{
  "type": "Domain",
  "indicator": "gosocket.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/gosocket.net",
    "alexa": "http://www.alexa.com/siteinfo/gosocket.net",
    "indicator": "gosocket.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3215330782,
      "indicator": "gosocket.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6615d6998eba463f36adf923",
          "name": "hxxps://viz[.]greynoise[.]io/analysis/22fe6389-fe4a-49dc-b343-b6a2feb32864 - 04.04.24 by jwanihad (enriched)",
          "description": "",
          "modified": "2025-06-23T17:53:11.641000",
          "created": "2024-04-10T00:00:25.617000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/gui/collection/789999053bd7022e2d79a887a5f959be573ce57d6c4f3165503438fbd5dd9ad5/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2361,
            "domain": 632,
            "FileHash-SHA256": 644,
            "hostname": 918
          },
          "indicator_count": 4555,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 187,
          "modified_text": "341 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "660b176a98b0c92ba5a962bc",
          "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
          "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
          "modified": "2024-09-04T05:01:56.993000",
          "created": "2024-04-01T20:22:02.851000",
          "tags": [
            "BEC"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
            "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
            "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
            "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
            "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 233,
            "FileHash-SHA1": 230,
            "FileHash-SHA256": 6703,
            "URL": 4450,
            "CIDR": 3,
            "domain": 6223,
            "hostname": 2863,
            "email": 7,
            "CVE": 53
          },
          "indicator_count": 20765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "634 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "668115d703e0a46887c7f08d",
          "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware",
          "description": "Targeted Individual has experienced attacks on both iOS, Android, MacBooks & PC's. Drive-by Compromise can be accomplished by various methods this can be done, for example: A pop up advert could have an 'X' in the corner that disguises itself as a close button, but actually acts as a catalyst for starting a malicious download once pressed. A tactic used on specific target is a pop-up w/with (a non-Google affiliated disclaimer)'Google' account chooser with Google logo desired email checked. [https://accounts.google.com/AccountChooser?]; checked. Every time TB acquired a new phone, this occurs. A link could appear legitimate, but clicking on it could cause the download to begin. Drive-by Compromise \u00b7 A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript.",
          "modified": "2024-07-30T08:04:39.977000",
          "created": "2024-06-30T08:22:47.783000",
          "tags": [
            "vj83",
            "tsara brashears",
            "malware",
            "password bypass",
            "problems",
            "threat network",
            "infrastructure",
            "checking",
            "china",
            "iocs",
            "download",
            "relic",
            "monitoring",
            "installer",
            "graph",
            "server",
            "domain status",
            "date",
            "code",
            "country",
            "registrar abuse",
            "registrar",
            "whois lookup",
            "admin city",
            "redmond admin",
            "analyzer paste",
            "urls http",
            "z1277946686",
            "slfrd1",
            "uiebaae",
            "jid960554243",
            "samples",
            "malicious url",
            "z1767086795",
            "no data",
            "tag count",
            "count blacklist",
            "tag tag",
            "sample29",
            "team alexa",
            "million",
            "alexa",
            "site",
            "cisco umbrella",
            "hostname",
            "united",
            "mail spammer",
            "malicious site",
            "covid19",
            "cyber threat",
            "filerepmalware",
            "phishing site",
            "heur",
            "engineering",
            "keybase",
            "bank",
            "malicious",
            "artemis",
            "phishing",
            "div div",
            "domain",
            "passive dns",
            "creation date",
            "as46606",
            "content type",
            "script script",
            "a div",
            "unknown",
            "meta",
            "process32nextw",
            "medium",
            "wizard",
            "registry",
            "module load",
            "t1129",
            "registry run",
            "keys",
            "t1060",
            "memcommit",
            "win32",
            "service",
            "explorer",
            "june",
            "copy",
            "delphi",
            "tools",
            "persistence",
            "execution",
            "capture",
            "a dd",
            "h3 p",
            "search",
            "aaaa",
            "free",
            "p div",
            "virtool",
            "form",
            "window",
            "next",
            "status",
            "record value",
            "showing",
            "cname",
            "gmt content",
            "body",
            "pulses",
            "urls",
            "files ip",
            "address",
            "location united",
            "asn as13335",
            "whois registrar",
            "as8075",
            "access",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "yara detections",
            "push",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "sec ch",
            "xml base64",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "whois",
            "trojan",
            "entries",
            "gmt server",
            "centos",
            "ransom",
            "detection list",
            "alexa top",
            "bluehost",
            "e emeseieee",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dynamicloader",
            "cryptowall",
            "malware beacon",
            "suspicious",
            "zeus",
            "write",
            "bits",
            "date hash",
            "avast avg",
            "mtb dec",
            "script urls",
            "typeof",
            "script domains",
            "as54600 peg",
            "li ol",
            "apple",
            "ios",
            "samsung",
            "tracking",
            "ms windows",
            "pe32",
            "read c",
            "intel",
            "pe32 executable",
            "qt translation",
            "regsetvalueexa",
            "write c",
            "show",
            "april",
            "observer",
            "stream",
            "local",
            "e eue",
            "goatsinacoat"
          ],
          "references": [
            "espysite.azurewebsites.net",
            "http://45.159.189.105/bot/regex [command and control infection source]",
            "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
            "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
            "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11",
            "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858",
            "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
            "https://twitter.com/PORNO_SEXYBABES",
            "https://adservice.google.com.uy/clk\t init.ess.apple.com",
            "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin  Lockbin1.com",
            "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl  crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js  tracking.minitool.com launch.php",
            "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t  Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net",
            "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294",
            "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS",
            "Alerts:  stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook",
            "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile",
            "Domains Contacted: cdn2.minitool.com www.partitionwizard.com",
            "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd",
            "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419",
            "samsungdevapi.reverselogix.net",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a",
            "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570  CVE-2018-8453  CVE-2014-0160",
            "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/",
            "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf",
            "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77",
            "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf",
            "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
            "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com",
            "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools",
            "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6",
            "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f",
            "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c",
            "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef",
            "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37",
            "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip",
            "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]",
            "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh",
            "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/",
            "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/",
            "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
            "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t  URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795",
            "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))",
            "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com",
            "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
            "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "PWS:Win32/Ymacco",
              "display_name": "PWS:Win32/Ymacco",
              "target": "/malware/PWS:Win32/Ymacco"
            },
            {
              "id": "Win.Malware.Swisyn-7610494-0",
              "display_name": "Win.Malware.Swisyn-7610494-0",
              "target": null
            },
            {
              "id": "Win32:VB-AJKP\\ [Trj]",
              "display_name": "Win32:VB-AJKP\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Malware.Drivepack-9884589-1",
              "display_name": "Win.Malware.Drivepack-9884589-1",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Injector.AB!MSR",
              "display_name": "TEL:Trojan:Win32/Injector.AB!MSR",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Targeted Individuals"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1324,
            "FileHash-SHA1": 931,
            "FileHash-SHA256": 2209,
            "URL": 1572,
            "hostname": 1628,
            "domain": 1711,
            "email": 10,
            "CVE": 5,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9392,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "670 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f270d3801ae3dfde1cd0",
          "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware ",
          "description": "",
          "modified": "2024-07-30T08:04:39.977000",
          "created": "2024-07-01T00:04:00.567000",
          "tags": [
            "vj83",
            "tsara brashears",
            "malware",
            "password bypass",
            "problems",
            "threat network",
            "infrastructure",
            "checking",
            "china",
            "iocs",
            "download",
            "relic",
            "monitoring",
            "installer",
            "graph",
            "server",
            "domain status",
            "date",
            "code",
            "country",
            "registrar abuse",
            "registrar",
            "whois lookup",
            "admin city",
            "redmond admin",
            "analyzer paste",
            "urls http",
            "z1277946686",
            "slfrd1",
            "uiebaae",
            "jid960554243",
            "samples",
            "malicious url",
            "z1767086795",
            "no data",
            "tag count",
            "count blacklist",
            "tag tag",
            "sample29",
            "team alexa",
            "million",
            "alexa",
            "site",
            "cisco umbrella",
            "hostname",
            "united",
            "mail spammer",
            "malicious site",
            "covid19",
            "cyber threat",
            "filerepmalware",
            "phishing site",
            "heur",
            "engineering",
            "keybase",
            "bank",
            "malicious",
            "artemis",
            "phishing",
            "div div",
            "domain",
            "passive dns",
            "creation date",
            "as46606",
            "content type",
            "script script",
            "a div",
            "unknown",
            "meta",
            "process32nextw",
            "medium",
            "wizard",
            "registry",
            "module load",
            "t1129",
            "registry run",
            "keys",
            "t1060",
            "memcommit",
            "win32",
            "service",
            "explorer",
            "june",
            "copy",
            "delphi",
            "tools",
            "persistence",
            "execution",
            "capture",
            "a dd",
            "h3 p",
            "search",
            "aaaa",
            "free",
            "p div",
            "virtool",
            "form",
            "window",
            "next",
            "status",
            "record value",
            "showing",
            "cname",
            "gmt content",
            "body",
            "pulses",
            "urls",
            "files ip",
            "address",
            "location united",
            "asn as13335",
            "whois registrar",
            "as8075",
            "access",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "yara detections",
            "push",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "sec ch",
            "xml base64",
            "ch ua",
            "ua full",
            "ua platform",
            "moved",
            "whois",
            "trojan",
            "entries",
            "gmt server",
            "centos",
            "ransom",
            "detection list",
            "alexa top",
            "bluehost",
            "e emeseieee",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dynamicloader",
            "cryptowall",
            "malware beacon",
            "suspicious",
            "zeus",
            "write",
            "bits",
            "date hash",
            "avast avg",
            "mtb dec",
            "script urls",
            "typeof",
            "script domains",
            "as54600 peg",
            "li ol",
            "apple",
            "ios",
            "samsung",
            "tracking",
            "ms windows",
            "pe32",
            "read c",
            "intel",
            "pe32 executable",
            "qt translation",
            "regsetvalueexa",
            "write c",
            "show",
            "april",
            "observer",
            "stream",
            "local",
            "e eue",
            "goatsinacoat"
          ],
          "references": [
            "espysite.azurewebsites.net",
            "http://45.159.189.105/bot/regex [command and control infection source]",
            "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
            "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
            "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11",
            "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858",
            "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
            "https://twitter.com/PORNO_SEXYBABES",
            "https://adservice.google.com.uy/clk\t init.ess.apple.com",
            "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin  Lockbin1.com",
            "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl  crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js  tracking.minitool.com launch.php",
            "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t  Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net",
            "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294",
            "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS",
            "Alerts:  stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook",
            "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile",
            "Domains Contacted: cdn2.minitool.com www.partitionwizard.com",
            "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd",
            "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419",
            "samsungdevapi.reverselogix.net",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
            "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af",
            "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a",
            "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570  CVE-2018-8453  CVE-2014-0160",
            "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/",
            "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf",
            "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77",
            "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf",
            "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
            "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com",
            "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools",
            "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9",
            "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6",
            "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f",
            "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c",
            "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef",
            "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37",
            "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip",
            "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]",
            "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh",
            "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/",
            "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/",
            "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
            "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t  URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795",
            "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))",
            "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com",
            "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
            "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "PWS:Win32/Ymacco",
              "display_name": "PWS:Win32/Ymacco",
              "target": "/malware/PWS:Win32/Ymacco"
            },
            {
              "id": "Win.Malware.Swisyn-7610494-0",
              "display_name": "Win.Malware.Swisyn-7610494-0",
              "target": null
            },
            {
              "id": "Win32:VB-AJKP\\ [Trj]",
              "display_name": "Win32:VB-AJKP\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Malware.Drivepack-9884589-1",
              "display_name": "Win.Malware.Drivepack-9884589-1",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Injector.AB!MSR",
              "display_name": "TEL:Trojan:Win32/Injector.AB!MSR",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti.A",
              "display_name": "Ransom:Win32/Crowti.A",
              "target": "/malware/Ransom:Win32/Crowti.A"
            },
            {
              "id": "Zeus",
              "display_name": "Zeus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Targeted Individuals"
          ],
          "TLP": "green",
          "cloned_from": "668115d703e0a46887c7f08d",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1324,
            "FileHash-SHA1": 931,
            "FileHash-SHA256": 2209,
            "URL": 1572,
            "hostname": 1628,
            "domain": 1711,
            "email": 10,
            "CVE": 5,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9392,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "670 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c3bd803f15cd94aab6e287",
          "name": "Lumma Stealer | Colorado Medical Center HCA",
          "description": "Needs further investigation. Miscellaneous attack affecting Denver physicians directory. Visitors accessing the page using insecure devices may be affected. PII & PHI breached. Monitoring.",
          "modified": "2024-03-08T17:04:03.644000",
          "created": "2024-02-07T17:27:28.349000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "resolutions",
            "problems",
            "siblings domain",
            "whois whois",
            "startpage",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "language",
            "html document",
            "unicode text",
            "utf8 text",
            "doctype",
            "anchor hrefs",
            "hrefs",
            "denver",
            "tsara brashears",
            "apple ios",
            "password bypass",
            "apple phone",
            "unlocker",
            "shell code",
            "script",
            "contacted urls",
            "hacktool",
            "malicious",
            "download",
            "malware",
            "relic",
            "monitoring",
            "domains",
            "eurodns sa",
            "markmonitor",
            "ip detections",
            "country",
            "graph",
            "https",
            "mitre att",
            "ta0007 network",
            "t1046 sends",
            "ssdp",
            "command",
            "control ta0011",
            "protocol t1071",
            "performs dns",
            "layer protocol",
            "number",
            "cus cndigicert",
            "ja3s",
            "subject",
            "sha2 secure",
            "server ca",
            "odigicert inc",
            "cus cnmicrosoft",
            "algorithm",
            "memory pattern",
            "file system",
            "registry",
            "registry keys",
            "process",
            "created",
            "processes tree",
            "february",
            "healthone",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "url https",
            "reverse dns",
            "general full",
            "security tls",
            "protocol h2",
            "software",
            "frankfurt",
            "main",
            "germany",
            "resource hash",
            "de indicators",
            "hashes",
            "value",
            "scriptsrcelem",
            "variables",
            "boomrmq string",
            "boomrapikey",
            "boomr function",
            "system",
            "babelpolyfill",
            "assign function",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "aes256gcm",
            "level",
            "akamaiasn1",
            "europeberlin",
            "generic malware",
            "tag count",
            "tue dec",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "root ca",
            "pattern match",
            "authority",
            "span",
            "presbyterianst",
            "luke",
            "medical center",
            "class",
            "accept",
            "date",
            "refresh",
            "blood",
            "liver cancer",
            "breast cancer",
            "lung cancer",
            "kidney cancer",
            "skin cancer",
            "sarcoma",
            "prostate cancer",
            "body",
            "facebook",
            "twitter",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "cookie",
            "command and control",
            "mitre",
            "scanning host",
            "exploit source",
            "trojan",
            "callback function",
            "targets",
            "targeting",
            "samesite=none",
            "kde",
            "konqueror",
            "phi",
            "pii",
            "wTJh.exe",
            "malware ransom trojan evader rat",
            "network",
            "rat trojan",
            "relacionada",
            "critical risk",
            "cyberstalking",
            "elf collection",
            "matches rule",
            "emotet",
            "lockbit",
            "critical",
            "copy",
            "installer",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "ursnif",
            "core",
            "as55688 pt",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "asn as55688",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "united",
            "aaaa",
            "unknown",
            "a domains",
            "search",
            "creation date",
            "record value",
            "next",
            "pornhub",
            "anyxxxtube",
            "domain",
            "gandi sas",
            "hostname",
            "basic",
            "pe32",
            "intel",
            "ms windows",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "pe32 packer",
            "petite",
            "vs98",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "rticon neutral",
            "overlay",
            "dos exe",
            "threat roundup",
            "pe resource",
            "june",
            "lumma stealer",
            "ransomexx",
            "azorult",
            "njrat",
            "open",
            "problem",
            "plugx",
            "android",
            "sex_phot.jpg.exe",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "delphi generic",
            "icons library",
            "pe32 linker",
            "lcc linker",
            "empty hash",
            "tulach",
            "sabey",
            "rat",
            "remote",
            "remote access trojan"
          ],
          "references": [
            "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
            "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
            "www2.megawebfind.com [command and control]",
            "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
            "20.99.186.246 [exploit source]",
            "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
            "Win32:RATX-gen [Trj] identified.",
            "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
            "CS Sigma Rules: Disable UAC Using Registry by frack113",
            "http://45.159.189.105/bot/regex [ tracking | botnet]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
            "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "Remote Access Trojan"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Indonesia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Win32:RATX-gen [Trj]",
              "display_name": "Win32:RATX-gen [Trj]",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "W32/Hupigon.NCU",
              "display_name": "W32/Hupigon.NCU",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Azorult",
              "display_name": "Azorult",
              "target": null
            },
            {
              "id": "Wiper",
              "display_name": "Wiper",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 68,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 883,
            "URL": 1412,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 231,
            "FileHash-SHA256": 2909,
            "domain": 824,
            "email": 3,
            "CVE": 3
          },
          "indicator_count": 6548,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS",
        "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh",
        "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "http://45.159.189.105/bot/regex [command and control infection source]",
        "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com",
        "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t  Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net",
        "http://45.159.189.105/bot/regex [ tracking | botnet]",
        "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
        "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
        "20.99.186.246 [exploit source]",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c",
        "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/",
        "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294",
        "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf",
        "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f",
        "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/",
        "Win32:RATX-gen [Trj] identified.",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/",
        "CS Sigma Rules: Disable UAC Using Registry by frack113",
        "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6",
        "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37",
        "samsungdevapi.reverselogix.net",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293",
        "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11",
        "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "Domains Contacted: cdn2.minitool.com www.partitionwizard.com",
        "https://twitter.com/PORNO_SEXYBABES",
        "www2.megawebfind.com [command and control]",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]",
        "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com",
        "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
        "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8",
        "espysite.azurewebsites.net",
        "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77",
        "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin  Lockbin1.com",
        "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
        "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools",
        "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t  URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795",
        "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
        "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com",
        "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile",
        "https://adservice.google.com.uy/clk\t init.ess.apple.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
        "Remote Access Trojan",
        "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip",
        "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl  crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js  tracking.minitool.com launch.php",
        "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies",
        "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf",
        "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570  CVE-2018-8453  CVE-2014-0160",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "Alerts:  stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook",
        "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9",
        "https://www.virustotal.com/gui/collection/789999053bd7022e2d79a887a5f959be573ce57d6c4f3165503438fbd5dd9ad5/graph"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ransom:win32/crowti.a",
            "Cobalt strike",
            "Zeus",
            "Relic",
            "Azorult",
            "Tel:trojan:win32/injector.ab!msr",
            "Ursnif",
            "Win32:vb-ajkp\\ [trj]",
            "Tulach",
            "Wiper",
            "Win.malware.swisyn-7610494-0",
            "Pws:win32/ymacco",
            "Win32:ratx-gen [trj]",
            "Ransomware",
            "Lockbit",
            "Dark power",
            "Hacktool",
            "Virut",
            "Lumma stealer",
            "Win.malware.drivepack-9884589-1",
            "W32/hupigon.ncu"
          ],
          "industries": [
            "Targeted individuals",
            "Technology",
            "Education",
            "Government",
            "Civil society",
            "Healthcare"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6615d6998eba463f36adf923",
      "name": "hxxps://viz[.]greynoise[.]io/analysis/22fe6389-fe4a-49dc-b343-b6a2feb32864 - 04.04.24 by jwanihad (enriched)",
      "description": "",
      "modified": "2025-06-23T17:53:11.641000",
      "created": "2024-04-10T00:00:25.617000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/gui/collection/789999053bd7022e2d79a887a5f959be573ce57d6c4f3165503438fbd5dd9ad5/graph"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2361,
        "domain": 632,
        "FileHash-SHA256": 644,
        "hostname": 918
      },
      "indicator_count": 4555,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 187,
      "modified_text": "341 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "660b176a98b0c92ba5a962bc",
      "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
      "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
      "modified": "2024-09-04T05:01:56.993000",
      "created": "2024-04-01T20:22:02.851000",
      "tags": [
        "BEC"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 233,
        "FileHash-SHA1": 230,
        "FileHash-SHA256": 6703,
        "URL": 4450,
        "CIDR": 3,
        "domain": 6223,
        "hostname": 2863,
        "email": 7,
        "CVE": 53
      },
      "indicator_count": 20765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "634 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "668115d703e0a46887c7f08d",
      "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware",
      "description": "Targeted Individual has experienced attacks on both iOS, Android, MacBooks & PC's. Drive-by Compromise can be accomplished by various methods this can be done, for example: A pop up advert could have an 'X' in the corner that disguises itself as a close button, but actually acts as a catalyst for starting a malicious download once pressed. A tactic used on specific target is a pop-up w/with (a non-Google affiliated disclaimer)'Google' account chooser with Google logo desired email checked. [https://accounts.google.com/AccountChooser?]; checked. Every time TB acquired a new phone, this occurs. A link could appear legitimate, but clicking on it could cause the download to begin. Drive-by Compromise \u00b7 A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript.",
      "modified": "2024-07-30T08:04:39.977000",
      "created": "2024-06-30T08:22:47.783000",
      "tags": [
        "vj83",
        "tsara brashears",
        "malware",
        "password bypass",
        "problems",
        "threat network",
        "infrastructure",
        "checking",
        "china",
        "iocs",
        "download",
        "relic",
        "monitoring",
        "installer",
        "graph",
        "server",
        "domain status",
        "date",
        "code",
        "country",
        "registrar abuse",
        "registrar",
        "whois lookup",
        "admin city",
        "redmond admin",
        "analyzer paste",
        "urls http",
        "z1277946686",
        "slfrd1",
        "uiebaae",
        "jid960554243",
        "samples",
        "malicious url",
        "z1767086795",
        "no data",
        "tag count",
        "count blacklist",
        "tag tag",
        "sample29",
        "team alexa",
        "million",
        "alexa",
        "site",
        "cisco umbrella",
        "hostname",
        "united",
        "mail spammer",
        "malicious site",
        "covid19",
        "cyber threat",
        "filerepmalware",
        "phishing site",
        "heur",
        "engineering",
        "keybase",
        "bank",
        "malicious",
        "artemis",
        "phishing",
        "div div",
        "domain",
        "passive dns",
        "creation date",
        "as46606",
        "content type",
        "script script",
        "a div",
        "unknown",
        "meta",
        "process32nextw",
        "medium",
        "wizard",
        "registry",
        "module load",
        "t1129",
        "registry run",
        "keys",
        "t1060",
        "memcommit",
        "win32",
        "service",
        "explorer",
        "june",
        "copy",
        "delphi",
        "tools",
        "persistence",
        "execution",
        "capture",
        "a dd",
        "h3 p",
        "search",
        "aaaa",
        "free",
        "p div",
        "virtool",
        "form",
        "window",
        "next",
        "status",
        "record value",
        "showing",
        "cname",
        "gmt content",
        "body",
        "pulses",
        "urls",
        "files ip",
        "address",
        "location united",
        "asn as13335",
        "whois registrar",
        "as8075",
        "access",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "yara detections",
        "push",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "sec ch",
        "xml base64",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "whois",
        "trojan",
        "entries",
        "gmt server",
        "centos",
        "ransom",
        "detection list",
        "alexa top",
        "bluehost",
        "e emeseieee",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dynamicloader",
        "cryptowall",
        "malware beacon",
        "suspicious",
        "zeus",
        "write",
        "bits",
        "date hash",
        "avast avg",
        "mtb dec",
        "script urls",
        "typeof",
        "script domains",
        "as54600 peg",
        "li ol",
        "apple",
        "ios",
        "samsung",
        "tracking",
        "ms windows",
        "pe32",
        "read c",
        "intel",
        "pe32 executable",
        "qt translation",
        "regsetvalueexa",
        "write c",
        "show",
        "april",
        "observer",
        "stream",
        "local",
        "e eue",
        "goatsinacoat"
      ],
      "references": [
        "espysite.azurewebsites.net",
        "http://45.159.189.105/bot/regex [command and control infection source]",
        "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11",
        "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858",
        "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://adservice.google.com.uy/clk\t init.ess.apple.com",
        "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin  Lockbin1.com",
        "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl  crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js  tracking.minitool.com launch.php",
        "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t  Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net",
        "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294",
        "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS",
        "Alerts:  stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook",
        "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile",
        "Domains Contacted: cdn2.minitool.com www.partitionwizard.com",
        "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd",
        "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419",
        "samsungdevapi.reverselogix.net",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a",
        "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570  CVE-2018-8453  CVE-2014-0160",
        "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/",
        "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf",
        "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77",
        "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf",
        "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com",
        "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools",
        "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c",
        "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef",
        "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37",
        "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip",
        "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]",
        "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh",
        "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/",
        "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/",
        "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t  URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795",
        "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))",
        "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com",
        "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "PWS:Win32/Ymacco",
          "display_name": "PWS:Win32/Ymacco",
          "target": "/malware/PWS:Win32/Ymacco"
        },
        {
          "id": "Win.Malware.Swisyn-7610494-0",
          "display_name": "Win.Malware.Swisyn-7610494-0",
          "target": null
        },
        {
          "id": "Win32:VB-AJKP\\ [Trj]",
          "display_name": "Win32:VB-AJKP\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Malware.Drivepack-9884589-1",
          "display_name": "Win.Malware.Drivepack-9884589-1",
          "target": null
        },
        {
          "id": "TEL:Trojan:Win32/Injector.AB!MSR",
          "display_name": "TEL:Trojan:Win32/Injector.AB!MSR",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Targeted Individuals"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1324,
        "FileHash-SHA1": 931,
        "FileHash-SHA256": 2209,
        "URL": 1572,
        "hostname": 1628,
        "domain": 1711,
        "email": 10,
        "CVE": 5,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9392,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "670 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f270d3801ae3dfde1cd0",
      "name": "Drive-by Compromise | TEL:Trojan:Win32/Injector | Zeus | Ransomware ",
      "description": "",
      "modified": "2024-07-30T08:04:39.977000",
      "created": "2024-07-01T00:04:00.567000",
      "tags": [
        "vj83",
        "tsara brashears",
        "malware",
        "password bypass",
        "problems",
        "threat network",
        "infrastructure",
        "checking",
        "china",
        "iocs",
        "download",
        "relic",
        "monitoring",
        "installer",
        "graph",
        "server",
        "domain status",
        "date",
        "code",
        "country",
        "registrar abuse",
        "registrar",
        "whois lookup",
        "admin city",
        "redmond admin",
        "analyzer paste",
        "urls http",
        "z1277946686",
        "slfrd1",
        "uiebaae",
        "jid960554243",
        "samples",
        "malicious url",
        "z1767086795",
        "no data",
        "tag count",
        "count blacklist",
        "tag tag",
        "sample29",
        "team alexa",
        "million",
        "alexa",
        "site",
        "cisco umbrella",
        "hostname",
        "united",
        "mail spammer",
        "malicious site",
        "covid19",
        "cyber threat",
        "filerepmalware",
        "phishing site",
        "heur",
        "engineering",
        "keybase",
        "bank",
        "malicious",
        "artemis",
        "phishing",
        "div div",
        "domain",
        "passive dns",
        "creation date",
        "as46606",
        "content type",
        "script script",
        "a div",
        "unknown",
        "meta",
        "process32nextw",
        "medium",
        "wizard",
        "registry",
        "module load",
        "t1129",
        "registry run",
        "keys",
        "t1060",
        "memcommit",
        "win32",
        "service",
        "explorer",
        "june",
        "copy",
        "delphi",
        "tools",
        "persistence",
        "execution",
        "capture",
        "a dd",
        "h3 p",
        "search",
        "aaaa",
        "free",
        "p div",
        "virtool",
        "form",
        "window",
        "next",
        "status",
        "record value",
        "showing",
        "cname",
        "gmt content",
        "body",
        "pulses",
        "urls",
        "files ip",
        "address",
        "location united",
        "asn as13335",
        "whois registrar",
        "as8075",
        "access",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "yara detections",
        "push",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "sec ch",
        "xml base64",
        "ch ua",
        "ua full",
        "ua platform",
        "moved",
        "whois",
        "trojan",
        "entries",
        "gmt server",
        "centos",
        "ransom",
        "detection list",
        "alexa top",
        "bluehost",
        "e emeseieee",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dynamicloader",
        "cryptowall",
        "malware beacon",
        "suspicious",
        "zeus",
        "write",
        "bits",
        "date hash",
        "avast avg",
        "mtb dec",
        "script urls",
        "typeof",
        "script domains",
        "as54600 peg",
        "li ol",
        "apple",
        "ios",
        "samsung",
        "tracking",
        "ms windows",
        "pe32",
        "read c",
        "intel",
        "pe32 executable",
        "qt translation",
        "regsetvalueexa",
        "write c",
        "show",
        "april",
        "observer",
        "stream",
        "local",
        "e eue",
        "goatsinacoat"
      ],
      "references": [
        "espysite.azurewebsites.net",
        "http://45.159.189.105/bot/regex [command and control infection source]",
        "http://update.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "http://www.partitionwizard.com/checking-update/ko/verconfig-v11-registered.txt",
        "http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11",
        "http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858",
        "http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://adservice.google.com.uy/clk\t init.ess.apple.com",
        "WinToFlash-Lite-The-Bootable-USB-Creator-1.13.0000-Setup.exe | Setup.Bin  Lockbin1.com",
        "crl.globalsign.com\tWinPCA.crl gscodesigng2.crl  crl.globalsign.net root.crl crl.microsoft.com WinPCA.crl analytics.js  tracking.minitool.com launch.php",
        "VTBehaviour.CommonDataStirage.GoogleAPIs.com\t  Playatoms-pa.googleapis.com SongCulture.com bam.nr-data.net",
        "https://www.google.co.kr/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-686301-28&cid=1048899291.1595287580&jid=1064984308&_v=j83&z=1277946686&slf_rd=1&random=491737294",
        "Yara Detections: Delphi , ProtectSharewareV11eCompservCMS",
        "Alerts:  stops_service network_icmp network_irc persistence_autorun creates_largekey antisandbox_mouse_hook",
        "Alerts: infostealer_keylogger rat_pcclient process_interest injection_resumethread stealth_hiddenfile",
        "Domains Contacted: cdn2.minitool.com www.partitionwizard.com",
        "https://otx.alienvault.com/indicator/file/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "PWS:Win32/Ymacco: FileHash-SHA256 22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "PWS:Win32/Ymacco: FileHash-MD5 0145b299e0d988750bd",
        "PWS:Win32/Ymacco: FileHash-SHA1 05d3eef1b402fcceced24bd5e8cc3d613c311419",
        "samsungdevapi.reverselogix.net",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/22e8de5785b65790950eeef5e81dadf9acd44d7767399f8a88bab8b7059b1269",
        "https://otx.alienvault.com/indicator/hostname/www.partitionwizard.com",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA256 3a8d5782cd3335cb19bc9f1588a9303e7c8bf46aa0a6dd8d9a8fbada0dc23293",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-MD5 502983a98c69c012c600e2a2a7b2a1af",
        "TEL:Trojan:Win32/Injector.AB!MSR: FileHash-SHA1 217eed43662f43704c5c65bbdb503699b8689d6a",
        "CVE-2017-0147 CVE-2017-11882 CVE-2017-8570  CVE-2018-8453  CVE-2014-0160",
        "https://otx.alienvault.com/indicator/url/http://www.pulsesolutions.com/WebService/EasyLoggerWebService.asmx/",
        "Ransom:Win32/Crowti.A: FileHash-SHA256 3328a110970be661ce1267a553fa2ddf",
        "Ransom:Win32/Crowti.A: FileHash-SHA1 f7e6be8e6b15e4c67d82ec663abee6f0a292ff77",
        "Ransom:Win32/Crowti.A: FileHash-MD5 3328a110970be661ce1267a553fa2ddf",
        "https://otx.alienvault.com/indicator/file/94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com",
        "Alerts: procmem_yara injection_inter_process injection_create_remote_thread antiav_servicestop suricata_alert suspicious_command_tools",
        "Alerts: bcdedit_command stealth_network cape_detected_threat deletes_shadow_copies infostealer_cookies",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA256 00f4950d49404f58e223c0946f18a2a779c502d82ce67d419ce42f794666d3c8",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-SHA1 fa773890465396aefe1a6b74d107ce1fee664ef9",
        "TrojanSpy:Win32/Nivdort.DC: FileHash-MD5 ecd1617974166e34de036ddf859a78f6",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA256 c72bf65e0b2635221ce291191b40ddae3d599e418601dcef5d3ef4ab6e929d5f",
        "Trojan:Win32/Formbook!MTB: FileHash-SHA1 3bba9a34622ca39fe8b7132da8056a0d8c9be36c",
        "Trojan:Win32/Formbook!MTB: FileHash-MD5 1f5c006f1ef8d4998c5a6392c4082aef",
        "VirTool:Win32/Obfuscator.JM: FileHash-SHA256 b4cbdc6fe310af9d4d089d36141ca51d5b91ce877c6d0f6f78fc8bd8e6ce5b37",
        "https://saptools.mx/files/aud2txt-linux.zip | linuxeater.com | kent@riboe.se | https://saptools.mx/files/aud2txt-linux.zip",
        "Related Domains By Email DOMAIN ORGANISATION NAME: citrusea.com - Kent Riboe | linuxeater.com - Kent Riboe [kent@riboe.se]",
        "https://admin.safeid.io/Account/ResetPassword?token=Bx_9HrVhO0ihjnilL3BfcpM9s_1XmMRCAI4Sr1QWsLNmMlpmaAH0DI8fWkk7MSrh",
        "Tracking: jrstrackingfunction.com | http://tracking.orca-functions.zoovu.solutions/ | http://tracking.orca-functions.zoovu.solutions/",
        "Tracking: https://sharepointwow.msnd36.com/tracking/lc/3d8656d6-d66c-4b3b-aec3-a363f4faf30f/9d15012d-b2b5-4d70-abb1-eed6eff85f20/7b92544e-3ea3-dccc-179b-fdc110fc452a/",
        "Tracking: URL http://45.159.189.105/bot/regex | http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11",
        "Tracking: http://tracking.minitool.com/pw/launch.php?120100-from-enterprise-v11 No Expiration\t0\t  URL http://www.google-analytics.com/r/collect?v=1&_v=j83&a=160340377&t=pageview&_s=1&dl=http://tracking.minitool.com/pw/launch.html?120100-from-enterprise-v11&ul=en-us&de=utf-8&dt=launch%20tracking&sd=32-bit&sr=1152x864&vp=79x26&je=0&fl=19.0%20r0&_u=IEBAAE~&jid=960554243&gjid=1088832951&cid=1848517172.1595359858&tid=UA-686301-39&_gid=1248672958.1595359858&_r=1&z=1767086795",
        "IDS Detections: Win32/Kapahyku.A Activity 1 PUP/ASMalwNS.A Checkin Observed Suspicious UA (NSIS_Inetc (Mozilla))",
        "iappletech.com | init.ess.apple.com | https://appliedinnovation.forms.pia.ai/r | join.appliedpsych.com",
        "Zeus: FileHash-SHA256 94cdf28c30c4bb09d191990706844f10d8ba837459c9a81dd672f209e77c2fb9",
        "IDS Detections: CryptoWall Check-in Zeus Bot Connectivity Check External IP Check myexternalip.com IP Check myexternalip.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "PWS:Win32/Ymacco",
          "display_name": "PWS:Win32/Ymacco",
          "target": "/malware/PWS:Win32/Ymacco"
        },
        {
          "id": "Win.Malware.Swisyn-7610494-0",
          "display_name": "Win.Malware.Swisyn-7610494-0",
          "target": null
        },
        {
          "id": "Win32:VB-AJKP\\ [Trj]",
          "display_name": "Win32:VB-AJKP\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Malware.Drivepack-9884589-1",
          "display_name": "Win.Malware.Drivepack-9884589-1",
          "target": null
        },
        {
          "id": "TEL:Trojan:Win32/Injector.AB!MSR",
          "display_name": "TEL:Trojan:Win32/Injector.AB!MSR",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti.A",
          "display_name": "Ransom:Win32/Crowti.A",
          "target": "/malware/Ransom:Win32/Crowti.A"
        },
        {
          "id": "Zeus",
          "display_name": "Zeus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Targeted Individuals"
      ],
      "TLP": "green",
      "cloned_from": "668115d703e0a46887c7f08d",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1324,
        "FileHash-SHA1": 931,
        "FileHash-SHA256": 2209,
        "URL": 1572,
        "hostname": 1628,
        "domain": 1711,
        "email": 10,
        "CVE": 5,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9392,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "670 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c3bd803f15cd94aab6e287",
      "name": "Lumma Stealer | Colorado Medical Center HCA",
      "description": "Needs further investigation. Miscellaneous attack affecting Denver physicians directory. Visitors accessing the page using insecure devices may be affected. PII & PHI breached. Monitoring.",
      "modified": "2024-03-08T17:04:03.644000",
      "created": "2024-02-07T17:27:28.349000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "execution",
        "resolutions",
        "problems",
        "siblings domain",
        "whois whois",
        "startpage",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "language",
        "html document",
        "unicode text",
        "utf8 text",
        "doctype",
        "anchor hrefs",
        "hrefs",
        "denver",
        "tsara brashears",
        "apple ios",
        "password bypass",
        "apple phone",
        "unlocker",
        "shell code",
        "script",
        "contacted urls",
        "hacktool",
        "malicious",
        "download",
        "malware",
        "relic",
        "monitoring",
        "domains",
        "eurodns sa",
        "markmonitor",
        "ip detections",
        "country",
        "graph",
        "https",
        "mitre att",
        "ta0007 network",
        "t1046 sends",
        "ssdp",
        "command",
        "control ta0011",
        "protocol t1071",
        "performs dns",
        "layer protocol",
        "number",
        "cus cndigicert",
        "ja3s",
        "subject",
        "sha2 secure",
        "server ca",
        "odigicert inc",
        "cus cnmicrosoft",
        "algorithm",
        "memory pattern",
        "file system",
        "registry",
        "registry keys",
        "process",
        "created",
        "processes tree",
        "february",
        "healthone",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "url https",
        "reverse dns",
        "general full",
        "security tls",
        "protocol h2",
        "software",
        "frankfurt",
        "main",
        "germany",
        "resource hash",
        "de indicators",
        "hashes",
        "value",
        "scriptsrcelem",
        "variables",
        "boomrmq string",
        "boomrapikey",
        "boomr function",
        "system",
        "babelpolyfill",
        "assign function",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "aes256gcm",
        "level",
        "akamaiasn1",
        "europeberlin",
        "generic malware",
        "tag count",
        "tue dec",
        "threat report",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "root ca",
        "pattern match",
        "authority",
        "span",
        "presbyterianst",
        "luke",
        "medical center",
        "class",
        "accept",
        "date",
        "refresh",
        "blood",
        "liver cancer",
        "breast cancer",
        "lung cancer",
        "kidney cancer",
        "skin cancer",
        "sarcoma",
        "prostate cancer",
        "body",
        "facebook",
        "twitter",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "cookie",
        "command and control",
        "mitre",
        "scanning host",
        "exploit source",
        "trojan",
        "callback function",
        "targets",
        "targeting",
        "samesite=none",
        "kde",
        "konqueror",
        "phi",
        "pii",
        "wTJh.exe",
        "malware ransom trojan evader rat",
        "network",
        "rat trojan",
        "relacionada",
        "critical risk",
        "cyberstalking",
        "elf collection",
        "matches rule",
        "emotet",
        "lockbit",
        "critical",
        "copy",
        "installer",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "ursnif",
        "core",
        "as55688 pt",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "asn as55688",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "united",
        "aaaa",
        "unknown",
        "a domains",
        "search",
        "creation date",
        "record value",
        "next",
        "pornhub",
        "anyxxxtube",
        "domain",
        "gandi sas",
        "hostname",
        "basic",
        "pe32",
        "intel",
        "ms windows",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "pe32 packer",
        "petite",
        "vs98",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "rticon neutral",
        "overlay",
        "dos exe",
        "threat roundup",
        "pe resource",
        "june",
        "lumma stealer",
        "ransomexx",
        "azorult",
        "njrat",
        "open",
        "problem",
        "plugx",
        "android",
        "sex_phot.jpg.exe",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "delphi generic",
        "icons library",
        "pe32 linker",
        "lcc linker",
        "empty hash",
        "tulach",
        "sabey",
        "rat",
        "remote",
        "remote access trojan"
      ],
      "references": [
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians",
        "https://www.hybrid-analysis.com/sample/63bf920be2401947bd686d7dd146af7f3e56800409307360105bf50cebb1c1ea",
        "www2.megawebfind.com [command and control]",
        "http://ifdnzact.com/?dn=megawebdeals.com&pid=9PO755G95 [ phishing]",
        "20.99.186.246 [exploit source]",
        "https://www.healthonecares.com/locations/presbyterian-st-lukes-medical-center/physicians/ [heuristic]",
        "Win32:RATX-gen [Trj] identified.",
        "CS Sigma Rules: Shadow Copies Deletion Using Operating Systems Utilities by Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)",
        "CS Sigma Rules: Disable UAC Using Registry by frack113",
        "http://45.159.189.105/bot/regex [ tracking | botnet]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [Password cracker | Patient being tracked through multiple medical systems]",
        "0-173-x.msn.com | https://twitter.com/PORNO_SEXYBABES | 0-3.duckdns.org | 0-212.pornhub.org | 000web.pornhub.org",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "CS Sigma Rules: Wow6432Node CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "Remote Access Trojan"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Indonesia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Win32:RATX-gen [Trj]",
          "display_name": "Win32:RATX-gen [Trj]",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "W32/Hupigon.NCU",
          "display_name": "W32/Hupigon.NCU",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Azorult",
          "display_name": "Azorult",
          "target": null
        },
        {
          "id": "Wiper",
          "display_name": "Wiper",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 68,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 883,
        "URL": 1412,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 231,
        "FileHash-SHA256": 2909,
        "domain": 824,
        "email": 3,
        "CVE": 3
      },
      "indicator_count": 6548,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "814 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "gosocket.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "gosocket.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780249667.521923
}