{
  "type": "URL",
  "indicator": "https://authenticate-email.hoffmanconstructions.us",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://authenticate-email.hoffmanconstructions.us",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3755950463,
      "indicator": "https://authenticate-email.hoffmanconstructions.us",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a56de96660c99420dbc2",
          "name": "Beach Research | Instagram Account Deleted Command and Control",
          "description": "",
          "modified": "2023-12-06T16:46:37.866000",
          "created": "2023-12-06T16:46:37.866000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 5,
            "hostname": 565,
            "domain": 287,
            "FileHash-SHA256": 966,
            "FileHash-MD5": 393,
            "FileHash-SHA1": 212,
            "URL": 2122,
            "FilePath": 2
          },
          "indicator_count": 4552,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650930a75e59920ea90a90df",
          "name": "Beach Research | Instagram Account Deleted Command and Control",
          "description": "Instagram account deleted by malicious attackers.\nAfter a period of information harvesting and spying , phone access,  iPhone intrusion, apparently the site was maliciously attacked.\n\nPrivilege Escalation\nTargeted individual\nObscuration\nHacking/ Web Attack",
          "modified": "2023-10-19T03:01:46.569000",
          "created": "2023-09-19T05:24:55.870000",
          "tags": [
            "cyber threat",
            "team phishing",
            "engineering",
            "united",
            "team",
            "team covid19",
            "heur",
            "ssh attacker",
            "hostname",
            "malicious site",
            "malware",
            "service",
            "phishing",
            "malicious",
            "agent",
            "installcore",
            "exploit",
            "msil",
            "hiloti",
            "riskware",
            "artemis",
            "unsafe",
            "crack",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware site",
            "phishing site",
            "redline stealer",
            "alexa",
            "download",
            "teamspy",
            "beach research",
            "generic malware",
            "cyber crime",
            "Instagram",
            "Instagram account attack",
            "keylogger",
            "Social Engineering",
            "Palm Beach Research Group phishing",
            "Ramnit",
            "Apple phishing"
          ],
          "references": [
            "Online Research",
            "Hybrid Analysis",
            "WebTools",
            "Data Analysis",
            "Behavior Pattern Match",
            "Research Targets media",
            "https://www.instagram.com/songculture/",
            "Alienvault OTX",
            "This AV link was attached to account: https://otx.alienvault.com/indicator/file/4dc6e4f00f06abdc43d4108301eadb800d77e18b631fdeb522e357845fba30c5"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
              "target": null
            },
            {
              "id": "Trojan:Win32/InstallCore",
              "display_name": "Trojan:Win32/InstallCore",
              "target": "/malware/Trojan:Win32/InstallCore"
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "HackTool:Win32/Crack",
              "display_name": "HackTool:Win32/Crack",
              "target": "/malware/HackTool:Win32/Crack"
            },
            {
              "id": "DEcovid19",
              "display_name": "DEcovid19",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Keylogger",
              "display_name": "#Lowfi:HSTR:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "TeamSpy",
              "display_name": "TeamSpy",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Teamspy",
              "display_name": "TrojanDropper:Win32/Teamspy",
              "target": "/malware/TrojanDropper:Win32/Teamspy"
            },
            {
              "id": "Genheur",
              "display_name": "Genheur",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 5,
            "hostname": 565,
            "domain": 287,
            "FileHash-MD5": 393,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 966,
            "URL": 2122,
            "FilePath": 2
          },
          "indicator_count": 4552,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Behavior Pattern Match",
        "Research Targets media",
        "Hybrid Analysis",
        "Alienvault OTX",
        "WebTools",
        "Data Analysis",
        "This AV link was attached to account: https://otx.alienvault.com/indicator/file/4dc6e4f00f06abdc43d4108301eadb800d77e18b631fdeb522e357845fba30c5",
        "Online Research",
        "https://www.instagram.com/songculture/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Artemis",
            "Alf:heraklezeval:trojan:win32/hiloti",
            "Backdoor:msil/asyncrat",
            "Teamspy",
            "Beach research",
            "Hacktool:win32/crack",
            "Trojan:win32/installcore",
            "Ramnit",
            "Genheur",
            "Decovid19",
            "Backdoor:msil/quasarrat",
            "#lowfi:hstr:msil/keylogger",
            "Generic.malware",
            "Trojandropper:win32/teamspy",
            "Redline stealer",
            "Alf:heraklezeval:trojan:msil/spyagent"
          ],
          "industries": [
            "Hacking",
            "Media",
            "Technology",
            "Social media"
          ],
          "unique_indicators": 26532
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hoffmanconstructions.us",
    "whois": "http://whois.domaintools.com/hoffmanconstructions.us",
    "domain": "hoffmanconstructions.us",
    "hostname": "authenticate-email.hoffmanconstructions.us"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a56de96660c99420dbc2",
      "name": "Beach Research | Instagram Account Deleted Command and Control",
      "description": "",
      "modified": "2023-12-06T16:46:37.866000",
      "created": "2023-12-06T16:46:37.866000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 5,
        "hostname": 565,
        "domain": 287,
        "FileHash-SHA256": 966,
        "FileHash-MD5": 393,
        "FileHash-SHA1": 212,
        "URL": 2122,
        "FilePath": 2
      },
      "indicator_count": 4552,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650a0b7c9a6b3c5d0a2a3960",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
      "modified": "2023-10-19T14:04:37.381000",
      "created": "2023-09-19T20:58:36.137000",
      "tags": [
        "contacted",
        "threat roundup",
        "execution",
        "ssl certificate",
        "dark web",
        "crypto threat",
        "resolutions",
        "referrer",
        "stealer",
        "quasar",
        "asyncrat",
        "error",
        "social engineering",
        "iPhone phishing",
        "Apple phishing",
        "email phishing",
        "emotet",
        "remote",
        "attacks"
      ],
      "references": [
        "Alienvault OTX",
        "Data Analysis",
        "Online Research",
        "WebTools"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "India"
      ],
      "malware_families": [
        {
          "id": "Backdoor:MSIL/AsyncRAT",
          "display_name": "Backdoor:MSIL/AsyncRAT",
          "target": "/malware/Backdoor:MSIL/AsyncRAT"
        },
        {
          "id": "Backdoor:MSIL/QuasarRat",
          "display_name": "Backdoor:MSIL/QuasarRat",
          "target": "/malware/Backdoor:MSIL/QuasarRat"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1548",
          "name": "Abuse Elevation Control Mechanism",
          "display_name": "T1548 - Abuse Elevation Control Mechanism"
        }
      ],
      "industries": [
        "Media",
        "Social Media",
        "Technology",
        "Hacking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 5791,
        "URL": 11513,
        "domain": 2317,
        "hostname": 3255,
        "CVE": 3
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650930a75e59920ea90a90df",
      "name": "Beach Research | Instagram Account Deleted Command and Control",
      "description": "Instagram account deleted by malicious attackers.\nAfter a period of information harvesting and spying , phone access,  iPhone intrusion, apparently the site was maliciously attacked.\n\nPrivilege Escalation\nTargeted individual\nObscuration\nHacking/ Web Attack",
      "modified": "2023-10-19T03:01:46.569000",
      "created": "2023-09-19T05:24:55.870000",
      "tags": [
        "cyber threat",
        "team phishing",
        "engineering",
        "united",
        "team",
        "team covid19",
        "heur",
        "ssh attacker",
        "hostname",
        "malicious site",
        "malware",
        "service",
        "phishing",
        "malicious",
        "agent",
        "installcore",
        "exploit",
        "msil",
        "hiloti",
        "riskware",
        "artemis",
        "unsafe",
        "crack",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware site",
        "phishing site",
        "redline stealer",
        "alexa",
        "download",
        "teamspy",
        "beach research",
        "generic malware",
        "cyber crime",
        "Instagram",
        "Instagram account attack",
        "keylogger",
        "Social Engineering",
        "Palm Beach Research Group phishing",
        "Ramnit",
        "Apple phishing"
      ],
      "references": [
        "Online Research",
        "Hybrid Analysis",
        "WebTools",
        "Data Analysis",
        "Behavior Pattern Match",
        "Research Targets media",
        "https://www.instagram.com/songculture/",
        "Alienvault OTX",
        "This AV link was attached to account: https://otx.alienvault.com/indicator/file/4dc6e4f00f06abdc43d4108301eadb800d77e18b631fdeb522e357845fba30c5"
      ],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
          "target": null
        },
        {
          "id": "Trojan:Win32/InstallCore",
          "display_name": "Trojan:Win32/InstallCore",
          "target": "/malware/Trojan:Win32/InstallCore"
        },
        {
          "id": "generic.malware",
          "display_name": "generic.malware",
          "target": null
        },
        {
          "id": "HackTool:Win32/Crack",
          "display_name": "HackTool:Win32/Crack",
          "target": "/malware/HackTool:Win32/Crack"
        },
        {
          "id": "DEcovid19",
          "display_name": "DEcovid19",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Keylogger",
          "display_name": "#Lowfi:HSTR:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "TeamSpy",
          "display_name": "TeamSpy",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Teamspy",
          "display_name": "TrojanDropper:Win32/Teamspy",
          "target": "/malware/TrojanDropper:Win32/Teamspy"
        },
        {
          "id": "Genheur",
          "display_name": "Genheur",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        }
      ],
      "industries": [
        "Technology",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 5,
        "hostname": 565,
        "domain": 287,
        "FileHash-MD5": 393,
        "FileHash-SHA1": 212,
        "FileHash-SHA256": 966,
        "URL": 2122,
        "FilePath": 2
      },
      "indicator_count": 4552,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://authenticate-email.hoffmanconstructions.us",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://authenticate-email.hoffmanconstructions.us",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638854.6152842
}