{
  "type": "Domain",
  "indicator": "defaultwin.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/defaultwin.com",
    "alexa": "http://www.alexa.com/siteinfo/defaultwin.com",
    "indicator": "defaultwin.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3907710661,
      "indicator": "defaultwin.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68abf66e97031d0ff0c04fed",
          "name": "Packed sentient.industries links to a targets business website",
          "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
          "modified": "2025-09-24T04:04:05.604000",
          "created": "2025-08-25T05:36:46.327000",
          "tags": [
            "moved",
            "body",
            "x cache",
            "cloudfront x",
            "cph50 c2",
            "certificate",
            "record value",
            "title",
            "h1 center",
            "server",
            "redacted for",
            "servers",
            "name redacted",
            "for privacy",
            "name servers",
            "org data",
            "privacy city",
            "privacy country",
            "ca creation",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "asn as57033",
            "less whois",
            "registrar",
            "tucows domains",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl ecc",
            "domain secure",
            "site ca",
            "validity",
            "subject public",
            "extraction",
            "data upload",
            "extra data",
            "include review",
            "find",
            "failed",
            "typ no",
            "ms windows",
            "intel",
            "pe32",
            "united",
            "search",
            "as16509",
            "from win32bios",
            "show",
            "high",
            "medium",
            "delphi",
            "copy",
            "write",
            "launcher",
            "next",
            "present aug",
            "present jul",
            "lowfi",
            "win32",
            "a div",
            "div div",
            "learn xml",
            "babylon",
            "win64",
            "trojan",
            "colors",
            "python",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "et info",
            "tls handshake",
            "bad traffic",
            "failure",
            "date",
            "august",
            "hybrid",
            "general",
            "path",
            "starfield",
            "click",
            "strings",
            "se bethseda",
            "n bethseda",
            "n data",
            "error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results aug",
            "read c",
            "tlsv1",
            "port",
            "destination",
            "module load",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "cname",
            "aaaa",
            "creation date",
            "showing",
            "domain",
            "dga domains",
            "palantirfoundry",
            "foundry",
            "status",
            "unknown ns",
            "g2 tls",
            "rsa sha256",
            "italy unknown",
            "mtb may",
            "trojandropper",
            "invalid url",
            "next associated",
            "ddos",
            "body html",
            "hacktool",
            "ipv4",
            "url analysis",
            "ukraine",
            "encrypt",
            "rl add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present jun",
            "entries",
            "title error",
            "all ipv4",
            "reverse dns",
            "yara detections",
            "top source",
            "top destination",
            "source source",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "canada unknown",
            "content type",
            "javascript src",
            "script script",
            "x powered",
            "ipv4 add",
            "pulse submit",
            "submit url",
            "analysis",
            "url add",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "unknown aaaa",
            "ascii text",
            "user agent",
            "powershell",
            "agent",
            "czechia unknown",
            "domain add",
            "dynamicloader",
            "hostname add",
            "pentagon",
            "defense"
          ],
          "references": [
            "sentient.industries affects independent artists. Affects several others.",
            "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
            "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
            "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
            "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
            "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
            "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
            "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
            "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
            "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
            "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
            "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
            "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
            "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
            "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
            "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
            "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
            "https://link.monetizer101.com/widget/code/dailystaruk.js",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
            "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
            "(Can't access file- Malware infection files)",
            "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
            "constellation.pcfrpegaservice.net (Pegasus related? idk)",
            "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
            "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
            "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
            "Remotewd.com devices",
            "If you find anything interesting please research it."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "nUFS_inno",
              "display_name": "nUFS_inno",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious",
              "target": null
            },
            {
              "id": "ALF:JASYP:PUA:Win32/Bibado",
              "display_name": "ALF:JASYP:PUA:Win32/Bibado",
              "target": null
            },
            {
              "id": "Trojan:Win32/Toga",
              "display_name": "Trojan:Win32/Toga",
              "target": "/malware/Trojan:Win32/Toga"
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-149",
              "display_name": "Win.Trojan.Jorik-149",
              "target": null
            },
            {
              "id": "#LowFiDetectsVmWare",
              "display_name": "#LowFiDetectsVmWare",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-130",
              "display_name": "Win.Trojan.Jorik-130",
              "target": null
            },
            {
              "id": "Win.Trojan.Fakecodecs-119",
              "display_name": "Win.Trojan.Fakecodecs-119",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Bulz-9860169-0",
              "display_name": "Win.Trojan.Bulz-9860169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop.V!MTB",
              "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
              "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Win.Packed.Razy-9785185-0",
              "display_name": "Win.Packed.Razy-9785185-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "PWS",
              "display_name": "PWS",
              "target": null
            },
            {
              "id": "DDOS:Win32/Stormser.A",
              "display_name": "DDOS:Win32/Stormser.A",
              "target": "/malware/DDOS:Win32/Stormser.A"
            },
            {
              "id": "ALF:HSTR:DotNET",
              "display_name": "ALF:HSTR:DotNET",
              "target": null
            },
            {
              "id": "DotNET",
              "display_name": "DotNET",
              "target": null
            },
            {
              "id": "Script Exploit",
              "display_name": "Script Exploit",
              "target": null
            },
            {
              "id": "HackTool:Win32/AutoKMS",
              "display_name": "HackTool:Win32/AutoKMS",
              "target": "/malware/HackTool:Win32/AutoKMS"
            },
            {
              "id": "Xanfpezes.A",
              "display_name": "Xanfpezes.A",
              "target": null
            },
            {
              "id": "Trojan:Win32/Gandcrab",
              "display_name": "Trojan:Win32/Gandcrab",
              "target": "/malware/Trojan:Win32/Gandcrab"
            },
            {
              "id": "Win.Trojan.Generic-9862772-0",
              "display_name": "Win.Trojan.Generic-9862772-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBL!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
            },
            {
              "id": "Win32/Nemucod",
              "display_name": "Win32/Nemucod",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "target": null
            },
            {
              "id": "Trojan:Win32/Blihan.A",
              "display_name": "Trojan:Win32/Blihan.A",
              "target": "/malware/Trojan:Win32/Blihan.A"
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "Win.Malware.Kolab-9885903-0",
              "display_name": "Win.Malware.Kolab-9885903-0",
              "target": null
            },
            {
              "id": "Win.Malware (30)",
              "display_name": "Win.Malware (30)",
              "target": null
            },
            {
              "id": "Ransom",
              "display_name": "Ransom",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "target": null
            },
            {
              "id": "E5",
              "display_name": "E5",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 6232,
            "URL": 24908,
            "hostname": 7993,
            "FileHash-SHA256": 11128,
            "email": 6,
            "FileHash-MD5": 1054,
            "FileHash-SHA1": 932,
            "SSLCertFingerprint": 14,
            "CIDR": 3,
            "CVE": 3
          },
          "indicator_count": 52273,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "208 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ce3eb4b4f1fc9eafb4b572",
          "name": "DDoS:Linux/Lightaidra | Mirai Botnet on US a State Computer",
          "description": "*Mirai Botnet on Colorado State computer. Im starting to wonder if potential problem cases are diverted to a botnet.\n1. Overlaps with a Colorado victim. Similar issues. I Recently became a senior in expensive Colorado, never compensated for workers compensation injury exacerbated when suddenly tossed a 60 lb weighted ball under care. Denied diagnoses of severe injury after toss. Complained, case closed, lawyers denied case after accepting case. Referred to JeffCo seeking assisted living resources. Was sent various packets with a variety of phone numbers, email addresses, etc. She keeps speaking to same man no matter what option chosen. Denied workforce training due to severity of injuries, No SSI or SSDI until years later. \n2. I can't pulse half of what I've researched without using multiple resources. No more 'contacted' made when new serious issues found. Pulses being modified. I rarely modify any pulse.",
          "modified": "2024-09-26T20:01:27.723000",
          "created": "2024-08-27T21:01:40.251000",
          "tags": [
            "memcommit",
            "read c",
            "nospltezraxuf",
            "writeconsolea",
            "write",
            "CVE-2023-22518",
            "tesla",
            "ye ye",
            "incapril",
            "yed ye",
            "yet ye",
            "yexe ye",
            "security",
            "search",
            "function read",
            "dll read",
            "installer",
            "april",
            "copy",
            "win32",
            "template",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "name servers",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "date",
            "windows",
            "medium",
            "shellexecuteexw",
            "hash",
            "show",
            "writeconsolew",
            "entries",
            "displayname",
            "sddl",
            "service",
            "august",
            "malware",
            "url http",
            "http",
            "ip address",
            "related nids",
            "files location",
            "domain",
            "status",
            "nxdomain",
            "whitelisted",
            "certificate",
            "backdoor",
            "record value",
            "body",
            "as15133 verizon",
            "united",
            "unknown",
            "mtb aug",
            "gmt server",
            "ecacc sed5906",
            "ransom",
            "trojan",
            "high",
            "cname",
            "as8075",
            "ipv4",
            "files",
            "asn as55720",
            "date hash",
            "default",
            "delete",
            "yara detections",
            "msvisualcpp60",
            "related pulses",
            "rootkit",
            "as16276",
            "canada unknown",
            "pulses",
            "expiration date",
            "exploit",
            "showing",
            "aaaa",
            "france unknown",
            "mtb sep",
            "worm",
            "msil",
            "mirai",
            "as36081 state",
            "reverse dns",
            "port",
            "destination",
            "south korea",
            "taiwan as3462",
            "as4766 korea",
            "asnone",
            "japan as17676",
            "china as4134",
            "china as4837",
            "file samples",
            "files matching",
            "next",
            "copyright",
            "levelblue",
            "as20940",
            "as15169 google",
            "ave suite",
            "purpose p5",
            "country united",
            "code us",
            "as41231",
            "united kingdom",
            "ddos",
            "sha256",
            "filehash",
            "av detections",
            "location london",
            "great britain",
            "gnulinux apt",
            "yara rule",
            "ids detections",
            "top source",
            "address",
            "as23969",
            "thailand"
          ],
          "references": [
            "In this instance a senior citizen needing assisted living resources redirected & social engineered by addresses originated from: jefferson.co.us",
            "Noted: Calls redirected, call jumps ahead of 25+ callers in wait, keeps getting same agent, told approved for services never applied for or received",
            "Exploits: IPv4 20.99.186.246 | 52.109.0.140 | CVE CVE-2023-22518 | Trojans: AgentTesla.KM , Cobalt Strike , Ransom: WannaCrypt , Malware: Dxqo",
            "Domain Name: IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM  Emails: BotnetSinkhole@gmail.com",
            "Emails: abuse@namecheap.com Name: Botnet Sinkhole  | Address: Botnet Sinkhole City: Los Angeles Country: USA",
            "Dnssec:Unsigned | Name Servers | BRUCE.NS.CLOUDFLARE.COM",
            "Notable: Mirai - 192.70.175.110 Security Operations (DORA?) oit_isocsecurity@state.co.us | state.co.us | Reverse DNS dns1.state.co.us",
            "Unix.Trojan.Mirai-6976991-0 : FileHash-SHA256 a282f250e59f8754335993293bfbfcc154cdb67ff0e234162f40a6cce5c4290c",
            "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
            "Overlaps: 4 others mailed information email address.",
            "Ransom:Win32/WannaCrypt.H",
            "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | CVE-2017-0147",
            "AS36081 State of Colorado General Government Computer",
            "Yara Detections Mirai_Botnet_Malware Alerts: dead_host network_icmp osquery_detection nolookup_communication",
            "ELF:Mirai-AII\\ [Trj]  | FileHash-SHA256:  760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
            "Detections Executable and linking format (ELF) file download Over HTTP |",
            "FileHash-SHA256 : 256760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
            "Yara Detections: UPXProtectorv10x2 ,  UPX ,  ELFHighEntropy ,  elf_empty_sections Alerts: dead_host | ELF:Mirai-AII\\ [Trj]",
            "77882 IP\u2019s Contacted: 1.1.69.67  1.10.237.208  1.101.233.31  1.102.46.59  1.103.37.126  1.105.106.252  1.106.108.182  1.106.193.143  1.109.132.165  1.11.116.209",
            "Domains Contacted: ntp.ubuntu.com | IDS Detections GNU/Linux APT User-Agent Outbound likely related to package management | 91.189.89.198",
            "Yara Detections: gafgyt IP\u2019s Contacted:  91.189.89.198 Domains Contacted :ntp.ubuntu.com",
            "FileHash-SHA256:  a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c",
            "Related Domains: townofignacio.com | coloradoagriculture.com | coloradoworkforce.com | coworkforce.com | coloradoccjj.com | dns1.state.co.us",
            "https://www.rapidinterviews.com/api/jobs/redirect/public-transit-bus-drivers-with-utah-transit-authority-in-stansbury-park-apc-1932",
            "https://us.thebigjobsite.com/redirectfeedjob?jobid=2A5F97A6BAE0AA90DC418C2119E1E0EB&source=onestepjobsxmlus&utm_source=onestepjobsxmlus&jobSiteK",
            "redirect.wuxs.icu",
            "https://a-a.redirector.navexglobal.com/navex_hosting/404.html",
            "https://engage.navexglobal.com/topclass1/login.do?redirectTo=/expand.do?template=JasperReports&view=library"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:MSIL/AgentTesla.KM",
              "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
              "target": null
            },
            {
              "id": "Win.Trojan.CobaltStrike-9044898-1",
              "display_name": "Win.Trojan.CobaltStrike-9044898-1",
              "target": null
            },
            {
              "id": "Win.Malware.Dxqo-6984072-0",
              "display_name": "Win.Malware.Dxqo-6984072-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt",
              "display_name": "Ransom:Win32/WannaCrypt",
              "target": "/malware/Ransom:Win32/WannaCrypt"
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Fynloski",
              "display_name": "Backdoor:Win32/Fynloski",
              "target": "/malware/Backdoor:Win32/Fynloski"
            },
            {
              "id": "Worm:Win32/Mofksys",
              "display_name": "Worm:Win32/Mofksys",
              "target": "/malware/Worm:Win32/Mofksys"
            },
            {
              "id": "TELPER:DDoS:Linux/Lightaidra",
              "display_name": "TELPER:DDoS:Linux/Lightaidra",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1009",
              "name": "Binary Padding",
              "display_name": "T1009 - Binary Padding"
            },
            {
              "id": "T1499",
              "name": "Endpoint Denial of Service",
              "display_name": "T1499 - Endpoint Denial of Service"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            }
          ],
          "industries": [
            "Telecom"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-MD5": 675,
            "FileHash-SHA1": 664,
            "FileHash-SHA256": 3327,
            "URL": 2448,
            "domain": 656,
            "hostname": 1281,
            "email": 11
          },
          "indicator_count": 9064,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "570 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6671e5844c155814e69ba4dd",
          "name": "Mirai Botnet Injection  affecting Alienvault.",
          "description": "It's unclear if some users or service itself is injecting users or if service is under a Mirai attack. I found evidence of both outbound & inbound activities.  *Crowdsourced context: Activity related to MIRAI - according to source Cluster25 - \nThis IPV4 is used by MIRAI. Mirai is a malware that created a big botnet of networked devices running Linux making them remotely controlled bots that can be used for large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers.\n#zbetcheckin tracker\nDownloaded on 2023-11-07 19:34:59 UTC\nSRC URL : http://171.228.209.167/x86_64\nIP : 171.228.209.167\nAS : AS7552 Viettel Group\nYARA : #contentis_base64 #debuggerpattern__rdtsc #ip #math_entropy_6 #is__elf #http #ft_elf #executable_elf64",
          "modified": "2024-07-18T19:02:50.386000",
          "created": "2024-06-18T19:52:36.849000",
          "tags": [
            "problems",
            "threat network",
            "infrastructure",
            "historical ssl",
            "microsoft stuff",
            "domain check",
            "referrer",
            "generic malware",
            "injector",
            "no data",
            "tag count",
            "fri mar",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "downloader",
            "generic",
            "united",
            "as14315",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "america asn",
            "unknown",
            "ransom",
            "body",
            "coinminer",
            "malware generic",
            "wed jan",
            "first",
            "status",
            "creation date",
            "search",
            "date",
            "expiration date",
            "name servers",
            "next",
            "mirai",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "reverse dns",
            "location lao",
            "viet nam",
            "domain",
            "all search",
            "otx scoreblue",
            "hostname",
            "files ip",
            "lazarus",
            "as7552 viettel",
            "vietnam unknown",
            "win32",
            "worm",
            "win32sfone jul",
            "vietnam",
            "etag",
            "telecom",
            "as16625 akamai",
            "as20940",
            "germany",
            "united kingdom",
            "singapore",
            "as20546 soprado",
            "hong kong",
            "as45102 alibaba",
            "taobao network",
            "cname",
            "aaaa",
            "entries",
            "showing",
            "a domains",
            "as38731 vietel",
            "plesk",
            "a li",
            "default page",
            "plesk a",
            "mirai variant",
            "useragent",
            "apache",
            "accept",
            "hello",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "create",
            "show",
            "medium",
            "dock",
            "execution",
            "copy",
            "xport",
            "address",
            "as131392",
            "cape",
            "orsam",
            "malware",
            "script urls",
            "moved",
            "record value",
            "cisco umbrella",
            "site",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "malicious site",
            "phishing site",
            "malicious url",
            "opencandy",
            "exploit",
            "agent",
            "phishing",
            "acint",
            "iframe",
            "crack",
            "conduit",
            "artemis",
            "riskware",
            "mimikatz",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "presenoker",
            "filetour",
            "cleaner",
            "wacatac",
            "outbreak",
            "installcore",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "related pulses",
            "whois",
            "related",
            "msil",
            "zombie",
            "dridex",
            "location viet",
            "pulse submit",
            "url analysis",
            "content",
            "google tag",
            "utc gcfezl5ynvb",
            "utc na",
            "utc google",
            "analytics na",
            "utc linkedin",
            "insight tag",
            "deep malware",
            "iframes",
            "trackers",
            "external-resources",
            "text/html",
            "elf info",
            "header class",
            "elf64 data",
            "header version",
            "os abi",
            "unix",
            "v object",
            "file type",
            "exec",
            "executable file",
            "progbits",
            "type address",
            "offset size",
            "flags",
            "null",
            "nobits",
            "strtab",
            "ip detections",
            "country",
            "us bundled",
            "detections file",
            "name",
            "graph summary",
            "get hello",
            "jaws webserver",
            "outbound",
            "mvpower dvr",
            "shell uce",
            "inbound",
            "activity mirai",
            "mirai",
            "info",
            "performs dns",
            "mitre att",
            "access ta0006",
            "os credential",
            "dumping t1003",
            "enumerates",
            "command",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "relacionada",
            "mirai malware",
            "mirai 04022024",
            "nciipc",
            "ip reputaion",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "china as37963",
            "simplified",
            "trojanspy",
            "virustotal",
            "panda",
            "detections type",
            "shell",
            "javascript",
            "dns replication",
            "files referring",
            "lookups",
            "as7552",
            "vhash",
            "ssdeep",
            "magic elf",
            "sysv",
            "trid elf",
            "executable",
            "linux",
            "elf executable",
            "loccel1",
            "echobot",
            "bashlite",
            "malwarebazaar",
            "echobot malware",
            "win32 exe",
            "magic msdos",
            "pe32 executable",
            "intel",
            "ms windows",
            "trid dos",
            "compiler",
            "delphi",
            "serial number",
            "algorithm",
            "thumbprint",
            "valid from",
            "code signing",
            "from",
            "microsoft root",
            "name microsoft",
            "verisign time",
            "stamping",
            "contained",
            "info sections",
            "name virtual",
            "address virtual",
            "size raw",
            "size entropy",
            "md5 chi2",
            "regsetvalueexa",
            "type rtrcdata",
            "sha256 file",
            "threat roundup",
            "october",
            "august",
            "june",
            "september",
            "highly targeted",
            "cyberstalking",
            "round",
            "december",
            "sneaky server",
            "facebook",
            "stealer",
            "agent tesla",
            "pony",
            "april",
            "whitelisted",
            "encrypt",
            "targeting",
            "tsara brashears",
            "otx",
            "alienvault",
            "memcommit",
            "regsz",
            "regopenkeyexw",
            "english",
            "module load",
            "t1129",
            "t1082",
            "windows module",
            "dlls",
            "redline stealer",
            "updater",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "data redacted",
            "cloudflare",
            "redacted",
            "for privacy",
            "code",
            "server",
            "registrar abuse",
            "redacted for",
            "postal code",
            "registrant name",
            "red team",
            "shit",
            "logistics",
            "cyber defense",
            "gootloader",
            "march",
            "sinkhole",
            "just",
            "ramnit",
            "netsupport rat",
            "microsoft",
            "vault",
            "karen",
            "gifts",
            "hidden privacy",
            "threats",
            "malicious",
            "darkgate",
            "core",
            "hacktool",
            "emotet"
          ],
          "references": [
            "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
            "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
            "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
            "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
            "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
            "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
            "https://otx.alienvault.com/indicator/domain/bunny.net",
            "https://otx.alienvault.com/indicator/ip/210.211.117.205",
            "https://otx.alienvault.com/indicator/ip/143.244.50.212",
            "https://otx.alienvault.com/indicator/ip/125.235.4.59",
            "AV Detection: ELF:Mirai-GH\\ [Trj]",
            "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
            "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
            "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
            "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
            "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
            "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
            "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
            "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
            "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
            "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
            "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
            "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
            "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com",
            "Was anyone else notified? I'm not sure why I was.",
            "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
            "CS Sigma: Matches rule Python Initiated Connection by frack113"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Unix.Trojan.Mirai-9441505-0",
              "display_name": "Unix.Trojan.Mirai-9441505-0",
              "target": null
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_mcv",
              "display_name": "ALF:E5.SpikeAex.rhh_mcv",
              "target": null
            },
            {
              "id": "Win.Dropper.Bulz-9910065-0",
              "display_name": "Win.Dropper.Bulz-9910065-0",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Win.Dropper.Autoit-6688751-0",
              "display_name": "Win.Dropper.Autoit-6688751-0",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Dropper.Dridex-9986041-0",
              "display_name": "Win.Dropper.Dridex-9986041-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Zombie",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Zombie",
              "target": null
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Worm:Win32/Sfone.A",
              "display_name": "Worm:Win32/Sfone.A",
              "target": "/malware/Worm:Win32/Sfone.A"
            },
            {
              "id": "Worm:Win32/Sfone",
              "display_name": "Worm:Win32/Sfone",
              "target": "/malware/Worm:Win32/Sfone"
            },
            {
              "id": "Win.Malware.Bbabdcdc-7358312-0",
              "display_name": "Win.Malware.Bbabdcdc-7358312-0",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "trojan.mirai/fszhh",
              "display_name": "trojan.mirai/fszhh",
              "target": null
            },
            {
              "id": "DDOS:Linux/Mirai",
              "display_name": "DDOS:Linux/Mirai",
              "target": "/malware/DDOS:Linux/Mirai"
            },
            {
              "id": "ANDROID/AVE.Mirai.fszhh",
              "display_name": "ANDROID/AVE.Mirai.fszhh",
              "target": null
            },
            {
              "id": "Flyagent L",
              "display_name": "Flyagent L",
              "target": null
            },
            {
              "id": "Win-Trojan/Malpacked5.Gen",
              "display_name": "Win-Trojan/Malpacked5.Gen",
              "target": null
            },
            {
              "id": "Atros3.LDJ",
              "display_name": "Atros3.LDJ",
              "target": null
            },
            {
              "id": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
              "display_name": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Gucotut.A",
              "display_name": "TrojanSpy:Win32/Gucotut.A",
              "target": "/malware/TrojanSpy:Win32/Gucotut.A"
            },
            {
              "id": "W32/Pidgeon-A",
              "display_name": "W32/Pidgeon-A",
              "target": null
            },
            {
              "id": "Variant.Zusy.151902",
              "display_name": "Variant.Zusy.151902",
              "target": null
            },
            {
              "id": "trojan.mirai/fedr",
              "display_name": "trojan.mirai/fedr",
              "target": null
            },
            {
              "id": "Win.Malware.Trojanx-9862538-0",
              "display_name": "Win.Malware.Trojanx-9862538-0",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen\\ [Trj]",
              "display_name": "Win32:PWSX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "virus.ramnit/nimnul",
              "display_name": "virus.ramnit/nimnul",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 351,
            "FileHash-SHA1": 349,
            "FileHash-SHA256": 3715,
            "domain": 3326,
            "hostname": 5200,
            "URL": 13151,
            "email": 9,
            "CVE": 7,
            "CIDR": 2
          },
          "indicator_count": 26110,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 243,
          "modified_text": "640 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
        "https://otx.alienvault.com/indicator/ip/143.244.50.212",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
        "https://a-a.redirector.navexglobal.com/navex_hosting/404.html",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
        "AV Detection: ELF:Mirai-GH\\ [Trj]",
        "77882 IP\u2019s Contacted: 1.1.69.67  1.10.237.208  1.101.233.31  1.102.46.59  1.103.37.126  1.105.106.252  1.106.108.182  1.106.193.143  1.109.132.165  1.11.116.209",
        "Notable: Mirai - 192.70.175.110 Security Operations (DORA?) oit_isocsecurity@state.co.us | state.co.us | Reverse DNS dns1.state.co.us",
        "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
        "https://us.thebigjobsite.com/redirectfeedjob?jobid=2A5F97A6BAE0AA90DC418C2119E1E0EB&source=onestepjobsxmlus&utm_source=onestepjobsxmlus&jobSiteK",
        "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
        "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
        "Dnssec:Unsigned | Name Servers | BRUCE.NS.CLOUDFLARE.COM",
        "sentient.industries affects independent artists. Affects several others.",
        "CS Sigma: Matches rule Python Initiated Connection by frack113",
        "Overlaps: 4 others mailed information email address.",
        "(Can't access file- Malware infection files)",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Related Domains: townofignacio.com | coloradoagriculture.com | coloradoworkforce.com | coworkforce.com | coloradoccjj.com | dns1.state.co.us",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Emails: abuse@namecheap.com Name: Botnet Sinkhole  | Address: Botnet Sinkhole City: Los Angeles Country: USA",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "AS36081 State of Colorado General Government Computer",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | CVE-2017-0147",
        "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
        "Domain Name: IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM  Emails: BotnetSinkhole@gmail.com",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
        "https://otx.alienvault.com/indicator/domain/bunny.net",
        "https://otx.alienvault.com/indicator/ip/210.211.117.205",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "Unix.Trojan.Mirai-6976991-0 : FileHash-SHA256 a282f250e59f8754335993293bfbfcc154cdb67ff0e234162f40a6cce5c4290c",
        "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
        "Detections Executable and linking format (ELF) file download Over HTTP |",
        "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
        "FileHash-SHA256:  a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c",
        "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
        "redirect.wuxs.icu",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "Yara Detections Mirai_Botnet_Malware Alerts: dead_host network_icmp osquery_detection nolookup_communication",
        "https://www.rapidinterviews.com/api/jobs/redirect/public-transit-bus-drivers-with-utah-transit-authority-in-stansbury-park-apc-1932",
        "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
        "Yara Detections: gafgyt IP\u2019s Contacted:  91.189.89.198 Domains Contacted :ntp.ubuntu.com",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
        "Ransom:Win32/WannaCrypt.H",
        "wallpapers-nature.com",
        "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "Remotewd.com devices",
        "https://engage.navexglobal.com/topclass1/login.do?redirectTo=/expand.do?template=JasperReports&view=library",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "If you find anything interesting please research it.",
        "Domains Contacted: ntp.ubuntu.com | IDS Detections GNU/Linux APT User-Agent Outbound likely related to package management | 91.189.89.198",
        "Noted: Calls redirected, call jumps ahead of 25+ callers in wait, keeps getting same agent, told approved for services never applied for or received",
        "ELF:Mirai-AII\\ [Trj]  | FileHash-SHA256:  760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "https://otx.alienvault.com/indicator/ip/125.235.4.59",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "FileHash-SHA256 : 256760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "In this instance a senior citizen needing assisted living resources redirected & social engineered by addresses originated from: jefferson.co.us",
        "Yara Detections: UPXProtectorv10x2 ,  UPX ,  ELFHighEntropy ,  elf_empty_sections Alerts: dead_host | ELF:Mirai-AII\\ [Trj]",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Was anyone else notified? I'm not sure why I was.",
        "Exploits: IPv4 20.99.186.246 | 52.109.0.140 | CVE CVE-2023-22518 | Trojans: AgentTesla.KM , Cobalt Strike , Ransom: WannaCrypt , Malware: Dxqo",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan:win32/zbot.sibl!mtb",
            "Win.trojan.bulz-9860169-0",
            "Trojan:win32/zombie.a",
            "Worm:win32/sfone.a",
            "Win.trojan.jorik-149",
            "Script exploit",
            "Atros3.ldj",
            "Virus.ramnit/nimnul",
            "Win.trojan.jorik-130",
            "Nufs_inno",
            "#lowfi:hstr:msil/malicious",
            "Telper:ddos:linux/lightaidra",
            "Win.malware.trojanx-9862538-0",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Alf:trojan:msil/agenttesla.km",
            "Win.malware.bbabdcdc-7358312-0",
            "#lowfidetectsvmware",
            "Win32:downloader-gjk\\ [trj]",
            "Trojandropper:win32/muldrop.v!mtb",
            "Mirai",
            "Win32:malware-gen",
            "Android/ave.mirai.fszhh",
            "Backdoor:win32/fynloski",
            "Win32/nemucod",
            "Trojan.mirai/fszhh",
            "Win.malware (30)",
            "Unix.trojan.mirai-9441505-0",
            "Elf:mirai-gh\\ [trj]",
            "Custom malware",
            "Alf:heraklezeval:trojandownloader:html/adodb!rfn",
            "Win.malware.dxqo-6984072-0",
            "Alf:heraklezeval:trojan:win32/zombie",
            "Win.malware.midie-6847892-0",
            "Worm:win32/mofksys",
            "Trojandropper:win32/muldrop",
            "Win.malware.kolab-9885903-0",
            "Flyagent l",
            "W32/pidgeon-a",
            "Dotnet",
            "Win-trojan/malpacked5.gen",
            "Pws",
            "Win.trojan.cobaltstrike-9044898-1",
            "Win.dropper.autoit-6688751-0",
            "Trojan:win32/blihan.a",
            "Win.downloader.109205-1",
            "Ransom",
            "Mydoom",
            "Ddos:win32/stormser.a",
            "Alf:e5.spikeaex.rhh_mcv",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Win32:pwsx-gen\\ [trj]",
            "Win.dropper.dridex-9986041-0",
            "Trojan.mirai/fedr",
            "Trojan:win32/toga",
            "Alf:hstr:dotnet",
            "Win.packer.pkr_ce1a-9980177-0",
            "Variant.zusy.151902",
            "Win.dropper.bulz-9910065-0",
            "Ransom:win32/wannacrypt",
            "Trojan:win32/glupteba.mt!mtb",
            "Win32:trojan-gen",
            "Trojan:win32/gandcrab",
            "A variant of win32/flystudio.packed.ad potentially unwanted",
            "#lowfi:hstr:msil/malicious.decryption",
            "Xanfpezes.a",
            "Trojanspy:win32/gucotut.a",
            "Ddos:linux/mirai",
            "Win.trojan.fakecodecs-119",
            "Win.packed.razy-9785185-0",
            "Alf:jasyp:pua:win32/bibado",
            "Win.trojan.generic-9862772-0",
            "#lowfienabledtcontinueafterunpacking",
            "E5",
            "Generic",
            "Worm:win32/sfone",
            "Hacktool:win32/autokms"
          ],
          "industries": [
            "Telecom"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68abf66e97031d0ff0c04fed",
      "name": "Packed sentient.industries links to a targets business website",
      "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
      "modified": "2025-09-24T04:04:05.604000",
      "created": "2025-08-25T05:36:46.327000",
      "tags": [
        "moved",
        "body",
        "x cache",
        "cloudfront x",
        "cph50 c2",
        "certificate",
        "record value",
        "title",
        "h1 center",
        "server",
        "redacted for",
        "servers",
        "name redacted",
        "for privacy",
        "name servers",
        "org data",
        "privacy city",
        "privacy country",
        "ca creation",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "asn as57033",
        "less whois",
        "registrar",
        "tucows domains",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl ecc",
        "domain secure",
        "site ca",
        "validity",
        "subject public",
        "extraction",
        "data upload",
        "extra data",
        "include review",
        "find",
        "failed",
        "typ no",
        "ms windows",
        "intel",
        "pe32",
        "united",
        "search",
        "as16509",
        "from win32bios",
        "show",
        "high",
        "medium",
        "delphi",
        "copy",
        "write",
        "launcher",
        "next",
        "present aug",
        "present jul",
        "lowfi",
        "win32",
        "a div",
        "div div",
        "learn xml",
        "babylon",
        "win64",
        "trojan",
        "colors",
        "python",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "et info",
        "tls handshake",
        "bad traffic",
        "failure",
        "date",
        "august",
        "hybrid",
        "general",
        "path",
        "starfield",
        "click",
        "strings",
        "se bethseda",
        "n bethseda",
        "n data",
        "error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results aug",
        "read c",
        "tlsv1",
        "port",
        "destination",
        "module load",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "cname",
        "aaaa",
        "creation date",
        "showing",
        "domain",
        "dga domains",
        "palantirfoundry",
        "foundry",
        "status",
        "unknown ns",
        "g2 tls",
        "rsa sha256",
        "italy unknown",
        "mtb may",
        "trojandropper",
        "invalid url",
        "next associated",
        "ddos",
        "body html",
        "hacktool",
        "ipv4",
        "url analysis",
        "ukraine",
        "encrypt",
        "rl add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present jun",
        "entries",
        "title error",
        "all ipv4",
        "reverse dns",
        "yara detections",
        "top source",
        "top destination",
        "source source",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "canada unknown",
        "content type",
        "javascript src",
        "script script",
        "x powered",
        "ipv4 add",
        "pulse submit",
        "submit url",
        "analysis",
        "url add",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "unknown aaaa",
        "ascii text",
        "user agent",
        "powershell",
        "agent",
        "czechia unknown",
        "domain add",
        "dynamicloader",
        "hostname add",
        "pentagon",
        "defense"
      ],
      "references": [
        "sentient.industries affects independent artists. Affects several others.",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Remotewd.com devices",
        "If you find anything interesting please research it."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "nUFS_inno",
          "display_name": "nUFS_inno",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious",
          "target": null
        },
        {
          "id": "ALF:JASYP:PUA:Win32/Bibado",
          "display_name": "ALF:JASYP:PUA:Win32/Bibado",
          "target": null
        },
        {
          "id": "Trojan:Win32/Toga",
          "display_name": "Trojan:Win32/Toga",
          "target": "/malware/Trojan:Win32/Toga"
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-149",
          "display_name": "Win.Trojan.Jorik-149",
          "target": null
        },
        {
          "id": "#LowFiDetectsVmWare",
          "display_name": "#LowFiDetectsVmWare",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-130",
          "display_name": "Win.Trojan.Jorik-130",
          "target": null
        },
        {
          "id": "Win.Trojan.Fakecodecs-119",
          "display_name": "Win.Trojan.Fakecodecs-119",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Bulz-9860169-0",
          "display_name": "Win.Trojan.Bulz-9860169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop.V!MTB",
          "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
          "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Win.Packed.Razy-9785185-0",
          "display_name": "Win.Packed.Razy-9785185-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "PWS",
          "display_name": "PWS",
          "target": null
        },
        {
          "id": "DDOS:Win32/Stormser.A",
          "display_name": "DDOS:Win32/Stormser.A",
          "target": "/malware/DDOS:Win32/Stormser.A"
        },
        {
          "id": "ALF:HSTR:DotNET",
          "display_name": "ALF:HSTR:DotNET",
          "target": null
        },
        {
          "id": "DotNET",
          "display_name": "DotNET",
          "target": null
        },
        {
          "id": "Script Exploit",
          "display_name": "Script Exploit",
          "target": null
        },
        {
          "id": "HackTool:Win32/AutoKMS",
          "display_name": "HackTool:Win32/AutoKMS",
          "target": "/malware/HackTool:Win32/AutoKMS"
        },
        {
          "id": "Xanfpezes.A",
          "display_name": "Xanfpezes.A",
          "target": null
        },
        {
          "id": "Trojan:Win32/Gandcrab",
          "display_name": "Trojan:Win32/Gandcrab",
          "target": "/malware/Trojan:Win32/Gandcrab"
        },
        {
          "id": "Win.Trojan.Generic-9862772-0",
          "display_name": "Win.Trojan.Generic-9862772-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBL!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
        },
        {
          "id": "Win32/Nemucod",
          "display_name": "Win32/Nemucod",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "target": null
        },
        {
          "id": "Trojan:Win32/Blihan.A",
          "display_name": "Trojan:Win32/Blihan.A",
          "target": "/malware/Trojan:Win32/Blihan.A"
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "Win.Malware.Kolab-9885903-0",
          "display_name": "Win.Malware.Kolab-9885903-0",
          "target": null
        },
        {
          "id": "Win.Malware (30)",
          "display_name": "Win.Malware (30)",
          "target": null
        },
        {
          "id": "Ransom",
          "display_name": "Ransom",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "target": null
        },
        {
          "id": "E5",
          "display_name": "E5",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 6232,
        "URL": 24908,
        "hostname": 7993,
        "FileHash-SHA256": 11128,
        "email": 6,
        "FileHash-MD5": 1054,
        "FileHash-SHA1": 932,
        "SSLCertFingerprint": 14,
        "CIDR": 3,
        "CVE": 3
      },
      "indicator_count": 52273,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "208 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66ce3eb4b4f1fc9eafb4b572",
      "name": "DDoS:Linux/Lightaidra | Mirai Botnet on US a State Computer",
      "description": "*Mirai Botnet on Colorado State computer. Im starting to wonder if potential problem cases are diverted to a botnet.\n1. Overlaps with a Colorado victim. Similar issues. I Recently became a senior in expensive Colorado, never compensated for workers compensation injury exacerbated when suddenly tossed a 60 lb weighted ball under care. Denied diagnoses of severe injury after toss. Complained, case closed, lawyers denied case after accepting case. Referred to JeffCo seeking assisted living resources. Was sent various packets with a variety of phone numbers, email addresses, etc. She keeps speaking to same man no matter what option chosen. Denied workforce training due to severity of injuries, No SSI or SSDI until years later. \n2. I can't pulse half of what I've researched without using multiple resources. No more 'contacted' made when new serious issues found. Pulses being modified. I rarely modify any pulse.",
      "modified": "2024-09-26T20:01:27.723000",
      "created": "2024-08-27T21:01:40.251000",
      "tags": [
        "memcommit",
        "read c",
        "nospltezraxuf",
        "writeconsolea",
        "write",
        "CVE-2023-22518",
        "tesla",
        "ye ye",
        "incapril",
        "yed ye",
        "yet ye",
        "yexe ye",
        "security",
        "search",
        "function read",
        "dll read",
        "installer",
        "april",
        "copy",
        "win32",
        "template",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "name servers",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse pulses",
        "date",
        "windows",
        "medium",
        "shellexecuteexw",
        "hash",
        "show",
        "writeconsolew",
        "entries",
        "displayname",
        "sddl",
        "service",
        "august",
        "malware",
        "url http",
        "http",
        "ip address",
        "related nids",
        "files location",
        "domain",
        "status",
        "nxdomain",
        "whitelisted",
        "certificate",
        "backdoor",
        "record value",
        "body",
        "as15133 verizon",
        "united",
        "unknown",
        "mtb aug",
        "gmt server",
        "ecacc sed5906",
        "ransom",
        "trojan",
        "high",
        "cname",
        "as8075",
        "ipv4",
        "files",
        "asn as55720",
        "date hash",
        "default",
        "delete",
        "yara detections",
        "msvisualcpp60",
        "related pulses",
        "rootkit",
        "as16276",
        "canada unknown",
        "pulses",
        "expiration date",
        "exploit",
        "showing",
        "aaaa",
        "france unknown",
        "mtb sep",
        "worm",
        "msil",
        "mirai",
        "as36081 state",
        "reverse dns",
        "port",
        "destination",
        "south korea",
        "taiwan as3462",
        "as4766 korea",
        "asnone",
        "japan as17676",
        "china as4134",
        "china as4837",
        "file samples",
        "files matching",
        "next",
        "copyright",
        "levelblue",
        "as20940",
        "as15169 google",
        "ave suite",
        "purpose p5",
        "country united",
        "code us",
        "as41231",
        "united kingdom",
        "ddos",
        "sha256",
        "filehash",
        "av detections",
        "location london",
        "great britain",
        "gnulinux apt",
        "yara rule",
        "ids detections",
        "top source",
        "address",
        "as23969",
        "thailand"
      ],
      "references": [
        "In this instance a senior citizen needing assisted living resources redirected & social engineered by addresses originated from: jefferson.co.us",
        "Noted: Calls redirected, call jumps ahead of 25+ callers in wait, keeps getting same agent, told approved for services never applied for or received",
        "Exploits: IPv4 20.99.186.246 | 52.109.0.140 | CVE CVE-2023-22518 | Trojans: AgentTesla.KM , Cobalt Strike , Ransom: WannaCrypt , Malware: Dxqo",
        "Domain Name: IUQERFSODP9IFJAPOSDFJHGOSURIJFAEWRWERGWEA.COM  Emails: BotnetSinkhole@gmail.com",
        "Emails: abuse@namecheap.com Name: Botnet Sinkhole  | Address: Botnet Sinkhole City: Los Angeles Country: USA",
        "Dnssec:Unsigned | Name Servers | BRUCE.NS.CLOUDFLARE.COM",
        "Notable: Mirai - 192.70.175.110 Security Operations (DORA?) oit_isocsecurity@state.co.us | state.co.us | Reverse DNS dns1.state.co.us",
        "Unix.Trojan.Mirai-6976991-0 : FileHash-SHA256 a282f250e59f8754335993293bfbfcc154cdb67ff0e234162f40a6cce5c4290c",
        "ELF:Mirai-AII\\ [Trj] | FileHash-SHA256 760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "Overlaps: 4 others mailed information email address.",
        "Ransom:Win32/WannaCrypt.H",
        "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com | CVE-2017-0147",
        "AS36081 State of Colorado General Government Computer",
        "Yara Detections Mirai_Botnet_Malware Alerts: dead_host network_icmp osquery_detection nolookup_communication",
        "ELF:Mirai-AII\\ [Trj]  | FileHash-SHA256:  760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "Detections Executable and linking format (ELF) file download Over HTTP |",
        "FileHash-SHA256 : 256760a17dea7794ebbfb5c54e7e74d0b53fd9e079e43be0b9b6e3df7eb14a47be9",
        "Yara Detections: UPXProtectorv10x2 ,  UPX ,  ELFHighEntropy ,  elf_empty_sections Alerts: dead_host | ELF:Mirai-AII\\ [Trj]",
        "77882 IP\u2019s Contacted: 1.1.69.67  1.10.237.208  1.101.233.31  1.102.46.59  1.103.37.126  1.105.106.252  1.106.108.182  1.106.193.143  1.109.132.165  1.11.116.209",
        "Domains Contacted: ntp.ubuntu.com | IDS Detections GNU/Linux APT User-Agent Outbound likely related to package management | 91.189.89.198",
        "Yara Detections: gafgyt IP\u2019s Contacted:  91.189.89.198 Domains Contacted :ntp.ubuntu.com",
        "FileHash-SHA256:  a0f50a7b0f9717589000b3414017bdcfcb9d3f6a3e5e03fe49c4dc8035e0d25c",
        "Related Domains: townofignacio.com | coloradoagriculture.com | coloradoworkforce.com | coworkforce.com | coloradoccjj.com | dns1.state.co.us",
        "https://www.rapidinterviews.com/api/jobs/redirect/public-transit-bus-drivers-with-utah-transit-authority-in-stansbury-park-apc-1932",
        "https://us.thebigjobsite.com/redirectfeedjob?jobid=2A5F97A6BAE0AA90DC418C2119E1E0EB&source=onestepjobsxmlus&utm_source=onestepjobsxmlus&jobSiteK",
        "redirect.wuxs.icu",
        "https://a-a.redirector.navexglobal.com/navex_hosting/404.html",
        "https://engage.navexglobal.com/topclass1/login.do?redirectTo=/expand.do?template=JasperReports&view=library"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:MSIL/AgentTesla.KM",
          "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
          "target": null
        },
        {
          "id": "Win.Trojan.CobaltStrike-9044898-1",
          "display_name": "Win.Trojan.CobaltStrike-9044898-1",
          "target": null
        },
        {
          "id": "Win.Malware.Dxqo-6984072-0",
          "display_name": "Win.Malware.Dxqo-6984072-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt",
          "display_name": "Ransom:Win32/WannaCrypt",
          "target": "/malware/Ransom:Win32/WannaCrypt"
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Fynloski",
          "display_name": "Backdoor:Win32/Fynloski",
          "target": "/malware/Backdoor:Win32/Fynloski"
        },
        {
          "id": "Worm:Win32/Mofksys",
          "display_name": "Worm:Win32/Mofksys",
          "target": "/malware/Worm:Win32/Mofksys"
        },
        {
          "id": "TELPER:DDoS:Linux/Lightaidra",
          "display_name": "TELPER:DDoS:Linux/Lightaidra",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1009",
          "name": "Binary Padding",
          "display_name": "T1009 - Binary Padding"
        },
        {
          "id": "T1499",
          "name": "Endpoint Denial of Service",
          "display_name": "T1499 - Endpoint Denial of Service"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        }
      ],
      "industries": [
        "Telecom"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "FileHash-MD5": 675,
        "FileHash-SHA1": 664,
        "FileHash-SHA256": 3327,
        "URL": 2448,
        "domain": 656,
        "hostname": 1281,
        "email": 11
      },
      "indicator_count": 9064,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "570 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6671e5844c155814e69ba4dd",
      "name": "Mirai Botnet Injection  affecting Alienvault.",
      "description": "It's unclear if some users or service itself is injecting users or if service is under a Mirai attack. I found evidence of both outbound & inbound activities.  *Crowdsourced context: Activity related to MIRAI - according to source Cluster25 - \nThis IPV4 is used by MIRAI. Mirai is a malware that created a big botnet of networked devices running Linux making them remotely controlled bots that can be used for large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers.\n#zbetcheckin tracker\nDownloaded on 2023-11-07 19:34:59 UTC\nSRC URL : http://171.228.209.167/x86_64\nIP : 171.228.209.167\nAS : AS7552 Viettel Group\nYARA : #contentis_base64 #debuggerpattern__rdtsc #ip #math_entropy_6 #is__elf #http #ft_elf #executable_elf64",
      "modified": "2024-07-18T19:02:50.386000",
      "created": "2024-06-18T19:52:36.849000",
      "tags": [
        "problems",
        "threat network",
        "infrastructure",
        "historical ssl",
        "microsoft stuff",
        "domain check",
        "referrer",
        "generic malware",
        "injector",
        "no data",
        "tag count",
        "fri mar",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "downloader",
        "generic",
        "united",
        "as14315",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "america asn",
        "unknown",
        "ransom",
        "body",
        "coinminer",
        "malware generic",
        "wed jan",
        "first",
        "status",
        "creation date",
        "search",
        "date",
        "expiration date",
        "name servers",
        "next",
        "mirai",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "reverse dns",
        "location lao",
        "viet nam",
        "domain",
        "all search",
        "otx scoreblue",
        "hostname",
        "files ip",
        "lazarus",
        "as7552 viettel",
        "vietnam unknown",
        "win32",
        "worm",
        "win32sfone jul",
        "vietnam",
        "etag",
        "telecom",
        "as16625 akamai",
        "as20940",
        "germany",
        "united kingdom",
        "singapore",
        "as20546 soprado",
        "hong kong",
        "as45102 alibaba",
        "taobao network",
        "cname",
        "aaaa",
        "entries",
        "showing",
        "a domains",
        "as38731 vietel",
        "plesk",
        "a li",
        "default page",
        "plesk a",
        "mirai variant",
        "useragent",
        "apache",
        "accept",
        "hello",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "create",
        "show",
        "medium",
        "dock",
        "execution",
        "copy",
        "xport",
        "address",
        "as131392",
        "cape",
        "orsam",
        "malware",
        "script urls",
        "moved",
        "record value",
        "cisco umbrella",
        "site",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "malicious site",
        "phishing site",
        "malicious url",
        "opencandy",
        "exploit",
        "agent",
        "phishing",
        "acint",
        "iframe",
        "crack",
        "conduit",
        "artemis",
        "riskware",
        "mimikatz",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "presenoker",
        "filetour",
        "cleaner",
        "wacatac",
        "outbreak",
        "installcore",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "related pulses",
        "whois",
        "related",
        "msil",
        "zombie",
        "dridex",
        "location viet",
        "pulse submit",
        "url analysis",
        "content",
        "google tag",
        "utc gcfezl5ynvb",
        "utc na",
        "utc google",
        "analytics na",
        "utc linkedin",
        "insight tag",
        "deep malware",
        "iframes",
        "trackers",
        "external-resources",
        "text/html",
        "elf info",
        "header class",
        "elf64 data",
        "header version",
        "os abi",
        "unix",
        "v object",
        "file type",
        "exec",
        "executable file",
        "progbits",
        "type address",
        "offset size",
        "flags",
        "null",
        "nobits",
        "strtab",
        "ip detections",
        "country",
        "us bundled",
        "detections file",
        "name",
        "graph summary",
        "get hello",
        "jaws webserver",
        "outbound",
        "mvpower dvr",
        "shell uce",
        "inbound",
        "activity mirai",
        "mirai",
        "info",
        "performs dns",
        "mitre att",
        "access ta0006",
        "os credential",
        "dumping t1003",
        "enumerates",
        "command",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "relacionada",
        "mirai malware",
        "mirai 04022024",
        "nciipc",
        "ip reputaion",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "china as37963",
        "simplified",
        "trojanspy",
        "virustotal",
        "panda",
        "detections type",
        "shell",
        "javascript",
        "dns replication",
        "files referring",
        "lookups",
        "as7552",
        "vhash",
        "ssdeep",
        "magic elf",
        "sysv",
        "trid elf",
        "executable",
        "linux",
        "elf executable",
        "loccel1",
        "echobot",
        "bashlite",
        "malwarebazaar",
        "echobot malware",
        "win32 exe",
        "magic msdos",
        "pe32 executable",
        "intel",
        "ms windows",
        "trid dos",
        "compiler",
        "delphi",
        "serial number",
        "algorithm",
        "thumbprint",
        "valid from",
        "code signing",
        "from",
        "microsoft root",
        "name microsoft",
        "verisign time",
        "stamping",
        "contained",
        "info sections",
        "name virtual",
        "address virtual",
        "size raw",
        "size entropy",
        "md5 chi2",
        "regsetvalueexa",
        "type rtrcdata",
        "sha256 file",
        "threat roundup",
        "october",
        "august",
        "june",
        "september",
        "highly targeted",
        "cyberstalking",
        "round",
        "december",
        "sneaky server",
        "facebook",
        "stealer",
        "agent tesla",
        "pony",
        "april",
        "whitelisted",
        "encrypt",
        "targeting",
        "tsara brashears",
        "otx",
        "alienvault",
        "memcommit",
        "regsz",
        "regopenkeyexw",
        "english",
        "module load",
        "t1129",
        "t1082",
        "windows module",
        "dlls",
        "redline stealer",
        "updater",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "data redacted",
        "cloudflare",
        "redacted",
        "for privacy",
        "code",
        "server",
        "registrar abuse",
        "redacted for",
        "postal code",
        "registrant name",
        "red team",
        "shit",
        "logistics",
        "cyber defense",
        "gootloader",
        "march",
        "sinkhole",
        "just",
        "ramnit",
        "netsupport rat",
        "microsoft",
        "vault",
        "karen",
        "gifts",
        "hidden privacy",
        "threats",
        "malicious",
        "darkgate",
        "core",
        "hacktool",
        "emotet"
      ],
      "references": [
        "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
        "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
        "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
        "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
        "https://otx.alienvault.com/indicator/domain/bunny.net",
        "https://otx.alienvault.com/indicator/ip/210.211.117.205",
        "https://otx.alienvault.com/indicator/ip/143.244.50.212",
        "https://otx.alienvault.com/indicator/ip/125.235.4.59",
        "AV Detection: ELF:Mirai-GH\\ [Trj]",
        "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
        "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
        "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
        "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
        "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
        "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
        "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
        "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
        "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
        "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com",
        "Was anyone else notified? I'm not sure why I was.",
        "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
        "CS Sigma: Matches rule Python Initiated Connection by frack113"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Unix.Trojan.Mirai-9441505-0",
          "display_name": "Unix.Trojan.Mirai-9441505-0",
          "target": null
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_mcv",
          "display_name": "ALF:E5.SpikeAex.rhh_mcv",
          "target": null
        },
        {
          "id": "Win.Dropper.Bulz-9910065-0",
          "display_name": "Win.Dropper.Bulz-9910065-0",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Win.Dropper.Autoit-6688751-0",
          "display_name": "Win.Dropper.Autoit-6688751-0",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Dropper.Dridex-9986041-0",
          "display_name": "Win.Dropper.Dridex-9986041-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Zombie",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Zombie",
          "target": null
        },
        {
          "id": "Win.Packer.pkr_ce1a-9980177-0",
          "display_name": "Win.Packer.pkr_ce1a-9980177-0",
          "target": null
        },
        {
          "id": "Worm:Win32/Sfone.A",
          "display_name": "Worm:Win32/Sfone.A",
          "target": "/malware/Worm:Win32/Sfone.A"
        },
        {
          "id": "Worm:Win32/Sfone",
          "display_name": "Worm:Win32/Sfone",
          "target": "/malware/Worm:Win32/Sfone"
        },
        {
          "id": "Win.Malware.Bbabdcdc-7358312-0",
          "display_name": "Win.Malware.Bbabdcdc-7358312-0",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "trojan.mirai/fszhh",
          "display_name": "trojan.mirai/fszhh",
          "target": null
        },
        {
          "id": "DDOS:Linux/Mirai",
          "display_name": "DDOS:Linux/Mirai",
          "target": "/malware/DDOS:Linux/Mirai"
        },
        {
          "id": "ANDROID/AVE.Mirai.fszhh",
          "display_name": "ANDROID/AVE.Mirai.fszhh",
          "target": null
        },
        {
          "id": "Flyagent L",
          "display_name": "Flyagent L",
          "target": null
        },
        {
          "id": "Win-Trojan/Malpacked5.Gen",
          "display_name": "Win-Trojan/Malpacked5.Gen",
          "target": null
        },
        {
          "id": "Atros3.LDJ",
          "display_name": "Atros3.LDJ",
          "target": null
        },
        {
          "id": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
          "display_name": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Gucotut.A",
          "display_name": "TrojanSpy:Win32/Gucotut.A",
          "target": "/malware/TrojanSpy:Win32/Gucotut.A"
        },
        {
          "id": "W32/Pidgeon-A",
          "display_name": "W32/Pidgeon-A",
          "target": null
        },
        {
          "id": "Variant.Zusy.151902",
          "display_name": "Variant.Zusy.151902",
          "target": null
        },
        {
          "id": "trojan.mirai/fedr",
          "display_name": "trojan.mirai/fedr",
          "target": null
        },
        {
          "id": "Win.Malware.Trojanx-9862538-0",
          "display_name": "Win.Malware.Trojanx-9862538-0",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen\\ [Trj]",
          "display_name": "Win32:PWSX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "virus.ramnit/nimnul",
          "display_name": "virus.ramnit/nimnul",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 351,
        "FileHash-SHA1": 349,
        "FileHash-SHA256": 3715,
        "domain": 3326,
        "hostname": 5200,
        "URL": 13151,
        "email": 9,
        "CVE": 7,
        "CIDR": 2
      },
      "indicator_count": 26110,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 243,
      "modified_text": "640 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "defaultwin.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "defaultwin.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776681840.1258078
}