{
  "type": "URL",
  "indicator": "http://lyrymuj.com/login.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://lyrymuj.com/login.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4026743566,
      "indicator": "http://lyrymuj.com/login.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68ddc902283b04c489f7e1cd",
          "name": "Malicious Probe - WannaCry \u2022 WannaCrypt- Ransomware",
          "description": "Malicious remote cab / drive by via an alt google redirect , clicked image , suspicious, low amount of search results.\nRead coded image. Target/s phone -cnc and infected. #dead_connect #decrypted #hacked #nametactics",
          "modified": "2025-11-01T00:02:59.726000",
          "created": "2025-10-02T00:36:18.296000",
          "tags": [
            "ip address",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "cus ogoogle",
            "trust",
            "cnwr3 validity",
            "subject public",
            "key info",
            "links",
            "dynamicloader",
            "high",
            "et exploit",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "dns lookup",
            "ransom",
            "write",
            "malware",
            "wannacrypt",
            "wannacry",
            "eternal blue",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "development att",
            "ssl certificate",
            "programfiles",
            "username",
            "windir",
            "userprofile",
            "mitre att",
            "ck matrix",
            "localappdata",
            "comspec",
            "model",
            "hybrid",
            "path",
            "click",
            "strings",
            "sabey type",
            "quasi type",
            "pegasus relationship",
            "fbi? files"
          ],
          "references": [
            "www.forensickb.com \u2022 Computer Forensics, Malware Analysis & Digital Investigations",
            "Eternal Blue Wannacry \u2022 WannaCry Crypter",
            "https://hybrid-analysis.com/sample/8ed6c58fb2a5d50252bf106d31ed9e230925124443e4243bec9515c82ef0450c/68ddc351e27cb562e902d674"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "WannaCrypt",
              "display_name": "WannaCrypt",
              "target": null
            },
            {
              "id": "Eternal Blue",
              "display_name": "Eternal Blue",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4246,
            "domain": 757,
            "hostname": 1039,
            "email": 1,
            "FileHash-SHA256": 2738,
            "FileHash-SHA1": 152,
            "FileHash-MD5": 140,
            "CVE": 1,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 9077,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "212 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ddc9048ba0719321307d03",
          "name": "Malicious Probe - WannaCry \u2022 WannaCrypt- Ransomware",
          "description": "Malicious remote cab / drive by via an alt google redirect , clicked image , suspicious, low amount of search results.\nRead coded image. Target/s phone -cnc and infected. #dead_connect #decrypted #hacked #nametactics",
          "modified": "2025-11-01T00:02:59.726000",
          "created": "2025-10-02T00:36:20.247000",
          "tags": [
            "ip address",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "cus ogoogle",
            "trust",
            "cnwr3 validity",
            "subject public",
            "key info",
            "links",
            "dynamicloader",
            "high",
            "et exploit",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "dns lookup",
            "ransom",
            "write",
            "malware",
            "wannacrypt",
            "wannacry",
            "eternal blue",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "development att",
            "ssl certificate",
            "programfiles",
            "username",
            "windir",
            "userprofile",
            "mitre att",
            "ck matrix",
            "localappdata",
            "comspec",
            "model",
            "hybrid",
            "path",
            "click",
            "strings",
            "sabey type",
            "quasi type",
            "pegasus relationship",
            "fbi? files"
          ],
          "references": [
            "www.forensickb.com \u2022 Computer Forensics, Malware Analysis & Digital Investigations",
            "Eternal Blue Wannacry \u2022 WannaCry Crypter",
            "https://hybrid-analysis.com/sample/8ed6c58fb2a5d50252bf106d31ed9e230925124443e4243bec9515c82ef0450c/68ddc351e27cb562e902d674"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "WannaCry",
              "display_name": "WannaCry",
              "target": null
            },
            {
              "id": "WannaCrypt",
              "display_name": "WannaCrypt",
              "target": null
            },
            {
              "id": "Eternal Blue",
              "display_name": "Eternal Blue",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4246,
            "domain": 757,
            "hostname": 1039,
            "email": 1,
            "FileHash-SHA256": 2738,
            "FileHash-SHA1": 152,
            "FileHash-MD5": 140,
            "CVE": 1,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 9077,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 147,
          "modified_text": "212 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688c8526be7a4df33863b5c5",
          "name": "VirusTotal - Shiz.ivr",
          "description": "*Win.Trojan.Shiz.ivr\n*PWS:Win32/Simda.D\n*virtool #injection#infostealer #network #cnc #block_not #virustotal_google #cnc #checking #procmem_yara\n#injection_inter_process\n#injection_create_remote_thread\n#antidebug_windows\n#multiple_useragents\n#network_fake_useragent\n#persistence_autorun\n#cape_detected_threat\n#antiav_detectfile\n#modify_proxy\n#deletes_self\n#infostealer_cookies\n#injection_createremotethread\n#suricata_alert\n~ vashti",
          "modified": "2025-08-31T08:01:04.297000",
          "created": "2025-08-01T09:13:10.510000",
          "tags": [
            "dynamicloader",
            "unknown",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "suspicious",
            "search",
            "high",
            "show",
            "copy",
            "possible",
            "write",
            "internal",
            "malware",
            "push",
            "local",
            "next",
            "contacted",
            "domains",
            "pulses",
            "related tags",
            "file type",
            "date april",
            "pm size",
            "sha1 sha256",
            "imphash pehash",
            "virustotal api",
            "bq jul",
            "united",
            "trojan",
            "backdoor",
            "virtool",
            "cnc beacon",
            "entries",
            "path max",
            "passive dns",
            "next associated",
            "cookie",
            "twitter",
            "body",
            "date",
            "medium",
            "simda",
            "global"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 10303,
            "hostname": 1413,
            "FileHash-SHA256": 1868,
            "domain": 1877,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 348,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 16168,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "273 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6786a59af06fee17c8decf9d",
          "name": "netcfg",
          "description": "000ceafd276003f46d06828bb0459b3ccdc2b44013a313b69d6270a224199034",
          "modified": "2025-05-31T02:36:52.299000",
          "created": "2025-01-14T17:57:46.687000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 222,
            "domain": 216,
            "hostname": 4,
            "FileHash-SHA256": 1
          },
          "indicator_count": 443,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "366 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Eternal Blue Wannacry \u2022 WannaCry Crypter",
        "www.forensickb.com \u2022 Computer Forensics, Malware Analysis & Digital Investigations",
        "https://hybrid-analysis.com/sample/8ed6c58fb2a5d50252bf106d31ed9e230925124443e4243bec9515c82ef0450c/68ddc351e27cb562e902d674"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ransomware",
            "Wannacrypt",
            "Et",
            "Eternal blue",
            "Wannacry"
          ],
          "industries": [],
          "unique_indicators": 23957
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/lyrymuj.com",
    "whois": "http://whois.domaintools.com/lyrymuj.com",
    "domain": "lyrymuj.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68ddc902283b04c489f7e1cd",
      "name": "Malicious Probe - WannaCry \u2022 WannaCrypt- Ransomware",
      "description": "Malicious remote cab / drive by via an alt google redirect , clicked image , suspicious, low amount of search results.\nRead coded image. Target/s phone -cnc and infected. #dead_connect #decrypted #hacked #nametactics",
      "modified": "2025-11-01T00:02:59.726000",
      "created": "2025-10-02T00:36:18.296000",
      "tags": [
        "ip address",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "cus ogoogle",
        "trust",
        "cnwr3 validity",
        "subject public",
        "key info",
        "links",
        "dynamicloader",
        "high",
        "et exploit",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "dns lookup",
        "ransom",
        "write",
        "malware",
        "wannacrypt",
        "wannacry",
        "eternal blue",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "development att",
        "ssl certificate",
        "programfiles",
        "username",
        "windir",
        "userprofile",
        "mitre att",
        "ck matrix",
        "localappdata",
        "comspec",
        "model",
        "hybrid",
        "path",
        "click",
        "strings",
        "sabey type",
        "quasi type",
        "pegasus relationship",
        "fbi? files"
      ],
      "references": [
        "www.forensickb.com \u2022 Computer Forensics, Malware Analysis & Digital Investigations",
        "Eternal Blue Wannacry \u2022 WannaCry Crypter",
        "https://hybrid-analysis.com/sample/8ed6c58fb2a5d50252bf106d31ed9e230925124443e4243bec9515c82ef0450c/68ddc351e27cb562e902d674"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        },
        {
          "id": "WannaCrypt",
          "display_name": "WannaCrypt",
          "target": null
        },
        {
          "id": "Eternal Blue",
          "display_name": "Eternal Blue",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4246,
        "domain": 757,
        "hostname": 1039,
        "email": 1,
        "FileHash-SHA256": 2738,
        "FileHash-SHA1": 152,
        "FileHash-MD5": 140,
        "CVE": 1,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 9077,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "212 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ddc9048ba0719321307d03",
      "name": "Malicious Probe - WannaCry \u2022 WannaCrypt- Ransomware",
      "description": "Malicious remote cab / drive by via an alt google redirect , clicked image , suspicious, low amount of search results.\nRead coded image. Target/s phone -cnc and infected. #dead_connect #decrypted #hacked #nametactics",
      "modified": "2025-11-01T00:02:59.726000",
      "created": "2025-10-02T00:36:20.247000",
      "tags": [
        "ip address",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "cus ogoogle",
        "trust",
        "cnwr3 validity",
        "subject public",
        "key info",
        "links",
        "dynamicloader",
        "high",
        "et exploit",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "dns lookup",
        "ransom",
        "write",
        "malware",
        "wannacrypt",
        "wannacry",
        "eternal blue",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "development att",
        "ssl certificate",
        "programfiles",
        "username",
        "windir",
        "userprofile",
        "mitre att",
        "ck matrix",
        "localappdata",
        "comspec",
        "model",
        "hybrid",
        "path",
        "click",
        "strings",
        "sabey type",
        "quasi type",
        "pegasus relationship",
        "fbi? files"
      ],
      "references": [
        "www.forensickb.com \u2022 Computer Forensics, Malware Analysis & Digital Investigations",
        "Eternal Blue Wannacry \u2022 WannaCry Crypter",
        "https://hybrid-analysis.com/sample/8ed6c58fb2a5d50252bf106d31ed9e230925124443e4243bec9515c82ef0450c/68ddc351e27cb562e902d674"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "WannaCry",
          "display_name": "WannaCry",
          "target": null
        },
        {
          "id": "WannaCrypt",
          "display_name": "WannaCrypt",
          "target": null
        },
        {
          "id": "Eternal Blue",
          "display_name": "Eternal Blue",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4246,
        "domain": 757,
        "hostname": 1039,
        "email": 1,
        "FileHash-SHA256": 2738,
        "FileHash-SHA1": 152,
        "FileHash-MD5": 140,
        "CVE": 1,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 9077,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 147,
      "modified_text": "212 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688c8526be7a4df33863b5c5",
      "name": "VirusTotal - Shiz.ivr",
      "description": "*Win.Trojan.Shiz.ivr\n*PWS:Win32/Simda.D\n*virtool #injection#infostealer #network #cnc #block_not #virustotal_google #cnc #checking #procmem_yara\n#injection_inter_process\n#injection_create_remote_thread\n#antidebug_windows\n#multiple_useragents\n#network_fake_useragent\n#persistence_autorun\n#cape_detected_threat\n#antiav_detectfile\n#modify_proxy\n#deletes_self\n#infostealer_cookies\n#injection_createremotethread\n#suricata_alert\n~ vashti",
      "modified": "2025-08-31T08:01:04.297000",
      "created": "2025-08-01T09:13:10.510000",
      "tags": [
        "dynamicloader",
        "unknown",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "suspicious",
        "search",
        "high",
        "show",
        "copy",
        "possible",
        "write",
        "internal",
        "malware",
        "push",
        "local",
        "next",
        "contacted",
        "domains",
        "pulses",
        "related tags",
        "file type",
        "date april",
        "pm size",
        "sha1 sha256",
        "imphash pehash",
        "virustotal api",
        "bq jul",
        "united",
        "trojan",
        "backdoor",
        "virtool",
        "cnc beacon",
        "entries",
        "path max",
        "passive dns",
        "next associated",
        "cookie",
        "twitter",
        "body",
        "date",
        "medium",
        "simda",
        "global"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 10303,
        "hostname": 1413,
        "FileHash-SHA256": 1868,
        "domain": 1877,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 348,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 16168,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "273 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6786a59af06fee17c8decf9d",
      "name": "netcfg",
      "description": "000ceafd276003f46d06828bb0459b3ccdc2b44013a313b69d6270a224199034",
      "modified": "2025-05-31T02:36:52.299000",
      "created": "2025-01-14T17:57:46.687000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 222,
        "domain": 216,
        "hostname": 4,
        "FileHash-SHA256": 1
      },
      "indicator_count": 443,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "366 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://lyrymuj.com/login.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://lyrymuj.com/login.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780289947.8735752
}