{
  "type": "URL",
  "indicator": "https://apps.encyro.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://apps.encyro.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3974825192,
      "indicator": "https://apps.encyro.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66e846796e72bee6be87c110",
          "name": "C:\\Program Files\\Microsoft Office\\root\\",
          "description": "C:\\Program Files\\Microsoft Office\\root\\\n\nIocs sampled from the directory: C:\\Program Files\\Microsoft Office\\root\\ (from an infected windows 11 sample PC)\nNot complete, will expand upon it later.\nUnder C:\\Program Files\\Microsoft Office there is...\n4x File Folders, 3x Edge HTML Docs",
          "modified": "2024-10-16T19:04:17.209000",
          "created": "2024-09-16T14:53:45.370000",
          "tags": [
            "entity",
            "please",
            "javascript",
            "clientid",
            "platformwin32",
            "buildship",
            "architecturex86",
            "osbuild7601",
            "channeldcwin7",
            "installtypec2r",
            "sessionid"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/g8c4e1b9704cb478f92c4fbb255016abe5beee3a86be54a118c68677c8976dcf7?theme=dark",
            "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d",
            "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/iocs",
            "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 144,
            "FileHash-SHA256": 3981,
            "URL": 685,
            "domain": 476,
            "hostname": 748
          },
          "indicator_count": 6178,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 136,
          "modified_text": "550 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g8c4e1b9704cb478f92c4fbb255016abe5beee3a86be54a118c68677c8976dcf7?theme=dark",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/graph",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/iocs"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Technology"
          ],
          "unique_indicators": 13143
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/encyro.com",
    "whois": "http://whois.domaintools.com/encyro.com",
    "domain": "encyro.com",
    "hostname": "apps.encyro.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66e846796e72bee6be87c110",
      "name": "C:\\Program Files\\Microsoft Office\\root\\",
      "description": "C:\\Program Files\\Microsoft Office\\root\\\n\nIocs sampled from the directory: C:\\Program Files\\Microsoft Office\\root\\ (from an infected windows 11 sample PC)\nNot complete, will expand upon it later.\nUnder C:\\Program Files\\Microsoft Office there is...\n4x File Folders, 3x Edge HTML Docs",
      "modified": "2024-10-16T19:04:17.209000",
      "created": "2024-09-16T14:53:45.370000",
      "tags": [
        "entity",
        "please",
        "javascript",
        "clientid",
        "platformwin32",
        "buildship",
        "architecturex86",
        "osbuild7601",
        "channeldcwin7",
        "installtypec2r",
        "sessionid"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g8c4e1b9704cb478f92c4fbb255016abe5beee3a86be54a118c68677c8976dcf7?theme=dark",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/iocs",
        "https://www.virustotal.com/gui/collection/4ddaf1ccbac15330d25c28dbcc7c4f185279af098f013e0e9986afd18efc7c2d/graph"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 144,
        "FileHash-SHA256": 3981,
        "URL": 685,
        "domain": 476,
        "hostname": 748
      },
      "indicator_count": 6178,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 136,
      "modified_text": "550 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://apps.encyro.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://apps.encyro.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638776.7555664
}