{
  "type": "Domain",
  "indicator": "absitsolution.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/absitsolution.com",
    "alexa": "http://www.alexa.com/siteinfo/absitsolution.com",
    "indicator": "absitsolution.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3415872543,
      "indicator": "absitsolution.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "658b9e86f7a149333882bfb9",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
          "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T03:48:22.319000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "658ca3f53717bb3a25e96065",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
          "description": "",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T22:23:49.562000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658b9e86f7a149333882bfb9",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7fc464f9f56ac33a389",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:32.030000",
          "created": "2023-12-06T16:57:32.030000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7e7daf278491d9f9eb4",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:11.228000",
          "created": "2023-12-06T16:57:11.228000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "652044fb2f28d46e91d29160",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:33:47.403000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65204565ac1e8bce4de26df3",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:35:33.618000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1df9a7da086561b9897f",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-30T03:07:37.963000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65204565ac1e8bce4de26df3",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "624adfd8836c5ad74f429333",
          "name": "NewDom-0-20220404",
          "description": "ICANN-Dom",
          "modified": "2022-05-19T00:00:49.028000",
          "created": "2022-04-04T12:08:56.912000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 203,
          "modified_text": "1431 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        }
      ],
      "references": [
        "Research and Data Analysis",
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Tulach"
          ],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "658b9e86f7a149333882bfb9",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
      "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T03:48:22.319000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "814 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "658ca3f53717bb3a25e96065",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
      "description": "",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T22:23:49.562000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658b9e86f7a149333882bfb9",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "814 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7fc464f9f56ac33a389",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:32.030000",
      "created": "2023-12-06T16:57:32.030000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7e7daf278491d9f9eb4",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:11.228000",
      "created": "2023-12-06T16:57:11.228000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "652044fb2f28d46e91d29160",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:33:47.403000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65204565ac1e8bce4de26df3",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:35:33.618000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f1df9a7da086561b9897f",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-30T03:07:37.963000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65204565ac1e8bce4de26df3",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "624adfd8836c5ad74f429333",
      "name": "NewDom-0-20220404",
      "description": "ICANN-Dom",
      "modified": "2022-05-19T00:00:49.028000",
      "created": "2022-04-04T12:08:56.912000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ZENDataGELowC",
        "id": "152785",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 203,
      "modified_text": "1431 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "absitsolution.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "absitsolution.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639782.218445
}