            "ipv4",
            "script script",
            "as16276",
            "france unknown",
            "link",
            "span a",
            "span span",
            "span",
            "class",
            "pragma",
            "servers",
            "creation date",
            "emails",
            "domain",
            "expiration date",
            "cname",
            "aaaa",
            "certificate",
            "lowfitrojan",
            "hstr",
            "jsauto25 jun",
            "pm lowfitrojan",
            "related pulses",
            "file samples",
            "files matching",
            "show",
            "endpoints all",
            "trojan features",
            "date hash",
            "as15169 google",
            "as44273 host",
            "september",
            "de indicators",
            "domains",
            "hashes",
            "dynamicloader",
            "yara detections",
            "enigmaprotector",
            "high",
            "bios",
            "dynamic",
            "filehash",
            "yaxpax",
            "yapaxi",
            "zp6axi0",
            "cuckoo",
            "name servers",
            "domains ii",
            "for privacy",
            "redacted for",
            "next",
            "domain address",
            "alienvault name",
            "server",
            "flag",
            "contacted hosts",
            "process details",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "exit node",
            "traffic group",
            "suricata",
            "overview ip",
            "address",
            "files location",
            "flag united",
            "hostname",
            "files domain",
            "months ago",
            "created",
            "email",
            "modified",
            "filehashsha1",
            "filehashsha256",
            "white cve",
            "cyber",
            "xamzexpires300",
            "twitter",
            "xor ddos",
            "xorddos",
            "hacktool",
            "bazaarloader",
            "redcap",
            "formbook",
            "locky",
            "lockbit",
            "ransomware",
            "target",
            "ebury",
            "virustotal",
            "crypter",
            "shadowpad",
            "corrupt",
            "cryptor",
            "android",
            "xrat",
            "xtrat",
            "malicious",
            "honeypot",
            "fraud",
            "already",
            "behav",
            "ragnar locker",
            "swipper",
            "n\u2205 ip",
            "write c",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "execution",
            "dock",
            "persistence",
            "august",
            "asnone bulgaria",
            "sales",
            "algorithm",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "whois lookups",
            "dnssec",
            "domain name",
            "abuse contact",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "date",
            "dns replication",
            "record type",
            "ttl value",
            "msms33388520",
            "data",
            "cus starizona",
            "cngo daddy",
            "authority",
            "g2 validity"
          ],
          "references": [
            "TrojanSpy:Win32/Nivdort.DE",
            "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
            "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
            "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
            "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
            "Alerts: nids_malware_alert network_icmp persistence_autorun"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Ransom:Win32/Haperlock",
              "display_name": "Ransom:Win32/Haperlock",
              "target": "/malware/Ransom:Win32/Haperlock"
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_ade36583",
              "display_name": "ALF:Trojan:Win32/Cassini_ade36583",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
              "target": null
            },
            {
              "id": "Ransom:Win32/Wannaren",
              "display_name": "Ransom:Win32/Wannaren",
              "target": "/malware/Ransom:Win32/Wannaren"
            },
            {
              "id": "#LowfiTrojan:JS/Auto25",
              "display_name": "#LowfiTrojan:JS/Auto25",
              "target": "/malware/#LowfiTrojan:JS/Auto25"
            },
            {
              "id": "Trojan:Win32/Startpage",
              "display_name": "Trojan:Win32/Startpage",
              "target": "/malware/Trojan:Win32/Startpage"
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
              "target": null
            },
            {
              "id": "Win.Packed.XtremeRAT-9837419-0",
              "display_name": "Win.Packed.XtremeRAT-9837419-0",
              "target": null
            },
            {
              "id": "Win.Packed.Kelios-10023944-0",
              "display_name": "Win.Packed.Kelios-10023944-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Unruy-5885",
              "display_name": "Win.Trojan.Unruy-5885",
              "target": null
            },
            {
              "id": "Ebury",
              "display_name": "Ebury",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Swipper",
              "display_name": "Swipper",
              "target": null
            },
            {
              "id": "N\u2205 IP",
              "display_name": "N\u2205 IP",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.DE",
              "display_name": "TrojanSpy:Win32/Nivdort.DE",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [
            "Government",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4315,
            "FileHash-MD5": 573,
            "FileHash-SHA1": 550,
            "FileHash-SHA256": 4114,
            "domain": 4757,
            "hostname": 2075,
            "SSLCertFingerprint": 5,
            "email": 14,
            "CIDR": 1
          },
          "indicator_count": 16404,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "551 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b759cf57d491a9dcca8c17",
          "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
          "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
          "modified": "2024-10-08T11:00:59.828000",
          "created": "2024-08-10T12:15:11.526000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "yoda",
            "crypter",
            "win16 ne",
            "os2 executable",
            "sections",
            "md5 upx0",
            "upx1",
            "upx2",
            "downloads",
            "http posts",
            "mitre att",
            "evasion ta0005",
            "ta0006 input",
            "capture t1056",
            "remote system",
            "discovery t1018",
            "reads",
            "discovery t1082",
            "windows nt",
            "get http",
            "request",
            "pragma",
            "response",
            "memory pattern",
            "g2 tls",
            "rsa sha256",
            "ca1 odigicert",
            "inc cus",
            "hashes",
            "peexe",
            "deleted c",
            "files dropped",
            "json",
            "registry keys",
            "ssl protocol",
            "de ff",
            "c4 a6",
            "fe b9",
            "d7 e8",
            "ed f6",
            "c5 c1",
            "dd f1",
            "e0 ee",
            "dword",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "windir",
            "runtime modules",
            "urls",
            "ip detections",
            "country",
            "us a83f81100",
            "microsoft stuff",
            "malicious proxy",
            "june",
            "referrer",
            "historical ssl",
            "threat roundup",
            "domains",
            "threat network",
            "tracker radar",
            "hunting service",
            "vt ransomware",
            "malicious",
            "ermac",
            "probe",
            "vhash",
            "authentihash",
            "rich pe",
            "ssdeep",
            "magic pe32",
            "trid upx",
            "portable",
            "info compiler",
            "products",
            "vs2008",
            "vs2010 sp1",
            "vs2010",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "registrar",
            "csc corporate",
            "markmonitor inc",
            "ta0009 command",
            "control ta0011",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "command",
            "control ob0004",
            "defense evasion",
            "sample",
            "upx software",
            "upx packed",
            "evasion t1497",
            "may sleep",
            "packing f0001",
            "evasion b0003",
            "f0001 upx",
            "ob0006 software",
            "file",
            "post http",
            "hashes c2ae",
            "capa",
            "cape sandbox",
            "zenbox",
            "user",
            "files deleted",
            "files",
            "calls",
            "as15169 google",
            "united",
            "status",
            "date",
            "name servers",
            "cname",
            "passive dns",
            "search",
            "record value",
            "next",
            "error",
            "code",
            "unknown",
            "trojan",
            "found",
            "gmt contenttype",
            "sameorigin",
            "all scoreblue",
            "trojandropper",
            "matches rule",
            "et info",
            "generic http",
            "exe upload",
            "vtapi",
            "emails",
            "servers",
            "aaaa",
            "domain",
            "as13414 twitter",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "virtool",
            "mirai",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "borpa loading",
            "expiration",
            "url https",
            "akamai rank",
            "hostname",
            "twitter",
            "tsara brashears",
            "ip address",
            "pe resource",
            "apple ios",
            "threats",
            "malware",
            "scripts",
            "norton",
            "excel",
            "hacktool",
            "problem",
            "njrat",
            "ransomware",
            "open",
            "samples",
            "url http",
            "vercel",
            "server attack",
            "yara detections",
            "push",
            "scan endpoints",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "code overlap",
            "related pulses",
            "top source",
            "top destination",
            "source source",
            "copy",
            "host",
            "contentlength",
            "malware beacon",
            "show",
            "entries",
            "cape",
            "write",
            "expiration date",
            "tulach topic",
            "brian sabey",
            "hallrender",
            "apple id",
            "malicious url",
            "tag count",
            "tld count",
            "detection list",
            "blacklist https",
            "count blacklist",
            "tag tag",
            "no data",
            "tld aggregation",
            "combined",
            "contact",
            "as206834 team",
            "canada unknown",
            "div div",
            "redacted for",
            "unknown xn",
            "script script",
            "msie",
            "chrome",
            "precondition",
            "mtb oct",
            "body",
            "worm",
            "trojanspy",
            "xpire.info",
            "searchmeup",
            "as61969 team",
            "creation date",
            "domain robot",
            "win32",
            "et smtp",
            "message",
            "high",
            "mailrubar",
            "trojanclicker",
            "parking crew",
            "parking logic",
            "category",
            "trojan features",
            "file samples",
            "files matching",
            "date hash",
            "showing",
            "creates largekey",
            "threat sniper",
            "crouching yeti",
            "kitten",
            "camaro dragon",
            "google phish",
            "macros",
            "hiddentear",
            "plugins",
            "removes headers",
            "hitmen"
          ],
          "references": [
            "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
            "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
            "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
            "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "https://fixupx.com/Yoda4ever/status/1819058165264404527",
            "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
            "http://borpatoken.com/ borpatoken.com",
            "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
            "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
            "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
            "X Vercel Servers",
            "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
            "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
            "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
            "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
            "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
            "Vtapi: scanter.comwww.twitter.comx.com",
            "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
            "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
            "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
            "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
            "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Win.Trojan.Occamy",
              "display_name": "Win.Trojan.Occamy",
              "target": null
            },
            {
              "id": "W32.AIDetectMalware",
              "display_name": "W32.AIDetectMalware",
              "target": null
            },
            {
              "id": "Trojan.Vtflooder/Vflooder",
              "display_name": "Trojan.Vtflooder/Vflooder",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan:Win32/Vflooder.A",
              "display_name": "Trojan:Win32/Vflooder.A",
              "target": "/malware/Trojan:Win32/Vflooder.A"
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Xpire.info",
              "display_name": "Xpire.info",
              "target": null
            },
            {
              "id": "Searchmeup",
              "display_name": "Searchmeup",
              "target": null
            },
            {
              "id": "Trojan:Win32/Trickler",
              "display_name": "Trojan:Win32/Trickler",
              "target": "/malware/Trojan:Win32/Trickler"
            },
            {
              "id": "Trojan:Win32/Comame",
              "display_name": "Trojan:Win32/Comame",
              "target": "/malware/Trojan:Win32/Comame"
            },
            {
              "id": "#VirTool:Win32/Obfuscator",
              "display_name": "#VirTool:Win32/Obfuscator",
              "target": "/malware/#VirTool:Win32/Obfuscator"
            },
            {
              "id": "Trojan:Win32/Pariham",
              "display_name": "Trojan:Win32/Pariham",
              "target": "/malware/Trojan:Win32/Pariham"
            }
          ],
          "attack_ids": [
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 55,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1943,
            "FileHash-SHA1": 1637,
            "FileHash-SHA256": 3321,
            "URL": 1014,
            "domain": 645,
            "hostname": 1472,
            "email": 7,
            "CVE": 2
          },
          "indicator_count": 10041,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "558 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b75a315eac0ff46fa4510d",
          "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
          "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
          "modified": "2024-10-08T11:00:59.828000",
          "created": "2024-08-10T12:16:49.869000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "yoda",
            "crypter",
            "win16 ne",
            "os2 executable",
            "sections",
            "md5 upx0",
            "upx1",
            "upx2",
            "downloads",
            "http posts",
            "mitre att",
            "evasion ta0005",
            "ta0006 input",
            "capture t1056",
            "remote system",
            "discovery t1018",
            "reads",
            "discovery t1082",
            "windows nt",
            "get http",
            "request",
            "pragma",
            "response",
            "memory pattern",
            "g2 tls",
            "rsa sha256",
            "ca1 odigicert",
            "inc cus",
            "hashes",
            "peexe",
            "deleted c",
            "files dropped",
            "json",
            "registry keys",
            "ssl protocol",
            "de ff",
            "c4 a6",
            "fe b9",
            "d7 e8",
            "ed f6",
            "c5 c1",
            "dd f1",
            "e0 ee",
            "dword",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "windir",
            "runtime modules",
            "urls",
            "ip detections",
            "country",
            "us a83f81100",
            "microsoft stuff",
            "malicious proxy",
            "june",
            "referrer",
            "historical ssl",
            "threat roundup",
            "domains",
            "threat network",
            "tracker radar",
            "hunting service",
            "vt ransomware",
            "malicious",
            "ermac",
            "probe",
            "vhash",
            "authentihash",
            "rich pe",
            "ssdeep",
            "magic pe32",
            "trid upx",
            "portable",
            "info compiler",
            "products",
            "vs2008",
            "vs2010 sp1",
            "vs2010",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "registrar",
            "csc corporate",
            "markmonitor inc",
            "ta0009 command",
            "control ta0011",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "command",
            "control ob0004",
            "defense evasion",
            "sample",
            "upx software",
            "upx packed",
            "evasion t1497",
            "may sleep",
            "packing f0001",
            "evasion b0003",
            "f0001 upx",
            "ob0006 software",
            "file",
            "post http",
            "hashes c2ae",
            "capa",
            "cape sandbox",
            "zenbox",
            "user",
            "files deleted",
            "files",
            "calls",
            "as15169 google",
            "united",
            "status",
            "date",
            "name servers",
            "cname",
            "passive dns",
            "search",
            "record value",
            "next",
            "error",
            "code",
            "unknown",
            "trojan",
            "found",
            "gmt contenttype",
            "sameorigin",
            "all scoreblue",
            "trojandropper",
            "matches rule",
            "et info",
            "generic http",
            "exe upload",
            "vtapi",
            "emails",
            "servers",
            "aaaa",
            "domain",
            "as13414 twitter",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "virtool",
            "mirai",
            "analyzer paste",
            "iocs",
            "hostnames",
            "urls https",
            "borpa loading",
            "expiration",
            "url https",
            "akamai rank",
            "hostname",
            "twitter",
            "tsara brashears",
            "ip address",
            "pe resource",
            "apple ios",
            "threats",
            "malware",
            "scripts",
            "norton",
            "excel",
            "hacktool",
            "problem",
            "njrat",
            "ransomware",
            "open",
            "samples",
            "url http",
            "vercel",
            "server attack",
            "yara detections",
            "push",
            "scan endpoints",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "code overlap",
            "related pulses",
            "top source",
            "top destination",
            "source source",
            "copy",
            "host",
            "contentlength",
            "malware beacon",
            "show",
            "entries",
            "cape",
            "write",
            "expiration date",
            "tulach topic",
            "brian sabey",
            "hallrender",
            "apple id",
            "malicious url",
            "tag count",
            "tld count",
            "detection list",
            "blacklist https",
            "count blacklist",
            "tag tag",
            "no data",
            "tld aggregation",
            "combined",
            "contact",
            "as206834 team",
            "canada unknown",
            "div div",
            "redacted for",
            "unknown xn",
            "script script",
            "msie",
            "chrome",
            "precondition",
            "mtb oct",
            "body",
            "worm",
            "trojanspy",
            "xpire.info",
            "searchmeup",
            "as61969 team",
            "creation date",
            "domain robot",
            "win32",
            "et smtp",
            "message",
            "high",
            "mailrubar",
            "trojanclicker",
            "parking crew",
            "parking logic",
            "category",
            "trojan features",
            "file samples",
            "files matching",
            "date hash",
            "showing",
            "creates largekey",
            "threat sniper",
            "crouching yeti",
            "kitten",
            "camaro dragon",
            "google phish",
            "macros",
            "hiddentear",
            "plugins",
            "removes headers",
            "hitmen"
          ],
          "references": [
            "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
            "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
            "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
            "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
            "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
            "https://fixupx.com/Yoda4ever/status/1819058165264404527",
            "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
            "http://borpatoken.com/ borpatoken.com",
            "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
            "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
            "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
            "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
            "X Vercel Servers",
            "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
            "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
            "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
            "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
            "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
            "Vtapi: scanter.comwww.twitter.comx.com",
            "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
            "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
            "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
            "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
            "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Win.Trojan.Occamy",
              "display_name": "Win.Trojan.Occamy",
              "target": null
            },
            {
              "id": "W32.AIDetectMalware",
              "display_name": "W32.AIDetectMalware",
              "target": null
            },
            {
              "id": "Trojan.Vtflooder/Vflooder",
              "display_name": "Trojan.Vtflooder/Vflooder",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan:Win32/Vflooder.A",
              "display_name": "Trojan:Win32/Vflooder.A",
              "target": "/malware/Trojan:Win32/Vflooder.A"
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Xpire.info",
              "display_name": "Xpire.info",
              "target": null
            },
            {
              "id": "Searchmeup",
              "display_name": "Searchmeup",
              "target": null
            },
            {
              "id": "Trojan:Win32/Trickler",
              "display_name": "Trojan:Win32/Trickler",
              "target": "/malware/Trojan:Win32/Trickler"
            },
            {
              "id": "Trojan:Win32/Comame",
              "display_name": "Trojan:Win32/Comame",
              "target": "/malware/Trojan:Win32/Comame"
            },
            {
              "id": "#VirTool:Win32/Obfuscator",
              "display_name": "#VirTool:Win32/Obfuscator",
              "target": "/malware/#VirTool:Win32/Obfuscator"
            },
            {
              "id": "Trojan:Win32/Pariham",
              "display_name": "Trojan:Win32/Pariham",
              "target": "/malware/Trojan:Win32/Pariham"
            }
          ],
          "attack_ids": [
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 57,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1943,
            "FileHash-SHA1": 1637,
            "FileHash-SHA256": 3321,
            "URL": 1030,
            "domain": 646,
            "hostname": 1473,
            "email": 7,
            "CVE": 2
          },
          "indicator_count": 10059,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "558 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be56d257bb241c4fa3f68d",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:02.291000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be56d6df9d36bac14ccd87",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:06.808000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8134,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "61dfd76cee14f5a2fcc735f5",
          "name": "NewDom-0-20220113",
          "description": "ICANN-Dom",
          "modified": "2022-02-27T00:00:44.135000",
          "created": "2022-01-13T07:40:28.510000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 203,
          "modified_text": "1512 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        }
      ],
      "references": [
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "static-push-preprod.porndig.com",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
        "youramateuporn.com",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "ns2.abovedomains.com",
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "TrojanSpy:Win32/Nivdort.DE",
        "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "mwilliams.dev@gmail.com | piratepages.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
        "Alerts: nids_malware_alert network_icmp persistence_autorun",
        "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
        "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
        "Vtapi: scanter.comwww.twitter.comx.com",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
        "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
        "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "dropboxpayments.com",
        "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
        "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
        "pirateproxy.cc",
        "weconnect.com",
        "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
        "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
        "https://severeporn-com.pornproxy.page/",
        "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
        "24-70mm.camera",
        "campaign-manager.sharecare.com",
        "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
        "jimgaffigan.com",
        "X Vercel Servers",
        "watchhers.net",
        "www.anyxxxtube.net",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "imp.fusioninstall.com",
        "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
        "cdn.pornsocket.com",
        "https://mylegalbid.com/malwarebytes",
        "https://twitter.com/PORNO_SEXYBABES",
        "www.redtube.comyouporn.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "http://45.159.189.105/bot/regex",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "qa.companycam.com",
        "ww16.porn-community.porn25.com",
        "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
        "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "cams4all.com",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e",
        "yoursexy.porn | indianyouporn.com",
        "http://borpatoken.com/ borpatoken.com",
        "https://fixupx.com/Yoda4ever/status/1819058165264404527",
        "xhamster.comyouporn.com",
        "838114.parkingcrew.net",
        "qbot.zip",
        "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
        "http://xred.mooo.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "#virtool:win32/obfuscator",
            "Possible",
            "Ransom:win32/haperlock",
            "Formbook",
            "Malware",
            "Win.trojan.unruy-5885",
            "Trojanspy",
            "Locky",
            "Azorult cnc",
            "#lowfitrojan:js/auto25",
            "Searchmeup",
            "Trojan:win32/startpage",
            "Trojan:win32/comame",
            "Swipper",
            "Virtool",
            "W32.aidetectmalware",
            "Xpire.info",
            "Win.packed.kelios-10023944-0",
            "Ebury",
            "N\u2205 ip",
            "Ransom:win32/wannaren",
            "Win.packed.xtremerat-9837419-0",
            "Trojan:win32/vflooder.a",
            "Alf:heraklezeval:trojandownloader:win32/unruy",
            "Alf:heraklezeval:trojandownloader:win32/unruy!rfn",
            "Trojan:win32/pariham",
            "Trojan:win32/trickler",
            "Mirai",
            "Win.trojan.occamy",
            "Trojanspy:win32/nivdort.de",
            "Alf:trojan:win32/cassini_ade36583",
            "Trojan.vtflooder/vflooder",
            "Adware affiliate"
          ],
          "industries": [
            "Government",
            "Healthcare"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "66e6547f22d43d6d149cac7a",
      "name": "RedCap Abuse | The 1st Pulse was deleted from OTX . AlienVault",
      "description": "Another example of target working with a hacker impersonating some7he.sje was not. The hackers had the perfect opportunity to stay attached to Dropbox, photos. microphone and highlighted heavily targets location. || Target was suspicious about several issues related to pair. Hacker has only one piece of equipment for project. Target basically had to give him all , tips, cues and direction for project. If this Pulse is deleted I don't know what to think.",
      "modified": "2024-10-15T02:02:53.504000",
      "created": "2024-09-15T03:29:03.699000",
      "tags": [
        "urls",
        "passive dns",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "process32nextw",
        "intel",
        "ms windows",
        "united",
        "pe32",
        "search",
        "module load",
        "t1129",
        "read c",
        "default",
        "path",
        "write",
        "malware",
        "copy",
        "win32",
        "suspicious",
        "unknown",
        "united kingdom",
        "set cookie",
        "as43350 nforce",
        "script urls",
        "as55286",
        "status",
        "cookie",
        "trojan",
        "template",
        "showing",
        "entries",
        "body",
        "ransom",
        "meta",
        "a div",
        "div div",
        "ipv4",
        "script script",
        "as16276",
        "france unknown",
        "link",
        "span a",
        "span span",
        "span",
        "class",
        "pragma",
        "servers",
        "creation date",
        "emails",
        "domain",
        "expiration date",
        "cname",
        "aaaa",
        "certificate",
        "lowfitrojan",
        "hstr",
        "jsauto25 jun",
        "pm lowfitrojan",
        "related pulses",
        "file samples",
        "files matching",
        "show",
        "endpoints all",
        "trojan features",
        "date hash",
        "as15169 google",
        "as44273 host",
        "september",
        "de indicators",
        "domains",
        "hashes",
        "dynamicloader",
        "yara detections",
        "enigmaprotector",
        "high",
        "bios",
        "dynamic",
        "filehash",
        "yaxpax",
        "yapaxi",
        "zp6axi0",
        "cuckoo",
        "name servers",
        "domains ii",
        "for privacy",
        "redacted for",
        "next",
        "domain address",
        "alienvault name",
        "server",
        "flag",
        "contacted hosts",
        "process details",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "exit node",
        "traffic group",
        "suricata",
        "overview ip",
        "address",
        "files location",
        "flag united",
        "hostname",
        "files domain",
        "months ago",
        "created",
        "email",
        "modified",
        "filehashsha1",
        "filehashsha256",
        "white cve",
        "cyber",
        "xamzexpires300",
        "twitter",
        "xor ddos",
        "xorddos",
        "hacktool",
        "bazaarloader",
        "redcap",
        "formbook",
        "locky",
        "lockbit",
        "ransomware",
        "target",
        "ebury",
        "virustotal",
        "crypter",
        "shadowpad",
        "corrupt",
        "cryptor",
        "android",
        "xrat",
        "xtrat",
        "malicious",
        "honeypot",
        "fraud",
        "already",
        "behav",
        "ragnar locker",
        "swipper",
        "n\u2205 ip",
        "write c",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "execution",
        "dock",
        "persistence",
        "august",
        "asnone bulgaria",
        "sales",
        "algorithm",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "first",
        "whois lookups",
        "dnssec",
        "domain name",
        "abuse contact",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "date",
        "dns replication",
        "record type",
        "ttl value",
        "msms33388520",
        "data",
        "cus starizona",
        "cngo daddy",
        "authority",
        "g2 validity"
      ],
      "references": [
        "TrojanSpy:Win32/Nivdort.DE",
        "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn: FileHash-SHA256  00018d13f451300fb839123dfbf2d8607da0e7b1c89ae1bfbb9946ac79c1663c",
        "IDS Detections: Win32/Unruy Rogue Search Host Observed 1",
        "Yara Detections: Nrv2x ,  UPX_OEP_place ,  UPX_Modified_Or_Inside ,  UPX20030XMarkusOberhumerLaszloMolnarJohnReiser",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser",
        "Alerts: nids_malware_alert network_icmp persistence_autorun"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Ransom:Win32/Haperlock",
          "display_name": "Ransom:Win32/Haperlock",
          "target": "/malware/Ransom:Win32/Haperlock"
        },
        {
          "id": "ALF:Trojan:Win32/Cassini_ade36583",
          "display_name": "ALF:Trojan:Win32/Cassini_ade36583",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy!rfn",
          "target": null
        },
        {
          "id": "Ransom:Win32/Wannaren",
          "display_name": "Ransom:Win32/Wannaren",
          "target": "/malware/Ransom:Win32/Wannaren"
        },
        {
          "id": "#LowfiTrojan:JS/Auto25",
          "display_name": "#LowfiTrojan:JS/Auto25",
          "target": "/malware/#LowfiTrojan:JS/Auto25"
        },
        {
          "id": "Trojan:Win32/Startpage",
          "display_name": "Trojan:Win32/Startpage",
          "target": "/malware/Trojan:Win32/Startpage"
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:Win32/Unruy",
          "target": null
        },
        {
          "id": "Win.Packed.XtremeRAT-9837419-0",
          "display_name": "Win.Packed.XtremeRAT-9837419-0",
          "target": null
        },
        {
          "id": "Win.Packed.Kelios-10023944-0",
          "display_name": "Win.Packed.Kelios-10023944-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Unruy-5885",
          "display_name": "Win.Trojan.Unruy-5885",
          "target": null
        },
        {
          "id": "Ebury",
          "display_name": "Ebury",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Swipper",
          "display_name": "Swipper",
          "target": null
        },
        {
          "id": "N\u2205 IP",
          "display_name": "N\u2205 IP",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.DE",
          "display_name": "TrojanSpy:Win32/Nivdort.DE",
          "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [
        "Government",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4315,
        "FileHash-MD5": 573,
        "FileHash-SHA1": 550,
        "FileHash-SHA256": 4114,
        "domain": 4757,
        "hostname": 2075,
        "SSLCertFingerprint": 5,
        "email": 14,
        "CIDR": 1
      },
      "indicator_count": 16404,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "551 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b759cf57d491a9dcca8c17",
      "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
      "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
      "modified": "2024-10-08T11:00:59.828000",
      "created": "2024-08-10T12:15:11.526000",
      "tags": [
        "win32 exe",
        "pe32",
        "intel",
        "ms windows",
        "yoda",
        "crypter",
        "win16 ne",
        "os2 executable",
        "sections",
        "md5 upx0",
        "upx1",
        "upx2",
        "downloads",
        "http posts",
        "mitre att",
        "evasion ta0005",
        "ta0006 input",
        "capture t1056",
        "remote system",
        "discovery t1018",
        "reads",
        "discovery t1082",
        "windows nt",
        "get http",
        "request",
        "pragma",
        "response",
        "memory pattern",
        "g2 tls",
        "rsa sha256",
        "ca1 odigicert",
        "inc cus",
        "hashes",
        "peexe",
        "deleted c",
        "files dropped",
        "json",
        "registry keys",
        "ssl protocol",
        "de ff",
        "c4 a6",
        "fe b9",
        "d7 e8",
        "ed f6",
        "c5 c1",
        "dd f1",
        "e0 ee",
        "dword",
        "samplepath",
        "process",
        "created",
        "shell commands",
        "windir",
        "runtime modules",
        "urls",
        "ip detections",
        "country",
        "us a83f81100",
        "microsoft stuff",
        "malicious proxy",
        "june",
        "referrer",
        "historical ssl",
        "threat roundup",
        "domains",
        "threat network",
        "tracker radar",
        "hunting service",
        "vt ransomware",
        "malicious",
        "ermac",
        "probe",
        "vhash",
        "authentihash",
        "rich pe",
        "ssdeep",
        "magic pe32",
        "trid upx",
        "portable",
        "info compiler",
        "products",
        "vs2008",
        "vs2010 sp1",
        "vs2010",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "registrar",
        "csc corporate",
        "markmonitor inc",
        "ta0009 command",
        "control ta0011",
        "catalog tree",
        "analysis ob0001",
        "analysis ob0002",
        "command",
        "control ob0004",
        "defense evasion",
        "sample",
        "upx software",
        "upx packed",
        "evasion t1497",
        "may sleep",
        "packing f0001",
        "evasion b0003",
        "f0001 upx",
        "ob0006 software",
        "file",
        "post http",
        "hashes c2ae",
        "capa",
        "cape sandbox",
        "zenbox",
        "user",
        "files deleted",
        "files",
        "calls",
        "as15169 google",
        "united",
        "status",
        "date",
        "name servers",
        "cname",
        "passive dns",
        "search",
        "record value",
        "next",
        "error",
        "code",
        "unknown",
        "trojan",
        "found",
        "gmt contenttype",
        "sameorigin",
        "all scoreblue",
        "trojandropper",
        "matches rule",
        "et info",
        "generic http",
        "exe upload",
        "vtapi",
        "emails",
        "servers",
        "aaaa",
        "domain",
        "as13414 twitter",
        "backdoor",
        "ipv4",
        "pulse pulses",
        "virtool",
        "mirai",
        "analyzer paste",
        "iocs",
        "hostnames",
        "urls https",
        "borpa loading",
        "expiration",
        "url https",
        "akamai rank",
        "hostname",
        "twitter",
        "tsara brashears",
        "ip address",
        "pe resource",
        "apple ios",
        "threats",
        "malware",
        "scripts",
        "norton",
        "excel",
        "hacktool",
        "problem",
        "njrat",
        "ransomware",
        "open",
        "samples",
        "url http",
        "vercel",
        "server attack",
        "yara detections",
        "push",
        "scan endpoints",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "code overlap",
        "related pulses",
        "top source",
        "top destination",
        "source source",
        "copy",
        "host",
        "contentlength",
        "malware beacon",
        "show",
        "entries",
        "cape",
        "write",
        "expiration date",
        "tulach topic",
        "brian sabey",
        "hallrender",
        "apple id",
        "malicious url",
        "tag count",
        "tld count",
        "detection list",
        "blacklist https",
        "count blacklist",
        "tag tag",
        "no data",
        "tld aggregation",
        "combined",
        "contact",
        "as206834 team",
        "canada unknown",
        "div div",
        "redacted for",
        "unknown xn",
        "script script",
        "msie",
        "chrome",
        "precondition",
        "mtb oct",
        "body",
        "worm",
        "trojanspy",
        "xpire.info",
        "searchmeup",
        "as61969 team",
        "creation date",
        "domain robot",
        "win32",
        "et smtp",
        "message",
        "high",
        "mailrubar",
        "trojanclicker",
        "parking crew",
        "parking logic",
        "category",
        "trojan features",
        "file samples",
        "files matching",
        "date hash",
        "showing",
        "creates largekey",
        "threat sniper",
        "crouching yeti",
        "kitten",
        "camaro dragon",
        "google phish",
        "macros",
        "hiddentear",
        "plugins",
        "removes headers",
        "hitmen"
      ],
      "references": [
        "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
        "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
        "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
        "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "https://fixupx.com/Yoda4ever/status/1819058165264404527",
        "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
        "http://borpatoken.com/ borpatoken.com",
        "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
        "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
        "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
        "X Vercel Servers",
        "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
        "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
        "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
        "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
        "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
        "Vtapi: scanter.comwww.twitter.comx.com",
        "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
        "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
        "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
        "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
        "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Win.Trojan.Occamy",
          "display_name": "Win.Trojan.Occamy",
          "target": null
        },
        {
          "id": "W32.AIDetectMalware",
          "display_name": "W32.AIDetectMalware",
          "target": null
        },
        {
          "id": "Trojan.Vtflooder/Vflooder",
          "display_name": "Trojan.Vtflooder/Vflooder",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan:Win32/Vflooder.A",
          "display_name": "Trojan:Win32/Vflooder.A",
          "target": "/malware/Trojan:Win32/Vflooder.A"
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Xpire.info",
          "display_name": "Xpire.info",
          "target": null
        },
        {
          "id": "Searchmeup",
          "display_name": "Searchmeup",
          "target": null
        },
        {
          "id": "Trojan:Win32/Trickler",
          "display_name": "Trojan:Win32/Trickler",
          "target": "/malware/Trojan:Win32/Trickler"
        },
        {
          "id": "Trojan:Win32/Comame",
          "display_name": "Trojan:Win32/Comame",
          "target": "/malware/Trojan:Win32/Comame"
        },
        {
          "id": "#VirTool:Win32/Obfuscator",
          "display_name": "#VirTool:Win32/Obfuscator",
          "target": "/malware/#VirTool:Win32/Obfuscator"
        },
        {
          "id": "Trojan:Win32/Pariham",
          "display_name": "Trojan:Win32/Pariham",
          "target": "/malware/Trojan:Win32/Pariham"
        }
      ],
      "attack_ids": [
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 55,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1943,
        "FileHash-SHA1": 1637,
        "FileHash-SHA256": 3321,
        "URL": 1014,
        "domain": 645,
        "hostname": 1472,
        "email": 7,
        "CVE": 2
      },
      "indicator_count": 10041,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "558 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b75a315eac0ff46fa4510d",
      "name": "Yoda Crypter | Vtapi Virustotal Ransomware | X.Com |  Twitter | Remote Job",
      "description": "Miscellaneous Virustotal attack found. A malicious hash found while researching a malicious Twitter template regarding post found re: otx.alienvault.com pulse.\nFound BorpaToken [moved] attacking X Vercel servers, impacting Azure, impacts X.com, Google.com, YouTube, androids, apple id,  (otx seems impacted) with and /w/o header and every versions of related links, Malicious x.com 'REMOTELY' redirects to malicious Twitter templates with recognized names.",
      "modified": "2024-10-08T11:00:59.828000",
      "created": "2024-08-10T12:16:49.869000",
      "tags": [
        "win32 exe",
        "pe32",
        "intel",
        "ms windows",
        "yoda",
        "crypter",
        "win16 ne",
        "os2 executable",
        "sections",
        "md5 upx0",
        "upx1",
        "upx2",
        "downloads",
        "http posts",
        "mitre att",
        "evasion ta0005",
        "ta0006 input",
        "capture t1056",
        "remote system",
        "discovery t1018",
        "reads",
        "discovery t1082",
        "windows nt",
        "get http",
        "request",
        "pragma",
        "response",
        "memory pattern",
        "g2 tls",
        "rsa sha256",
        "ca1 odigicert",
        "inc cus",
        "hashes",
        "peexe",
        "deleted c",
        "files dropped",
        "json",
        "registry keys",
        "ssl protocol",
        "de ff",
        "c4 a6",
        "fe b9",
        "d7 e8",
        "ed f6",
        "c5 c1",
        "dd f1",
        "e0 ee",
        "dword",
        "samplepath",
        "process",
        "created",
        "shell commands",
        "windir",
        "runtime modules",
        "urls",
        "ip detections",
        "country",
        "us a83f81100",
        "microsoft stuff",
        "malicious proxy",
        "june",
        "referrer",
        "historical ssl",
        "threat roundup",
        "domains",
        "threat network",
        "tracker radar",
        "hunting service",
        "vt ransomware",
        "malicious",
        "ermac",
        "probe",
        "vhash",
        "authentihash",
        "rich pe",
        "ssdeep",
        "magic pe32",
        "trid upx",
        "portable",
        "info compiler",
        "products",
        "vs2008",
        "vs2010 sp1",
        "vs2010",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "registrar",
        "csc corporate",
        "markmonitor inc",
        "ta0009 command",
        "control ta0011",
        "catalog tree",
        "analysis ob0001",
        "analysis ob0002",
        "command",
        "control ob0004",
        "defense evasion",
        "sample",
        "upx software",
        "upx packed",
        "evasion t1497",
        "may sleep",
        "packing f0001",
        "evasion b0003",
        "f0001 upx",
        "ob0006 software",
        "file",
        "post http",
        "hashes c2ae",
        "capa",
        "cape sandbox",
        "zenbox",
        "user",
        "files deleted",
        "files",
        "calls",
        "as15169 google",
        "united",
        "status",
        "date",
        "name servers",
        "cname",
        "passive dns",
        "search",
        "record value",
        "next",
        "error",
        "code",
        "unknown",
        "trojan",
        "found",
        "gmt contenttype",
        "sameorigin",
        "all scoreblue",
        "trojandropper",
        "matches rule",
        "et info",
        "generic http",
        "exe upload",
        "vtapi",
        "emails",
        "servers",
        "aaaa",
        "domain",
        "as13414 twitter",
        "backdoor",
        "ipv4",
        "pulse pulses",
        "virtool",
        "mirai",
        "analyzer paste",
        "iocs",
        "hostnames",
        "urls https",
        "borpa loading",
        "expiration",
        "url https",
        "akamai rank",
        "hostname",
        "twitter",
        "tsara brashears",
        "ip address",
        "pe resource",
        "apple ios",
        "threats",
        "malware",
        "scripts",
        "norton",
        "excel",
        "hacktool",
        "problem",
        "njrat",
        "ransomware",
        "open",
        "samples",
        "url http",
        "vercel",
        "server attack",
        "yara detections",
        "push",
        "scan endpoints",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "code overlap",
        "related pulses",
        "top source",
        "top destination",
        "source source",
        "copy",
        "host",
        "contentlength",
        "malware beacon",
        "show",
        "entries",
        "cape",
        "write",
        "expiration date",
        "tulach topic",
        "brian sabey",
        "hallrender",
        "apple id",
        "malicious url",
        "tag count",
        "tld count",
        "detection list",
        "blacklist https",
        "count blacklist",
        "tag tag",
        "no data",
        "tld aggregation",
        "combined",
        "contact",
        "as206834 team",
        "canada unknown",
        "div div",
        "redacted for",
        "unknown xn",
        "script script",
        "msie",
        "chrome",
        "precondition",
        "mtb oct",
        "body",
        "worm",
        "trojanspy",
        "xpire.info",
        "searchmeup",
        "as61969 team",
        "creation date",
        "domain robot",
        "win32",
        "et smtp",
        "message",
        "high",
        "mailrubar",
        "trojanclicker",
        "parking crew",
        "parking logic",
        "category",
        "trojan features",
        "file samples",
        "files matching",
        "date hash",
        "showing",
        "creates largekey",
        "threat sniper",
        "crouching yeti",
        "kitten",
        "camaro dragon",
        "google phish",
        "macros",
        "hiddentear",
        "plugins",
        "removes headers",
        "hitmen"
      ],
      "references": [
        "trojan.vtflooder/vflooder FileHash-SHA256  e8d7208330c634fad06d1b12bfea92435cdd7e63d01fde5ed8f3493b9deefad4",
        "Crowdsourced IDS rules: Matches rule MALWARE-CNC Win.Trojan.Occamy variant outbound connection",
        "Crowdsourced IDS rules: Matches rule ET INFO Generic HTTP EXE Upload Outbound",
        "Crowdsourced IDS rules: Matches rule (stream_tcp) data sent on stream not accepting data",
        "Crowdsourced YARA rules: Matches rule UPX from ruleset UPX by kevoreilly",
        "https://fixupx.com/Yoda4ever/status/1819058165264404527",
        "Malicious IP: 1.3.6.1 ASNone  Generic.Malware has also been named in ransomware and other highly malicious attacks.",
        "http://borpatoken.com/ borpatoken.com",
        "Sourced: https://twitter.com/ootiosum/status/1812208222150726029a4dmHAxV0M0QIHawADl4Qr4kDegUI-QEQAA&usg=AOvVaw37yALadqlgoR9_xlQ5B4Hm",
        "This IP carried out Apache Log4j RCE attempt(s) (also known as CVE-2021-44228 or Log4Shell). @parthmaniar on Twitter",
        "For more information, or to report interesting/incorrect findings, give me a shoutout on @parthmaniar on Twitter.",
        "analytics.x.com | https://analytics.x.com | https://localhost.twitter.com:3443",
        "X Vercel Servers",
        "FileHash-MD5: b7e1dc2c46a9b972943a08b09c4dd6db",
        "FileHash-SHA1: d20959337b099526ed5250b60d9250ab865a7c6c",
        "FileHash-SHA256: 7b749ef9d91c1f0fe7513ece148409f2254317be8b0487603a2b333ebbb927ae",
        "Yara: RansomWin32Betisrypt , TrojanClickerWin32NightClick , TrojanDropperWin32Jscrpt , TrojanWin32Notepices TrojanClickerWin32NightClick",
        "apple.twitter.com | https://appleid.cdn-apple.com/appleauth/static/jsapi/appleid/1/en_US/appleid.auth.js | vine.co | appleid.cdn-apple.com",
        "Vtapi: scanter.comwww.twitter.comx.com",
        "IDS Detections: ETPRO TROJAN Possible Win32/Zbot.AHJ CnC Traffic ET SMTP Abuseat.org Block Message",
        "IDS Detections: ET TROJAN Pushdo v3 Checkin ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain",
        "Crypt3.BWVY: FileHash-SHA256  9235583481d06530ef1ce04fa4f9a3bf3b6735dcdef0486cf6181c7868c9c249",
        "Crypt3.BWVY: FileHash-SHA1  4c60cf6b7e2981f1c05c5a34f880c6020923014c",
        "Crypt3.BWVY: FileHash-MD5  947f28c8ab697548aca370c080187e6e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Win.Trojan.Occamy",
          "display_name": "Win.Trojan.Occamy",
          "target": null
        },
        {
          "id": "W32.AIDetectMalware",
          "display_name": "W32.AIDetectMalware",
          "target": null
        },
        {
          "id": "Trojan.Vtflooder/Vflooder",
          "display_name": "Trojan.Vtflooder/Vflooder",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan:Win32/Vflooder.A",
          "display_name": "Trojan:Win32/Vflooder.A",
          "target": "/malware/Trojan:Win32/Vflooder.A"
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Xpire.info",
          "display_name": "Xpire.info",
          "target": null
        },
        {
          "id": "Searchmeup",
          "display_name": "Searchmeup",
          "target": null
        },
        {
          "id": "Trojan:Win32/Trickler",
          "display_name": "Trojan:Win32/Trickler",
          "target": "/malware/Trojan:Win32/Trickler"
        },
        {
          "id": "Trojan:Win32/Comame",
          "display_name": "Trojan:Win32/Comame",
          "target": "/malware/Trojan:Win32/Comame"
        },
        {
          "id": "#VirTool:Win32/Obfuscator",
          "display_name": "#VirTool:Win32/Obfuscator",
          "target": "/malware/#VirTool:Win32/Obfuscator"
        },
        {
          "id": "Trojan:Win32/Pariham",
          "display_name": "Trojan:Win32/Pariham",
          "target": "/malware/Trojan:Win32/Pariham"
        }
      ],
      "attack_ids": [
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 57,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1943,
        "FileHash-SHA1": 1637,
        "FileHash-SHA256": 3321,
        "URL": 1030,
        "domain": 646,
        "hostname": 1473,
        "email": 7,
        "CVE": 2
      },
      "indicator_count": 10059,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "558 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be56d257bb241c4fa3f68d",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:02.291000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be56d6df9d36bac14ccd87",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:06.808000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8134,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "61dfd76cee14f5a2fcc735f5",
      "name": "NewDom-0-20220113",
      "description": "ICANN-Dom",
      "modified": "2022-02-27T00:00:44.135000",
      "created": "2022-01-13T07:40:28.510000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ZENDataGELowC",
        "id": "152785",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 203,
      "modified_text": "1512 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "10yearsofborn.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "10yearsofborn.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642511.124845
}