{
  "type": "Domain",
  "indicator": "acrobatrelay.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/acrobatrelay.com",
    "alexa": "http://www.alexa.com/siteinfo/acrobatrelay.com",
    "indicator": "acrobatrelay.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3359029579,
      "indicator": "acrobatrelay.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "62e3c158a4294a9068303b65",
          "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
          "description": "A European private-sector offensive actor (PSOA) has developed malware used in a series of targeted attacks against Microsoft customers in Europe and Central American countries from July 27, 2022, Microsoft has said.",
          "modified": "2022-07-29T11:15:35.820000",
          "created": "2022-07-29T11:15:35.820000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
          ],
          "public": 1,
          "adversary": "KNOTWEED",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 453,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 15,
            "domain": 3
          },
          "indicator_count": 30,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386479,
          "modified_text": "1401 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64dd9c1d76a7807782a691d3",
          "name": "IOC's found on my pesonal devices; week starting 08/14/23",
          "description": "I had wrapped the majority of the files i'd run since the 14th into the Pulse of the same date, but at over 17k indicators i think it was time to put that one to rest. Obviously time and life allowing my intention is to keep updating and creating more of these as long as i'm kept flush with content. At current i'm pretty damned flush. This is just a preliminary dump of my /tmp folder on Arch. part of the infection chain is process hallowing and then hijacking a program close to the user, with decent call ability to the rest of the system.",
          "modified": "2024-02-14T21:44:02.852000",
          "created": "2023-08-17T04:03:41.985000",
          "tags": [
            "o cloexec",
            "r procversion",
            "cachyos",
            "gnu ld",
            "gnu binutils",
            "microsoft",
            "f lockfd",
            "cygwin",
            "u respfd",
            "procselffd13",
            "procselffd14",
            "x8664",
            "uname",
            "linux",
            "getconf",
            "cpus32",
            "case",
            "m x8664",
            "s linux",
            "x8664 o",
            "z linux",
            "z x8664",
            "replying",
            "timing",
            "successfully",
            "shift",
            "procselffd16",
            "empty",
            "head",
            "dirty",
            "found",
            "splitting",
            "license",
            "index",
            "kill",
            "zfrm",
            "argv"
          ],
          "references": [
            ".ICE-unix",
            ".org.chromium.Chromium.12ZdF3",
            ".vbox-mrkd-ipc",
            "@tmp",
            ".org.chromium.Chromium.T2jdbS",
            ".X11-unix",
            "albert_yt_ynb2tftv",
            "fish.root",
            "20230816_202710-scantemp.b14ff4bc3a",
            "plasma-csd-generator.LTvjbT",
            "pytest-of-mrkd",
            "runtime-root",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-ananicy-cpp.service-U5RKxp",
            ".org.chromium.Chromium.coQnti",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-bluetooth.service-7fh2tg",
            "bauh@mrkd",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-iwd.service-jnpcHR",
            ".org.chromium.Chromium.8GBhMA",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-polkit.service-CfCUQZ",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-systemd-logind.service-Q9OYbj",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-power-profiles-daemon.service-hSCDr7",
            ".org.chromium.Chromium.HMzFxo",
            "Temp-0c3dc677-7d66-4234-b14e-f604605b2d0c",
            "tmp.D4NXyZ3U4J",
            "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-uksmd.service-oAjI9s",
            "Temp-0148ee46-b3e0-4c4b-aa55-b60c6b63eb6f",
            "tmp.ziktUZeKXL",
            "v8-compile-cache-0",
            "tmp90lfbdek",
            "tst-bz26353KOtJVp",
            "v8-compile-cache-1000",
            ".X0-lock",
            "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.xtrace.log",
            "Temp-4d7e99a7-2d45-4347-a3b6-b64e3ae65e2e",
            "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.8928.1692232861.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.10291.1692217508.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.11270.1692217597.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.12928.1692233448.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.13309.1692233456.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.28823.1692223670.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.23930.1692220492.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.241161.1692238939.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.240792.1692238921.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.268412.1692240156.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.317097.1692240795.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.xtrace.log",
            "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.345673.1692241474.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.daemon.log",
            "qtsingleapp-Notifi-4c42-3e8",
            "gitstatus.POWERLEVEL9K.1000.2588447.1692243345.1.xtrace.log",
            "memmemY_2MMv.c",
            "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.daemon.log",
            "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.xtrace.log",
            "qtsingleapp-Notifi-4c42-3e8-lockfile",
            "stdbool.hcc0B2j.c",
            "strlcatmMvE1V.c",
            "qtsingleapp-Octopi-1d88-3e8-lockfile",
            "strlcpydb8x03.c",
            "stdbool.ht64kj6qw.c",
            "qtsingleapp-Octopi-1d88-3e8",
            "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.daemon.log",
            "https://hybrid-analysis.com/sample/43b03483bf2b292ebb1b33469ab4b19e2ac84b1c86c0f34f60adab4bc64176b9",
            "https://hybrid-analysis.com/sample/320a60044adeccec22937423e859d2b095e976698133e37a83e019ce08c8bc0c",
            "https://hybrid-analysis.com/file-collection/64dfee6a3329552c91026445",
            "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca",
            "https://hybrid-analysis.com/sample/8c7c7246468ffeffe01617b597622cd237fa334fb24dc4977fcac398bbe0df80",
            "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/64dff1fbeab7dc252b0e56a6",
            "https://www.virustotal.com/gui/file/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/details",
            "https://otx.alienvault.com/indicator/file/5820da0bbae4f091dc0248e566d8f1076fd81485d1893effa14cdc1dc122f1fd"
          ],
          "public": 1,
          "adversary": "N/A",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "BV:TelegramBot-A\\ [Trj]",
              "display_name": "BV:TelegramBot-A\\ [Trj]",
              "target": null
            },
            {
              "id": "Ransom:Linux/DarkRadiation.A!MTB",
              "display_name": "Ransom:Linux/DarkRadiation.A!MTB",
              "target": "/malware/Ransom:Linux/DarkRadiation.A!MTB"
            },
            {
              "id": "SLF:MamacseMacro.A",
              "display_name": "SLF:MamacseMacro.A",
              "target": null
            },
            {
              "id": "TrojanDownloader:Linux/Morila!MTB",
              "display_name": "TrojanDownloader:Linux/Morila!MTB",
              "target": "/malware/TrojanDownloader:Linux/Morila!MTB"
            },
            {
              "id": "Backdoor:Win32/R2d2.A",
              "display_name": "Backdoor:Win32/R2d2.A",
              "target": "/malware/Backdoor:Win32/R2d2.A"
            },
            {
              "id": "Sf:ShellCode-DZ\\ [Trj]",
              "display_name": "Sf:ShellCode-DZ\\ [Trj]",
              "target": null
            },
            {
              "id": "NETexecutableMicrosoft",
              "display_name": "NETexecutableMicrosoft",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/FakeFlexnet.A",
              "display_name": "TrojanDropper:Win32/FakeFlexnet.A",
              "target": "/malware/TrojanDropper:Win32/FakeFlexnet.A"
            },
            {
              "id": "Delphi",
              "display_name": "Delphi",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "individuals"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Merkd1904",
            "id": "196517",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 206,
            "domain": 5129,
            "FileHash-MD5": 177,
            "FileHash-SHA1": 114,
            "URL": 646,
            "hostname": 2078,
            "CVE": 412,
            "email": 4
          },
          "indicator_count": 8766,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 82,
          "modified_text": "836 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709ffcf3ffe737f8cb8dfd",
          "name": "IOC's found on my pesonal devices; week starting 08/14/23",
          "description": "",
          "modified": "2023-12-06T16:23:24.919000",
          "created": "2023-12-06T16:23:24.919000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 103,
            "hostname": 524,
            "domain": 1292,
            "FileHash-SHA256": 95,
            "FileHash-MD5": 54,
            "FileHash-SHA1": 39,
            "URL": 169,
            "email": 1
          },
          "indicator_count": 2277,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "906 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "630741b693cf51e5abcd3eba",
          "name": "Domains - Threat Alert - KNOTWEED Threat Actor Utilizing Subzero Tool (FinTIP)",
          "description": "",
          "modified": "2022-08-25T09:32:38.268000",
          "created": "2022-08-25T09:32:38.268000",
          "tags": [],
          "references": [
            "Domains - Threat Alert - KNOTWEED Threat Actor Utilizing Subzero Tool (FinTIP).txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "arulieswaran",
            "id": "190549",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3
          },
          "indicator_count": 3,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 43,
          "modified_text": "1374 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62ec87661aa865f7f7791b8f",
          "name": "KNOTWEED\u653b\u51fb\u8005\u4f7f\u75280-day\u6f0f\u6d1e\u90e8\u7f72Subzero \u6076\u610f\u8f6f\u4ef6",
          "description": "\u8fd1\u65e5\uff0c\u5fae\u8f6f\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3\u79f0\uff0c\u4e00\u5bb6\u540d\u4e3aDSIRF\uff08\u5fae\u8f6f\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3\u5c06\u5176\u547d\u540d\u4e3aKNOTWEED\uff09\u7684\u5965\u5730\u5229\u516c\u53f8\u5f00\u53d1\u5e76\u9500\u552e\u4e86SubZero\u6076\u610f\u8f6f\u4ef6\uff0c\u8be5\u6076\u610f\u8f6f\u4ef6\u7684\u4e3b\u8981\u6709\u6548\u8f7d\u8377corelump\uff0c\u4e13\u95e8\u9a7b\u7559\u5728\u5185\u5b58\u4e2d\u4ee5\u9003\u907f\u68c0\u6d4b\uff0c\u5b83\u5305\u542b\u591a\u79cd\u529f\u80fd\uff0c\u5305\u62ec\u952e\u76d8\u8bb0\u5f55\u3001\u6355\u83b7\u5c4f\u5e55\u622a\u56fe\u3001\u6cc4\u9732\u6587\u4ef6\u3001\u8fd0\u884c\u8fdc\u7a0bshell\u4ee5\u53ca\u8fd0\u884c\u4ece KNOTWEED\u7684C2\u670d\u52a1\u5668\u4e0b\u8f7d\u7684\u4efb\u610f\u63d2\u4ef6\u3002\u53e6\u5916\uff0cKNOTWEED\u5728\u5176\u653b\u51fb\u6d3b\u52a8\u4e2d\u5229\u7528\u591a\u4e2a\u6f0f\u6d1e\u90e8\u7f72Subzero\u6076\u610f\u8f6f\u4ef6\uff0c\u5305\u62ecCVE-2022-22047\u6f0f\u6d1e\u3001\u7531\u4e24\u4e2a Windows \u63d0\u6743\u6f0f\u6d1e\uff08CVE-2021-31199 \u548c CVE-2021-31201\uff09\u548c\u4e00\u4e2a Adobe Reader \u6f0f\u6d1e\uff08CVE-2021-28550\uff09\u7ec4\u6210\u7684\u6f0f\u6d1e\u94fe\u3001\u4ee5\u53caCVE-2021-36948\u3002",
          "modified": "2022-08-05T03:00:41.704000",
          "created": "2022-08-05T02:58:46.499000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa",
            "mstic",
            "microsoft",
            "dsirf",
            "adobe reader",
            "iocs",
            "cve202222047",
            "antivirus",
            "com registry",
            "lsass",
            "defender",
            "powershell",
            "panama",
            "june",
            "win32",
            "guard",
            "february",
            "virustotal",
            "HotSpot"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/?utm_source=substack&utm_medium=email"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "KNOTWEED",
              "display_name": "KNOTWEED",
              "target": null
            },
            {
              "id": "JumpLump",
              "display_name": "JumpLump",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "sd123456",
            "id": "172789",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3
          },
          "indicator_count": 3,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 45,
          "modified_text": "1395 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e30c0fed8744e9a530b1b4",
          "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits - Microsoft Security Blog",
          "description": "A European private-sector offensive actor (PSOA) has developed malware used in a series of targeted attacks against Microsoft customers in Europe and Central American countries from July 27, 2022, Microsoft has said.",
          "modified": "2022-07-28T22:22:07.461000",
          "created": "2022-07-28T22:22:07.461000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa",
            "mstic",
            "microsoft",
            "dsirf",
            "adobe reader",
            "iocs",
            "cve202222047",
            "antivirus",
            "com registry",
            "lsass",
            "defender",
            "powershell",
            "panama",
            "june",
            "win32",
            "guard",
            "february",
            "virustotal"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "KNOTWEED",
              "display_name": "KNOTWEED",
              "target": null
            },
            {
              "id": "JumpLump",
              "display_name": "JumpLump",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "apextechnology",
            "id": "85564",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_85564/resized/80/avatar_e0767b85c3.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 15,
            "domain": 4,
            "hostname": 3
          },
          "indicator_count": 34,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 45,
          "modified_text": "1402 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e2b94e4d7a4011cf709f36",
          "name": "Microsoft Discovers Zero-Day Exploits for Windows and Adobe",
          "description": "",
          "modified": "2022-07-28T16:29:02.888000",
          "created": "2022-07-28T16:29:02.888000",
          "tags": [],
          "references": [
            "July 28th, 2022 - CryptoGen Cyber Threat Intelligence - Microsoft Discovers Zero-Day Exploits for Windows and Adobe.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 15,
            "domain": 4
          },
          "indicator_count": 24,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 500,
          "modified_text": "1402 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e295079c9e2c0c701e73e7",
          "name": "Microsoft: Windows, Adobe zero-days used to deploy Subzero malware",
          "description": "Microsoft has linked a threat group known as Knotweed to an Austrian spyware vendor also operating as a cyber mercenary outfit named DSIRF that targets European and Central American entities using a malware toolset dubbed Subzero. On its website, DSIRF promotes itself as a company that provides information research, forensics, and data-driven intelligence services to corporations.\n\nHowever, it has been linked to the development of the Subzero malware that its customers can use to hack targets' phones, computers, and network and internet-connected devices",
          "modified": "2022-07-28T13:54:15.577000",
          "created": "2022-07-28T13:54:15.577000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa",
            "mstic",
            "microsoft",
            "dsirf",
            "adobe reader",
            "iocs",
            "cve202222047",
            "antivirus",
            "com registry",
            "lsass",
            "defender",
            "powershell",
            "panama",
            "june",
            "win32",
            "guard",
            "february",
            "virustotal"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
            "https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-adobe-zero-days-used-to-deploy-subzero-malware/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "KNOTWEED",
              "display_name": "KNOTWEED",
              "target": null
            },
            {
              "id": "JumpLump",
              "display_name": "JumpLump",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 327,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dekaRituraj",
            "id": "99856",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 15,
            "domain": 4,
            "hostname": 3
          },
          "indicator_count": 32,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 433,
          "modified_text": "1402 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e2815c1ab1dd14e3249194",
          "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
          "description": "",
          "modified": "2022-07-28T12:30:20.393000",
          "created": "2022-07-28T12:30:20.393000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa",
            "mstic",
            "microsoft",
            "dsirf",
            "adobe reader",
            "iocs",
            "cve202222047",
            "antivirus",
            "com registry",
            "lsass",
            "defender",
            "powershell",
            "panama",
            "june",
            "win32",
            "february",
            "virustotal"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "KNOTWEED",
              "display_name": "KNOTWEED",
              "target": null
            },
            {
              "id": "JumpLump",
              "display_name": "JumpLump",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": "62e154209840435a7cdba732",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "threatmanager",
            "id": "74623",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 15,
            "domain": 4,
            "hostname": 3
          },
          "indicator_count": 32,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 507,
          "modified_text": "1402 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e23095d7fb68eb10ed3a47",
          "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
          "description": "",
          "modified": "2022-07-28T06:45:41.645000",
          "created": "2022-07-28T06:45:41.645000",
          "tags": [
            "timegenerated",
            "commandline",
            "type",
            "hashes",
            "image",
            "devicename",
            "eventdetail",
            "filehash",
            "sha256",
            "account",
            "ipaddress",
            "dnsname",
            "domainnames",
            "computer",
            "destinationhost",
            "dnsname in",
            "srcipaddr",
            "remoteip"
          ],
          "references": [
            "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDC2DomainsJuly2022.yaml",
            "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDFileHashesJuly2022.yaml",
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunter_NL",
            "id": "171283",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 15,
            "hostname": 1
          },
          "indicator_count": 23,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 862,
          "modified_text": "1402 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e154209840435a7cdba732",
          "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits - Microsoft Security Blog",
          "description": "A European private-sector offensive actor (PSOA) has developed malware used in a series of targeted attacks against Microsoft customers in Europe and Central American countries from July 27, 2022, Microsoft has said.",
          "modified": "2022-07-27T15:05:04.099000",
          "created": "2022-07-27T15:05:04.099000",
          "tags": [
            "corelump",
            "subzero",
            "jumplump",
            "knotweed",
            "psoa",
            "mstic",
            "microsoft",
            "dsirf",
            "adobe reader",
            "iocs",
            "cve202222047",
            "antivirus",
            "com registry",
            "lsass",
            "defender",
            "powershell",
            "panama",
            "june",
            "win32",
            "february",
            "virustotal"
          ],
          "references": [
            "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Corelump",
              "display_name": "Corelump",
              "target": null
            },
            {
              "id": "Jumplump",
              "display_name": "Jumplump",
              "target": null
            },
            {
              "id": "Subzero",
              "display_name": "Subzero",
              "target": null
            },
            {
              "id": "KNOTWEED",
              "display_name": "KNOTWEED",
              "target": null
            },
            {
              "id": "JumpLump",
              "display_name": "JumpLump",
              "target": null
            },
            {
              "id": "PSOA",
              "display_name": "PSOA",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Retail",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "eric.ford",
            "id": "42510",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_42510/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 15,
            "domain": 4,
            "hostname": 3
          },
          "indicator_count": 32,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "1403 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "61e9111c3b2d9e7071e1d777",
          "name": "NewDom-0-20220120",
          "description": "ICANN-Dom",
          "modified": "2022-03-06T00:03:42.267000",
          "created": "2022-01-20T07:37:00.704000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 202,
          "modified_text": "1547 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        }
      ],
      "references": [
        "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240156.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.2588447.1692243345.1.xtrace.log",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-ananicy-cpp.service-U5RKxp",
        "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.23930.1692220492.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.xtrace.log",
        "qtsingleapp-Octopi-1d88-3e8-lockfile",
        "gitstatus.POWERLEVEL9K.1000.13309.1692233456.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.12928.1692233448.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.xtrace.log",
        "qtsingleapp-Notifi-4c42-3e8-lockfile",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.345673.1692241474.1.daemon.log",
        "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/64dff1fbeab7dc252b0e56a6",
        ".org.chromium.Chromium.8GBhMA",
        ".ICE-unix",
        "albert_yt_ynb2tftv",
        "gitstatus.POWERLEVEL9K.1000.240792.1692238921.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.xtrace.log",
        "https://www.virustotal.com/gui/file/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/details",
        "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.xtrace.log",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-uksmd.service-oAjI9s",
        "v8-compile-cache-0",
        "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.xtrace.log",
        ".vbox-mrkd-ipc",
        "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.daemon.log",
        ".org.chromium.Chromium.T2jdbS",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.daemon.log",
        "strlcatmMvE1V.c",
        "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.xtrace.log",
        "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDFileHashesJuly2022.yaml",
        "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.xtrace.log",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-bluetooth.service-7fh2tg",
        "https://hybrid-analysis.com/sample/320a60044adeccec22937423e859d2b095e976698133e37a83e019ce08c8bc0c",
        "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.daemon.log",
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
        ".org.chromium.Chromium.coQnti",
        "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.xtrace.log",
        "bauh@mrkd",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.317097.1692240795.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.daemon.log",
        ".X11-unix",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.daemon.log",
        "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca",
        "plasma-csd-generator.LTvjbT",
        "https://hybrid-analysis.com/sample/8c7c7246468ffeffe01617b597622cd237fa334fb24dc4977fcac398bbe0df80",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.xtrace.log",
        "strlcpydb8x03.c",
        "gitstatus.POWERLEVEL9K.1000.241161.1692238939.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.xtrace.log",
        "https://otx.alienvault.com/indicator/file/5820da0bbae4f091dc0248e566d8f1076fd81485d1893effa14cdc1dc122f1fd",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.daemon.log",
        "July 28th, 2022 - CryptoGen Cyber Threat Intelligence - Microsoft Discovers Zero-Day Exploits for Windows and Adobe.pdf",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.xtrace.log",
        "runtime-root",
        "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.xtrace.log",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-polkit.service-CfCUQZ",
        "gitstatus.POWERLEVEL9K.1000.11270.1692217597.1.daemon.log",
        "https://hybrid-analysis.com/file-collection/64dfee6a3329552c91026445",
        ".X0-lock",
        "v8-compile-cache-1000",
        ".org.chromium.Chromium.HMzFxo",
        "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.daemon.log",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-power-profiles-daemon.service-hSCDr7",
        ".org.chromium.Chromium.12ZdF3",
        "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.daemon.log",
        "stdbool.ht64kj6qw.c",
        "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.xtrace.log",
        "@tmp",
        "fish.root",
        "tst-bz26353KOtJVp",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-systemd-logind.service-Q9OYbj",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.daemon.log",
        "https://hybrid-analysis.com/sample/43b03483bf2b292ebb1b33469ab4b19e2ac84b1c86c0f34f60adab4bc64176b9",
        "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.daemon.log",
        "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDC2DomainsJuly2022.yaml",
        "Temp-4d7e99a7-2d45-4347-a3b6-b64e3ae65e2e",
        "stdbool.hcc0B2j.c",
        "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.10291.1692217508.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.daemon.log",
        "Temp-0148ee46-b3e0-4c4b-aa55-b60c6b63eb6f",
        "qtsingleapp-Octopi-1d88-3e8",
        "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.28823.1692223670.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.daemon.log",
        "Temp-0c3dc677-7d66-4234-b14e-f604605b2d0c",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.xtrace.log",
        "pytest-of-mrkd",
        "tmp.ziktUZeKXL",
        "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.daemon.log",
        "memmemY_2MMv.c",
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/?utm_source=substack&utm_medium=email",
        "Domains - Threat Alert - KNOTWEED Threat Actor Utilizing Subzero Tool (FinTIP).txt",
        "https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-adobe-zero-days-used-to-deploy-subzero-malware/",
        "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.daemon.log",
        "tmp.D4NXyZ3U4J",
        "tmp90lfbdek",
        "qtsingleapp-Notifi-4c42-3e8",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-iwd.service-jnpcHR",
        "20230816_202710-scantemp.b14ff4bc3a",
        "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.daemon.log"
      ],
      "related": {
        "alienvault": {
          "adversary": [
            "KNOTWEED"
          ],
          "malware_families": [
            "Corelump",
            "Subzero",
            "Jumplump",
            "Psoa"
          ],
          "industries": [
            "Banks",
            "Financial",
            "Energy",
            "Technology",
            "Retail"
          ]
        },
        "other": {
          "adversary": [
            "N/A"
          ],
          "malware_families": [
            "Delphi",
            "Trojandownloader:linux/morila!mtb",
            "Knotweed",
            "Psoa",
            "Ransom:linux/darkradiation.a!mtb",
            "Subzero",
            "Sf:shellcode-dz\\ [trj]",
            "Corelump",
            "Slf:mamacsemacro.a",
            "Netexecutablemicrosoft",
            "Trojandropper:win32/fakeflexnet.a",
            "Bv:telegrambot-a\\ [trj]",
            "Jumplump",
            "Backdoor:win32/r2d2.a"
          ],
          "industries": [
            "Individuals",
            "Banks",
            "Financial",
            "Energy",
            "Technology",
            "Retail"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "62e3c158a4294a9068303b65",
      "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
      "description": "A European private-sector offensive actor (PSOA) has developed malware used in a series of targeted attacks against Microsoft customers in Europe and Central American countries from July 27, 2022, Microsoft has said.",
      "modified": "2022-07-29T11:15:35.820000",
      "created": "2022-07-29T11:15:35.820000",
      "tags": [
        "corelump",
        "subzero",
        "jumplump",
        "knotweed",
        "psoa"
      ],
      "references": [
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
      ],
      "public": 1,
      "adversary": "KNOTWEED",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Corelump",
          "display_name": "Corelump",
          "target": null
        },
        {
          "id": "Jumplump",
          "display_name": "Jumplump",
          "target": null
        },
        {
          "id": "Subzero",
          "display_name": "Subzero",
          "target": null
        },
        {
          "id": "PSOA",
          "display_name": "PSOA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Banks",
        "Financial",
        "Energy",
        "Retail",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 453,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 15,
        "domain": 3
      },
      "indicator_count": 30,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386479,
      "modified_text": "1401 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64dd9c1d76a7807782a691d3",
      "name": "IOC's found on my pesonal devices; week starting 08/14/23",
      "description": "I had wrapped the majority of the files i'd run since the 14th into the Pulse of the same date, but at over 17k indicators i think it was time to put that one to rest. Obviously time and life allowing my intention is to keep updating and creating more of these as long as i'm kept flush with content. At current i'm pretty damned flush. This is just a preliminary dump of my /tmp folder on Arch. part of the infection chain is process hallowing and then hijacking a program close to the user, with decent call ability to the rest of the system.",
      "modified": "2024-02-14T21:44:02.852000",
      "created": "2023-08-17T04:03:41.985000",
      "tags": [
        "o cloexec",
        "r procversion",
        "cachyos",
        "gnu ld",
        "gnu binutils",
        "microsoft",
        "f lockfd",
        "cygwin",
        "u respfd",
        "procselffd13",
        "procselffd14",
        "x8664",
        "uname",
        "linux",
        "getconf",
        "cpus32",
        "case",
        "m x8664",
        "s linux",
        "x8664 o",
        "z linux",
        "z x8664",
        "replying",
        "timing",
        "successfully",
        "shift",
        "procselffd16",
        "empty",
        "head",
        "dirty",
        "found",
        "splitting",
        "license",
        "index",
        "kill",
        "zfrm",
        "argv"
      ],
      "references": [
        ".ICE-unix",
        ".org.chromium.Chromium.12ZdF3",
        ".vbox-mrkd-ipc",
        "@tmp",
        ".org.chromium.Chromium.T2jdbS",
        ".X11-unix",
        "albert_yt_ynb2tftv",
        "fish.root",
        "20230816_202710-scantemp.b14ff4bc3a",
        "plasma-csd-generator.LTvjbT",
        "pytest-of-mrkd",
        "runtime-root",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-ananicy-cpp.service-U5RKxp",
        ".org.chromium.Chromium.coQnti",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-bluetooth.service-7fh2tg",
        "bauh@mrkd",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-iwd.service-jnpcHR",
        ".org.chromium.Chromium.8GBhMA",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-polkit.service-CfCUQZ",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-systemd-logind.service-Q9OYbj",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-power-profiles-daemon.service-hSCDr7",
        ".org.chromium.Chromium.HMzFxo",
        "Temp-0c3dc677-7d66-4234-b14e-f604605b2d0c",
        "tmp.D4NXyZ3U4J",
        "systemd-private-28f1c54986a24a4fa12e1cfe0bb09aa0-uksmd.service-oAjI9s",
        "Temp-0148ee46-b3e0-4c4b-aa55-b60c6b63eb6f",
        "tmp.ziktUZeKXL",
        "v8-compile-cache-0",
        "tmp90lfbdek",
        "tst-bz26353KOtJVp",
        "v8-compile-cache-1000",
        ".X0-lock",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.xtrace.log",
        "Temp-4d7e99a7-2d45-4347-a3b6-b64e3ae65e2e",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.6339.1692232717.2.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.10291.1692217508.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.9950.1692233029.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.11270.1692217597.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.8928.1692232861.2.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.10858.1692217566.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.11926.1692233325.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.12928.1692233448.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.10525.1692233087.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.13309.1692233456.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.28823.1692223670.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.12470.1692233381.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.23930.1692220492.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.13878.1692218150.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.28463.1692223667.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.75659.1692225165.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.81737.1692225737.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.78332.1692225277.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.82565.1692225764.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.82162.1692225750.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83486.1692225808.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.83038.1692225779.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.84305.1692225848.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.84754.1692225891.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.122089.1692235219.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.83896.1692225820.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.154521.1692237692.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.155609.1692237756.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.237594.1692238521.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.240024.1692238828.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.241161.1692238939.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.240792.1692238921.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.237952.1692238535.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.247194.1692239163.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.248323.1692239206.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.253137.1692239505.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240121.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240136.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267109.1692240155.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.263981.1692240117.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240156.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.317097.1692240795.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240150.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.xtrace.log",
        "gitstatus.POWERLEVEL9K.1000.268412.1692240179.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.345673.1692241474.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.daemon.log",
        "qtsingleapp-Notifi-4c42-3e8",
        "gitstatus.POWERLEVEL9K.1000.2588447.1692243345.1.xtrace.log",
        "memmemY_2MMv.c",
        "gitstatus.POWERLEVEL9K.1000.2586196.1692243336.1.daemon.log",
        "gitstatus.POWERLEVEL9K.1000.2703415.1692243471.1.xtrace.log",
        "qtsingleapp-Notifi-4c42-3e8-lockfile",
        "stdbool.hcc0B2j.c",
        "strlcatmMvE1V.c",
        "qtsingleapp-Octopi-1d88-3e8-lockfile",
        "strlcpydb8x03.c",
        "stdbool.ht64kj6qw.c",
        "qtsingleapp-Octopi-1d88-3e8",
        "gitstatus.POWERLEVEL9K.1000.267442.1692240143.1.daemon.log",
        "https://hybrid-analysis.com/sample/43b03483bf2b292ebb1b33469ab4b19e2ac84b1c86c0f34f60adab4bc64176b9",
        "https://hybrid-analysis.com/sample/320a60044adeccec22937423e859d2b095e976698133e37a83e019ce08c8bc0c",
        "https://hybrid-analysis.com/file-collection/64dfee6a3329552c91026445",
        "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca",
        "https://hybrid-analysis.com/sample/8c7c7246468ffeffe01617b597622cd237fa334fb24dc4977fcac398bbe0df80",
        "https://hybrid-analysis.com/sample/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/64dff1fbeab7dc252b0e56a6",
        "https://www.virustotal.com/gui/file/79e3317a07b12a977f7fda3463779055bbfec748e7fae4c2c1d1cb9bb8e408ca/details",
        "https://otx.alienvault.com/indicator/file/5820da0bbae4f091dc0248e566d8f1076fd81485d1893effa14cdc1dc122f1fd"
      ],
      "public": 1,
      "adversary": "N/A",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "BV:TelegramBot-A\\ [Trj]",
          "display_name": "BV:TelegramBot-A\\ [Trj]",
          "target": null
        },
        {
          "id": "Ransom:Linux/DarkRadiation.A!MTB",
          "display_name": "Ransom:Linux/DarkRadiation.A!MTB",
          "target": "/malware/Ransom:Linux/DarkRadiation.A!MTB"
        },
        {
          "id": "SLF:MamacseMacro.A",
          "display_name": "SLF:MamacseMacro.A",
          "target": null
        },
        {
          "id": "TrojanDownloader:Linux/Morila!MTB",
          "display_name": "TrojanDownloader:Linux/Morila!MTB",
          "target": "/malware/TrojanDownloader:Linux/Morila!MTB"
        },
        {
          "id": "Backdoor:Win32/R2d2.A",
          "display_name": "Backdoor:Win32/R2d2.A",
          "target": "/malware/Backdoor:Win32/R2d2.A"
        },
        {
          "id": "Sf:ShellCode-DZ\\ [Trj]",
          "display_name": "Sf:ShellCode-DZ\\ [Trj]",
          "target": null
        },
        {
          "id": "NETexecutableMicrosoft",
          "display_name": "NETexecutableMicrosoft",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/FakeFlexnet.A",
          "display_name": "TrojanDropper:Win32/FakeFlexnet.A",
          "target": "/malware/TrojanDropper:Win32/FakeFlexnet.A"
        },
        {
          "id": "Delphi",
          "display_name": "Delphi",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "individuals"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Merkd1904",
        "id": "196517",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 206,
        "domain": 5129,
        "FileHash-MD5": 177,
        "FileHash-SHA1": 114,
        "URL": 646,
        "hostname": 2078,
        "CVE": 412,
        "email": 4
      },
      "indicator_count": 8766,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 82,
      "modified_text": "836 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709ffcf3ffe737f8cb8dfd",
      "name": "IOC's found on my pesonal devices; week starting 08/14/23",
      "description": "",
      "modified": "2023-12-06T16:23:24.919000",
      "created": "2023-12-06T16:23:24.919000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 103,
        "hostname": 524,
        "domain": 1292,
        "FileHash-SHA256": 95,
        "FileHash-MD5": 54,
        "FileHash-SHA1": 39,
        "URL": 169,
        "email": 1
      },
      "indicator_count": 2277,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "906 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "630741b693cf51e5abcd3eba",
      "name": "Domains - Threat Alert - KNOTWEED Threat Actor Utilizing Subzero Tool (FinTIP)",
      "description": "",
      "modified": "2022-08-25T09:32:38.268000",
      "created": "2022-08-25T09:32:38.268000",
      "tags": [],
      "references": [
        "Domains - Threat Alert - KNOTWEED Threat Actor Utilizing Subzero Tool (FinTIP).txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "arulieswaran",
        "id": "190549",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3
      },
      "indicator_count": 3,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 43,
      "modified_text": "1374 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62ec87661aa865f7f7791b8f",
      "name": "KNOTWEED\u653b\u51fb\u8005\u4f7f\u75280-day\u6f0f\u6d1e\u90e8\u7f72Subzero \u6076\u610f\u8f6f\u4ef6",
      "description": "\u8fd1\u65e5\uff0c\u5fae\u8f6f\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3\u79f0\uff0c\u4e00\u5bb6\u540d\u4e3aDSIRF\uff08\u5fae\u8f6f\u5a01\u80c1\u60c5\u62a5\u4e2d\u5fc3\u5c06\u5176\u547d\u540d\u4e3aKNOTWEED\uff09\u7684\u5965\u5730\u5229\u516c\u53f8\u5f00\u53d1\u5e76\u9500\u552e\u4e86SubZero\u6076\u610f\u8f6f\u4ef6\uff0c\u8be5\u6076\u610f\u8f6f\u4ef6\u7684\u4e3b\u8981\u6709\u6548\u8f7d\u8377corelump\uff0c\u4e13\u95e8\u9a7b\u7559\u5728\u5185\u5b58\u4e2d\u4ee5\u9003\u907f\u68c0\u6d4b\uff0c\u5b83\u5305\u542b\u591a\u79cd\u529f\u80fd\uff0c\u5305\u62ec\u952e\u76d8\u8bb0\u5f55\u3001\u6355\u83b7\u5c4f\u5e55\u622a\u56fe\u3001\u6cc4\u9732\u6587\u4ef6\u3001\u8fd0\u884c\u8fdc\u7a0bshell\u4ee5\u53ca\u8fd0\u884c\u4ece KNOTWEED\u7684C2\u670d\u52a1\u5668\u4e0b\u8f7d\u7684\u4efb\u610f\u63d2\u4ef6\u3002\u53e6\u5916\uff0cKNOTWEED\u5728\u5176\u653b\u51fb\u6d3b\u52a8\u4e2d\u5229\u7528\u591a\u4e2a\u6f0f\u6d1e\u90e8\u7f72Subzero\u6076\u610f\u8f6f\u4ef6\uff0c\u5305\u62ecCVE-2022-22047\u6f0f\u6d1e\u3001\u7531\u4e24\u4e2a Windows \u63d0\u6743\u6f0f\u6d1e\uff08CVE-2021-31199 \u548c CVE-2021-31201\uff09\u548c\u4e00\u4e2a Adobe Reader \u6f0f\u6d1e\uff08CVE-2021-28550\uff09\u7ec4\u6210\u7684\u6f0f\u6d1e\u94fe\u3001\u4ee5\u53caCVE-2021-36948\u3002",
      "modified": "2022-08-05T03:00:41.704000",
      "created": "2022-08-05T02:58:46.499000",
      "tags": [
        "corelump",
        "subzero",
        "jumplump",
        "knotweed",
        "psoa",
        "mstic",
        "microsoft",
        "dsirf",
        "adobe reader",
        "iocs",
        "cve202222047",
        "antivirus",
        "com registry",
        "lsass",
        "defender",
        "powershell",
        "panama",
        "june",
        "win32",
        "guard",
        "february",
        "virustotal",
        "HotSpot"
      ],
      "references": [
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/?utm_source=substack&utm_medium=email"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Corelump",
          "display_name": "Corelump",
          "target": null
        },
        {
          "id": "Jumplump",
          "display_name": "Jumplump",
          "target": null
        },
        {
          "id": "Subzero",
          "display_name": "Subzero",
          "target": null
        },
        {
          "id": "KNOTWEED",
          "display_name": "KNOTWEED",
          "target": null
        },
        {
          "id": "JumpLump",
          "display_name": "JumpLump",
          "target": null
        },
        {
          "id": "PSOA",
          "display_name": "PSOA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Banks",
        "Financial",
        "Energy",
        "Retail",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "sd123456",
        "id": "172789",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3
      },
      "indicator_count": 3,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 45,
      "modified_text": "1395 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e30c0fed8744e9a530b1b4",
      "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits - Microsoft Security Blog",
      "description": "A European private-sector offensive actor (PSOA) has developed malware used in a series of targeted attacks against Microsoft customers in Europe and Central American countries from July 27, 2022, Microsoft has said.",
      "modified": "2022-07-28T22:22:07.461000",
      "created": "2022-07-28T22:22:07.461000",
      "tags": [
        "corelump",
        "subzero",
        "jumplump",
        "knotweed",
        "psoa",
        "mstic",
        "microsoft",
        "dsirf",
        "adobe reader",
        "iocs",
        "cve202222047",
        "antivirus",
        "com registry",
        "lsass",
        "defender",
        "powershell",
        "panama",
        "june",
        "win32",
        "guard",
        "february",
        "virustotal"
      ],
      "references": [
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Corelump",
          "display_name": "Corelump",
          "target": null
        },
        {
          "id": "Jumplump",
          "display_name": "Jumplump",
          "target": null
        },
        {
          "id": "Subzero",
          "display_name": "Subzero",
          "target": null
        },
        {
          "id": "KNOTWEED",
          "display_name": "KNOTWEED",
          "target": null
        },
        {
          "id": "JumpLump",
          "display_name": "JumpLump",
          "target": null
        },
        {
          "id": "PSOA",
          "display_name": "PSOA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Banks",
        "Financial",
        "Energy",
        "Retail",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "apextechnology",
        "id": "85564",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_85564/resized/80/avatar_e0767b85c3.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 15,
        "domain": 4,
        "hostname": 3
      },
      "indicator_count": 34,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 45,
      "modified_text": "1402 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e2b94e4d7a4011cf709f36",
      "name": "Microsoft Discovers Zero-Day Exploits for Windows and Adobe",
      "description": "",
      "modified": "2022-07-28T16:29:02.888000",
      "created": "2022-07-28T16:29:02.888000",
      "tags": [],
      "references": [
        "July 28th, 2022 - CryptoGen Cyber Threat Intelligence - Microsoft Discovers Zero-Day Exploits for Windows and Adobe.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 15,
        "domain": 4
      },
      "indicator_count": 24,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 500,
      "modified_text": "1402 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e295079c9e2c0c701e73e7",
      "name": "Microsoft: Windows, Adobe zero-days used to deploy Subzero malware",
      "description": "Microsoft has linked a threat group known as Knotweed to an Austrian spyware vendor also operating as a cyber mercenary outfit named DSIRF that targets European and Central American entities using a malware toolset dubbed Subzero. On its website, DSIRF promotes itself as a company that provides information research, forensics, and data-driven intelligence services to corporations.\n\nHowever, it has been linked to the development of the Subzero malware that its customers can use to hack targets' phones, computers, and network and internet-connected devices",
      "modified": "2022-07-28T13:54:15.577000",
      "created": "2022-07-28T13:54:15.577000",
      "tags": [
        "corelump",
        "subzero",
        "jumplump",
        "knotweed",
        "psoa",
        "mstic",
        "microsoft",
        "dsirf",
        "adobe reader",
        "iocs",
        "cve202222047",
        "antivirus",
        "com registry",
        "lsass",
        "defender",
        "powershell",
        "panama",
        "june",
        "win32",
        "guard",
        "february",
        "virustotal"
      ],
      "references": [
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/",
        "https://www.bleepingcomputer.com/news/microsoft/microsoft-windows-adobe-zero-days-used-to-deploy-subzero-malware/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Corelump",
          "display_name": "Corelump",
          "target": null
        },
        {
          "id": "Jumplump",
          "display_name": "Jumplump",
          "target": null
        },
        {
          "id": "Subzero",
          "display_name": "Subzero",
          "target": null
        },
        {
          "id": "KNOTWEED",
          "display_name": "KNOTWEED",
          "target": null
        },
        {
          "id": "JumpLump",
          "display_name": "JumpLump",
          "target": null
        },
        {
          "id": "PSOA",
          "display_name": "PSOA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Banks",
        "Financial",
        "Energy",
        "Retail",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 327,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dekaRituraj",
        "id": "99856",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_99856/resized/80/avatar_0e93d502b7.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 15,
        "domain": 4,
        "hostname": 3
      },
      "indicator_count": 32,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 433,
      "modified_text": "1402 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e2815c1ab1dd14e3249194",
      "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
      "description": "",
      "modified": "2022-07-28T12:30:20.393000",
      "created": "2022-07-28T12:30:20.393000",
      "tags": [
        "corelump",
        "subzero",
        "jumplump",
        "knotweed",
        "psoa",
        "mstic",
        "microsoft",
        "dsirf",
        "adobe reader",
        "iocs",
        "cve202222047",
        "antivirus",
        "com registry",
        "lsass",
        "defender",
        "powershell",
        "panama",
        "june",
        "win32",
        "february",
        "virustotal"
      ],
      "references": [
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Corelump",
          "display_name": "Corelump",
          "target": null
        },
        {
          "id": "Jumplump",
          "display_name": "Jumplump",
          "target": null
        },
        {
          "id": "Subzero",
          "display_name": "Subzero",
          "target": null
        },
        {
          "id": "KNOTWEED",
          "display_name": "KNOTWEED",
          "target": null
        },
        {
          "id": "JumpLump",
          "display_name": "JumpLump",
          "target": null
        },
        {
          "id": "PSOA",
          "display_name": "PSOA",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Banks",
        "Financial",
        "Energy",
        "Retail",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": "62e154209840435a7cdba732",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "threatmanager",
        "id": "74623",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 15,
        "domain": 4,
        "hostname": 3
      },
      "indicator_count": 32,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 507,
      "modified_text": "1402 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e23095d7fb68eb10ed3a47",
      "name": "Untangling KNOTWEED: European private-sector offensive actor using 0-day exploits",
      "description": "",
      "modified": "2022-07-28T06:45:41.645000",
      "created": "2022-07-28T06:45:41.645000",
      "tags": [
        "timegenerated",
        "commandline",
        "type",
        "hashes",
        "image",
        "devicename",
        "eventdetail",
        "filehash",
        "sha256",
        "account",
        "ipaddress",
        "dnsname",
        "domainnames",
        "computer",
        "destinationhost",
        "dnsname in",
        "srcipaddr",
        "remoteip"
      ],
      "references": [
        "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDC2DomainsJuly2022.yaml",
        "https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Detections/MultipleDataSources/KNOTWEEDFileHashesJuly2022.yaml",
        "https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunter_NL",
        "id": "171283",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 15,
        "hostname": 1
      },
      "indicator_count": 23,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 862,
      "modified_text": "1402 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "acrobatrelay.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "acrobatrelay.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780200618.8429816
}