{
  "type": "URL",
  "indicator": "https://bbs.kanxue.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://bbs.kanxue.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833892038,
      "indicator": "https://bbs.kanxue.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "65e24b157718e7ddf71765db",
          "name": "Lenovo Tablet K series  Remotely Connects & controls Devices",
          "description": "Lenovo K series Tablet resource used to connect to thermostat devices and develops full CnC of victims network. All types of malicious abuses from dumping to spyware, tracking, enabling device features, listening to room. Creates zombie devices. Zusy: Man-in-the-middle attacks, injection, stealer.\n | AutoIt_3_00_Third_Party: treat actors dependent on various environments to load maware, when exploited, user interface , scripting, malicious activity possible by hidden users",
          "modified": "2024-03-31T15:02:37.900000",
          "created": "2024-03-01T21:39:33.521000",
          "tags": [
            "url http",
            "search",
            "lenovo type",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "status",
            "united",
            "unknown",
            "creation date",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "date",
            "next",
            "meta",
            "tabx explorer",
            "urls",
            "hichina",
            "record value",
            "entries",
            "explorer",
            "target",
            "china unknown",
            "as4812 china",
            "as58461",
            "as4808 china",
            "smartchat",
            "vary",
            "accept encoding",
            "ipv4",
            "pulse submit",
            "dns replication",
            "as4837 china",
            "aaaa",
            "as9808 china",
            "whitelisted",
            "nxdomain",
            "as56047 china",
            "as58542 tianjij",
            "ns nxdomain",
            "body",
            "pe32",
            "intel",
            "ms windows",
            "windows activex",
            "control panel",
            "item",
            "win16 ne",
            "pe32 compiler",
            "exe32",
            "compiler",
            "javascript",
            "win32 exe",
            "kb file",
            "files",
            "file type",
            "javascript code",
            "windows",
            "text",
            "web open",
            "font format",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "connection",
            "date fri",
            "contacted",
            "whois record",
            "pe resource",
            "execution",
            "communicating",
            "siblings",
            "referrer",
            "whois whois",
            "bundled",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "parent domain",
            "ssl certificate",
            "historical ssl",
            "whois domain",
            "set cookie",
            "gmt path",
            "url analysis",
            "find",
            "service",
            "as15169 google",
            "as9009 m247",
            "as14061",
            "as16276",
            "name servers",
            "alienvault",
            "open threat",
            "yara rule",
            "high",
            "show",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "accept",
            "copy",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "malware",
            "zusy",
            "local",
            "json",
            "delete c",
            "ascii text",
            "suspicious",
            "cookie",
            "jpeg image",
            "exif standard",
            "tiff image",
            "autoit",
            "markus",
            "april",
            "dropper",
            "default",
            "delete",
            "switch",
            "as20940",
            "dynamicloader",
            "medium",
            "http",
            "write c",
            "ciphersuite",
            "a li",
            "amazon ses",
            "moved",
            "pepo campaigns",
            "advanced email",
            "twitter",
            "span",
            "servers",
            "authority",
            "win32upatre feb",
            "artro",
            "apple",
            "typosquatting",
            "botnet",
            "network",
            "advertising botnet",
            "adware",
            "mining",
            "spyware",
            "cnc",
            "mbs"
          ],
          "references": [
            "http://www.tabxexplorer.com/lenovo",
            "114.80.179.242 \u2022 61.170.80.193 [malware hosting]",
            "IDS Detections Zusy Variant CnC Checkin",
            "IDS Signatures: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\t192.168.122.30\t104.18.12.173",
            "Registry:   Read - DisableUserModeCallbackFilter",
            "OTX Alerts: procmem_yara injection_inter_process \u2022 ransomware_file_modifications \u2022 stack_pivot stealth_file antiav_detectfile \u2022 deletes_self",
            "OTX Alerts: cape_extracted_content \u2022 infostealer_cookies \u2022 recon_fingerprint \u2022 suricata_alert \u2022 anomalous_deletefile dead_connect \u2022dynamic_function_loading ipc_namedpipe powershell_download createtoolhelp32snapshot_module_enumeration reads_self antidebug_ntsetinformationthread injection_rwx network_http",
            "Stack pivoting was detected when using a critical API",
            "Tracking: trackite.com \u2022 track.beanstalkdata.com \u2022 http://tracking.butterflymx.com/ls/click?upn= \u2022 sonymobilemail.com \u2022 connect.grovelfun.com",
            "apple.ios-slgn-in.com \u2022 appleid.com \u2022 apple.com  \u2022 http://apple.ddianle.com \u2022 http://write.52toolbox.com/cms/privacy_policy_lenovo.html",
            "http://desk.52toolbox.com/cms/agreement_lenovo.html \u2022 http://chat.52toolbox.com/cms/agreement_lenovo.html \u2022 www.tabxexplorer.com",
            "https://www.starbucks.com.cn/mobile-view/en/help/terms/digital-starbucks-rewards-kit?supportTel=fals \u2022 https://u.ysepay.com:8288/MobileGate/login.do",
            "https://download.tenorshare.cn/go/reiboot-for-android_2420.exe?track[banner]=home&track[mobilebanner]=ferragosto20220719&track[tslateset]=undefined&track[w]=3840&track[h]=220?linksource&track[utm_source]=awin&track[utm_medium]=affiliate&track[utm_term]=213429&track[awc]=18616_1659086165_ce9efdb1e9f159a1234acd82324b61a8&track[realMedium]=affiliate&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.tenorshare.cn/guide/ios-system-recovery.html&track[sid]=118",
            "http://www.beneat.cn/mobile/index/index \u2022 http://www.beneat.cn/mobile/index/startAdv \u2022 http://www.beneat.cn/mobile/live/index",
            "http://www.beneat.cn/mobile/room/index \u2022 http://www.beneat.cn/mobile/user/cate  \u2022 http://www.tabxexplorer.com/channel/Commonapi?pid",
            "http://gahub.qijihezi.cn/outlink/others/UbisoftConnectInstaller.exe \u2022 http://zb1.baidu581.com/zhuobiao2/?nid=63047\\r\\nConnection: [location]",
            "accountchooser.com [malicious remote drive by] pop up covers screen, chooses from listed acompromised phone | no click |",
            "Multiple remotewd remotewd.com [DGA domain name changed, moved still active as]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Generickdz-9982080-0",
              "display_name": "Win.Malware.Generickdz-9982080-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
              "display_name": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
              "target": null
            },
            {
              "id": "Win.Malware.Autoit-7732194-0",
              "display_name": "Win.Malware.Autoit-7732194-0",
              "target": null
            },
            {
              "id": "DarkComet",
              "display_name": "DarkComet",
              "target": null
            },
            {
              "id": "!AutoIt_3_00_Third_Party",
              "display_name": "!AutoIt_3_00_Third_Party",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1463",
              "name": "Manipulate Device Communication",
              "display_name": "T1463 - Manipulate Device Communication"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1037.003",
              "name": "Network Logon Script",
              "display_name": "T1037.003 - Network Logon Script"
            }
          ],
          "industries": [
            "Civil Society",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8359,
            "domain": 1687,
            "hostname": 1746,
            "email": 7,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 224,
            "FileHash-SHA256": 1862,
            "CVE": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 14244,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "749 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e24b1cd80668c22e7e1c7a",
          "name": "Lenovo Tablet K series  Remotely Connects & controls Devices",
          "description": "Lenovo K series Tablet resource used to connect to thermostat devices and develops full CnC of victims network. All types of malicious abuses from dumping to spyware, tracking, enabling device features, listening to room. Creates zombie devices. Zusy: Man-in-the-middle attacks, injection, stealer.\n | AutoIt_3_00_Third_Party: treat actors dependent on various environments to load maware, when exploited, user interface , scripting, malicious activity possible by hidden users",
          "modified": "2024-03-31T15:02:37.900000",
          "created": "2024-03-01T21:39:40.078000",
          "tags": [
            "url http",
            "search",
            "lenovo type",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "status",
            "united",
            "unknown",
            "creation date",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse pulses",
            "passive dns",
            "date",
            "next",
            "meta",
            "tabx explorer",
            "urls",
            "hichina",
            "record value",
            "entries",
            "explorer",
            "target",
            "china unknown",
            "as4812 china",
            "as58461",
            "as4808 china",
            "smartchat",
            "vary",
            "accept encoding",
            "ipv4",
            "pulse submit",
            "dns replication",
            "as4837 china",
            "aaaa",
            "as9808 china",
            "whitelisted",
            "nxdomain",
            "as56047 china",
            "as58542 tianjij",
            "ns nxdomain",
            "body",
            "pe32",
            "intel",
            "ms windows",
            "windows activex",
            "control panel",
            "item",
            "win16 ne",
            "pe32 compiler",
            "exe32",
            "compiler",
            "javascript",
            "win32 exe",
            "kb file",
            "files",
            "file type",
            "javascript code",
            "windows",
            "text",
            "web open",
            "font format",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "connection",
            "date fri",
            "contacted",
            "whois record",
            "pe resource",
            "execution",
            "communicating",
            "siblings",
            "referrer",
            "whois whois",
            "bundled",
            "resolutions",
            "contacted urls",
            "siblings domain",
            "parent domain",
            "ssl certificate",
            "historical ssl",
            "whois domain",
            "set cookie",
            "gmt path",
            "url analysis",
            "find",
            "service",
            "as15169 google",
            "as9009 m247",
            "as14061",
            "as16276",
            "name servers",
            "alienvault",
            "open threat",
            "yara rule",
            "high",
            "show",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "accept",
            "copy",
            "write",
            "pecompact",
            "february",
            "packer",
            "delphi",
            "win32",
            "malware",
            "zusy",
            "local",
            "json",
            "delete c",
            "ascii text",
            "suspicious",
            "cookie",
            "jpeg image",
            "exif standard",
            "tiff image",
            "autoit",
            "markus",
            "april",
            "dropper",
            "default",
            "delete",
            "switch",
            "as20940",
            "dynamicloader",
            "medium",
            "http",
            "write c",
            "ciphersuite",
            "a li",
            "amazon ses",
            "moved",
            "pepo campaigns",
            "advanced email",
            "twitter",
            "span",
            "servers",
            "authority",
            "win32upatre feb",
            "artro",
            "apple",
            "typosquatting",
            "botnet",
            "network",
            "advertising botnet",
            "adware",
            "mining",
            "spyware",
            "cnc",
            "mbs"
          ],
          "references": [
            "http://www.tabxexplorer.com/lenovo",
            "114.80.179.242 \u2022 61.170.80.193 [malware hosting]",
            "IDS Detections Zusy Variant CnC Checkin",
            "IDS Signatures: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\t192.168.122.30\t104.18.12.173",
            "Registry:   Read - DisableUserModeCallbackFilter",
            "OTX Alerts: procmem_yara injection_inter_process \u2022 ransomware_file_modifications \u2022 stack_pivot stealth_file antiav_detectfile \u2022 deletes_self",
            "OTX Alerts: cape_extracted_content \u2022 infostealer_cookies \u2022 recon_fingerprint \u2022 suricata_alert \u2022 anomalous_deletefile dead_connect \u2022dynamic_function_loading ipc_namedpipe powershell_download createtoolhelp32snapshot_module_enumeration reads_self antidebug_ntsetinformationthread injection_rwx network_http",
            "Stack pivoting was detected when using a critical API",
            "Tracking: trackite.com \u2022 track.beanstalkdata.com \u2022 http://tracking.butterflymx.com/ls/click?upn= \u2022 sonymobilemail.com \u2022 connect.grovelfun.com",
            "apple.ios-slgn-in.com \u2022 appleid.com \u2022 apple.com  \u2022 http://apple.ddianle.com \u2022 http://write.52toolbox.com/cms/privacy_policy_lenovo.html",
            "http://desk.52toolbox.com/cms/agreement_lenovo.html \u2022 http://chat.52toolbox.com/cms/agreement_lenovo.html \u2022 www.tabxexplorer.com",
            "https://www.starbucks.com.cn/mobile-view/en/help/terms/digital-starbucks-rewards-kit?supportTel=fals \u2022 https://u.ysepay.com:8288/MobileGate/login.do",
            "https://download.tenorshare.cn/go/reiboot-for-android_2420.exe?track[banner]=home&track[mobilebanner]=ferragosto20220719&track[tslateset]=undefined&track[w]=3840&track[h]=220?linksource&track[utm_source]=awin&track[utm_medium]=affiliate&track[utm_term]=213429&track[awc]=18616_1659086165_ce9efdb1e9f159a1234acd82324b61a8&track[realMedium]=affiliate&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.tenorshare.cn/guide/ios-system-recovery.html&track[sid]=118",
            "http://www.beneat.cn/mobile/index/index \u2022 http://www.beneat.cn/mobile/index/startAdv \u2022 http://www.beneat.cn/mobile/live/index",
            "http://www.beneat.cn/mobile/room/index \u2022 http://www.beneat.cn/mobile/user/cate  \u2022 http://www.tabxexplorer.com/channel/Commonapi?pid",
            "http://gahub.qijihezi.cn/outlink/others/UbisoftConnectInstaller.exe \u2022 http://zb1.baidu581.com/zhuobiao2/?nid=63047\\r\\nConnection: [location]",
            "accountchooser.com [malicious remote drive by] pop up covers screen, chooses from listed acompromised phone | no click |",
            "Multiple remotewd remotewd.com [DGA domain name changed, moved still active as]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Generickdz-9982080-0",
              "display_name": "Win.Malware.Generickdz-9982080-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
              "display_name": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
              "target": null
            },
            {
              "id": "Win.Malware.Autoit-7732194-0",
              "display_name": "Win.Malware.Autoit-7732194-0",
              "target": null
            },
            {
              "id": "DarkComet",
              "display_name": "DarkComet",
              "target": null
            },
            {
              "id": "!AutoIt_3_00_Third_Party",
              "display_name": "!AutoIt_3_00_Third_Party",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1463",
              "name": "Manipulate Device Communication",
              "display_name": "T1463 - Manipulate Device Communication"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1037.003",
              "name": "Network Logon Script",
              "display_name": "T1037.003 - Network Logon Script"
            }
          ],
          "industries": [
            "Civil Society",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8359,
            "domain": 1687,
            "hostname": 1746,
            "email": 7,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 224,
            "FileHash-SHA256": 1862,
            "CVE": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 14244,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "749 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "accountchooser.com [malicious remote drive by] pop up covers screen, chooses from listed acompromised phone | no click |",
        "IDS Detections Zusy Variant CnC Checkin",
        "http://www.beneat.cn/mobile/room/index \u2022 http://www.beneat.cn/mobile/user/cate  \u2022 http://www.tabxexplorer.com/channel/Commonapi?pid",
        "https://download.tenorshare.cn/go/reiboot-for-android_2420.exe?track[banner]=home&track[mobilebanner]=ferragosto20220719&track[tslateset]=undefined&track[w]=3840&track[h]=220?linksource&track[utm_source]=awin&track[utm_medium]=affiliate&track[utm_term]=213429&track[awc]=18616_1659086165_ce9efdb1e9f159a1234acd82324b61a8&track[realMedium]=affiliate&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.tenorshare.cn/guide/ios-system-recovery.html&track[sid]=118",
        "apple.ios-slgn-in.com \u2022 appleid.com \u2022 apple.com  \u2022 http://apple.ddianle.com \u2022 http://write.52toolbox.com/cms/privacy_policy_lenovo.html",
        "Registry:   Read - DisableUserModeCallbackFilter",
        "https://www.starbucks.com.cn/mobile-view/en/help/terms/digital-starbucks-rewards-kit?supportTel=fals \u2022 https://u.ysepay.com:8288/MobileGate/login.do",
        "OTX Alerts: procmem_yara injection_inter_process \u2022 ransomware_file_modifications \u2022 stack_pivot stealth_file antiav_detectfile \u2022 deletes_self",
        "http://gahub.qijihezi.cn/outlink/others/UbisoftConnectInstaller.exe \u2022 http://zb1.baidu581.com/zhuobiao2/?nid=63047\\r\\nConnection: [location]",
        "Multiple remotewd remotewd.com [DGA domain name changed, moved still active as]",
        "OTX Alerts: cape_extracted_content \u2022 infostealer_cookies \u2022 recon_fingerprint \u2022 suricata_alert \u2022 anomalous_deletefile dead_connect \u2022dynamic_function_loading ipc_namedpipe powershell_download createtoolhelp32snapshot_module_enumeration reads_self antidebug_ntsetinformationthread injection_rwx network_http",
        "http://desk.52toolbox.com/cms/agreement_lenovo.html \u2022 http://chat.52toolbox.com/cms/agreement_lenovo.html \u2022 www.tabxexplorer.com",
        "http://www.beneat.cn/mobile/index/index \u2022 http://www.beneat.cn/mobile/index/startAdv \u2022 http://www.beneat.cn/mobile/live/index",
        "IDS Signatures: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\t192.168.122.30\t104.18.12.173",
        "Stack pivoting was detected when using a critical API",
        "114.80.179.242 \u2022 61.170.80.193 [malware hosting]",
        "http://www.tabxexplorer.com/lenovo",
        "Tracking: trackite.com \u2022 track.beanstalkdata.com \u2022 http://tracking.butterflymx.com/ls/click?upn= \u2022 sonymobilemail.com \u2022 connect.grovelfun.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "#lowfi:hstr:autoititv3modguidmark",
            "Artro",
            "Darkcomet",
            "Win.malware.generickdz-9982080-0",
            "Trojan:win32/zusy",
            "Win.malware.autoit-7732194-0",
            "!autoit_3_00_third_party"
          ],
          "industries": [
            "Civil society",
            "Technology",
            "Telecommunications"
          ],
          "unique_indicators": 30721
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/kanxue.com",
    "whois": "http://whois.domaintools.com/kanxue.com",
    "domain": "kanxue.com",
    "hostname": "bbs.kanxue.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "65e24b157718e7ddf71765db",
      "name": "Lenovo Tablet K series  Remotely Connects & controls Devices",
      "description": "Lenovo K series Tablet resource used to connect to thermostat devices and develops full CnC of victims network. All types of malicious abuses from dumping to spyware, tracking, enabling device features, listening to room. Creates zombie devices. Zusy: Man-in-the-middle attacks, injection, stealer.\n | AutoIt_3_00_Third_Party: treat actors dependent on various environments to load maware, when exploited, user interface , scripting, malicious activity possible by hidden users",
      "modified": "2024-03-31T15:02:37.900000",
      "created": "2024-03-01T21:39:33.521000",
      "tags": [
        "url http",
        "search",
        "lenovo type",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "status",
        "united",
        "unknown",
        "creation date",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "date",
        "next",
        "meta",
        "tabx explorer",
        "urls",
        "hichina",
        "record value",
        "entries",
        "explorer",
        "target",
        "china unknown",
        "as4812 china",
        "as58461",
        "as4808 china",
        "smartchat",
        "vary",
        "accept encoding",
        "ipv4",
        "pulse submit",
        "dns replication",
        "as4837 china",
        "aaaa",
        "as9808 china",
        "whitelisted",
        "nxdomain",
        "as56047 china",
        "as58542 tianjij",
        "ns nxdomain",
        "body",
        "pe32",
        "intel",
        "ms windows",
        "windows activex",
        "control panel",
        "item",
        "win16 ne",
        "pe32 compiler",
        "exe32",
        "compiler",
        "javascript",
        "win32 exe",
        "kb file",
        "files",
        "file type",
        "javascript code",
        "windows",
        "text",
        "web open",
        "font format",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "connection",
        "date fri",
        "contacted",
        "whois record",
        "pe resource",
        "execution",
        "communicating",
        "siblings",
        "referrer",
        "whois whois",
        "bundled",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "parent domain",
        "ssl certificate",
        "historical ssl",
        "whois domain",
        "set cookie",
        "gmt path",
        "url analysis",
        "find",
        "service",
        "as15169 google",
        "as9009 m247",
        "as14061",
        "as16276",
        "name servers",
        "alienvault",
        "open threat",
        "yara rule",
        "high",
        "show",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "accept",
        "copy",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "malware",
        "zusy",
        "local",
        "json",
        "delete c",
        "ascii text",
        "suspicious",
        "cookie",
        "jpeg image",
        "exif standard",
        "tiff image",
        "autoit",
        "markus",
        "april",
        "dropper",
        "default",
        "delete",
        "switch",
        "as20940",
        "dynamicloader",
        "medium",
        "http",
        "write c",
        "ciphersuite",
        "a li",
        "amazon ses",
        "moved",
        "pepo campaigns",
        "advanced email",
        "twitter",
        "span",
        "servers",
        "authority",
        "win32upatre feb",
        "artro",
        "apple",
        "typosquatting",
        "botnet",
        "network",
        "advertising botnet",
        "adware",
        "mining",
        "spyware",
        "cnc",
        "mbs"
      ],
      "references": [
        "http://www.tabxexplorer.com/lenovo",
        "114.80.179.242 \u2022 61.170.80.193 [malware hosting]",
        "IDS Detections Zusy Variant CnC Checkin",
        "IDS Signatures: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\t192.168.122.30\t104.18.12.173",
        "Registry:   Read - DisableUserModeCallbackFilter",
        "OTX Alerts: procmem_yara injection_inter_process \u2022 ransomware_file_modifications \u2022 stack_pivot stealth_file antiav_detectfile \u2022 deletes_self",
        "OTX Alerts: cape_extracted_content \u2022 infostealer_cookies \u2022 recon_fingerprint \u2022 suricata_alert \u2022 anomalous_deletefile dead_connect \u2022dynamic_function_loading ipc_namedpipe powershell_download createtoolhelp32snapshot_module_enumeration reads_self antidebug_ntsetinformationthread injection_rwx network_http",
        "Stack pivoting was detected when using a critical API",
        "Tracking: trackite.com \u2022 track.beanstalkdata.com \u2022 http://tracking.butterflymx.com/ls/click?upn= \u2022 sonymobilemail.com \u2022 connect.grovelfun.com",
        "apple.ios-slgn-in.com \u2022 appleid.com \u2022 apple.com  \u2022 http://apple.ddianle.com \u2022 http://write.52toolbox.com/cms/privacy_policy_lenovo.html",
        "http://desk.52toolbox.com/cms/agreement_lenovo.html \u2022 http://chat.52toolbox.com/cms/agreement_lenovo.html \u2022 www.tabxexplorer.com",
        "https://www.starbucks.com.cn/mobile-view/en/help/terms/digital-starbucks-rewards-kit?supportTel=fals \u2022 https://u.ysepay.com:8288/MobileGate/login.do",
        "https://download.tenorshare.cn/go/reiboot-for-android_2420.exe?track[banner]=home&track[mobilebanner]=ferragosto20220719&track[tslateset]=undefined&track[w]=3840&track[h]=220?linksource&track[utm_source]=awin&track[utm_medium]=affiliate&track[utm_term]=213429&track[awc]=18616_1659086165_ce9efdb1e9f159a1234acd82324b61a8&track[realMedium]=affiliate&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.tenorshare.cn/guide/ios-system-recovery.html&track[sid]=118",
        "http://www.beneat.cn/mobile/index/index \u2022 http://www.beneat.cn/mobile/index/startAdv \u2022 http://www.beneat.cn/mobile/live/index",
        "http://www.beneat.cn/mobile/room/index \u2022 http://www.beneat.cn/mobile/user/cate  \u2022 http://www.tabxexplorer.com/channel/Commonapi?pid",
        "http://gahub.qijihezi.cn/outlink/others/UbisoftConnectInstaller.exe \u2022 http://zb1.baidu581.com/zhuobiao2/?nid=63047\\r\\nConnection: [location]",
        "accountchooser.com [malicious remote drive by] pop up covers screen, chooses from listed acompromised phone | no click |",
        "Multiple remotewd remotewd.com [DGA domain name changed, moved still active as]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Generickdz-9982080-0",
          "display_name": "Win.Malware.Generickdz-9982080-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
          "display_name": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
          "target": null
        },
        {
          "id": "Win.Malware.Autoit-7732194-0",
          "display_name": "Win.Malware.Autoit-7732194-0",
          "target": null
        },
        {
          "id": "DarkComet",
          "display_name": "DarkComet",
          "target": null
        },
        {
          "id": "!AutoIt_3_00_Third_Party",
          "display_name": "!AutoIt_3_00_Third_Party",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1463",
          "name": "Manipulate Device Communication",
          "display_name": "T1463 - Manipulate Device Communication"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1037.003",
          "name": "Network Logon Script",
          "display_name": "T1037.003 - Network Logon Script"
        }
      ],
      "industries": [
        "Civil Society",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8359,
        "domain": 1687,
        "hostname": 1746,
        "email": 7,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 224,
        "FileHash-SHA256": 1862,
        "CVE": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 14244,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "749 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65e24b1cd80668c22e7e1c7a",
      "name": "Lenovo Tablet K series  Remotely Connects & controls Devices",
      "description": "Lenovo K series Tablet resource used to connect to thermostat devices and develops full CnC of victims network. All types of malicious abuses from dumping to spyware, tracking, enabling device features, listening to room. Creates zombie devices. Zusy: Man-in-the-middle attacks, injection, stealer.\n | AutoIt_3_00_Third_Party: treat actors dependent on various environments to load maware, when exploited, user interface , scripting, malicious activity possible by hidden users",
      "modified": "2024-03-31T15:02:37.900000",
      "created": "2024-03-01T21:39:40.078000",
      "tags": [
        "url http",
        "search",
        "lenovo type",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "status",
        "united",
        "unknown",
        "creation date",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse pulses",
        "passive dns",
        "date",
        "next",
        "meta",
        "tabx explorer",
        "urls",
        "hichina",
        "record value",
        "entries",
        "explorer",
        "target",
        "china unknown",
        "as4812 china",
        "as58461",
        "as4808 china",
        "smartchat",
        "vary",
        "accept encoding",
        "ipv4",
        "pulse submit",
        "dns replication",
        "as4837 china",
        "aaaa",
        "as9808 china",
        "whitelisted",
        "nxdomain",
        "as56047 china",
        "as58542 tianjij",
        "ns nxdomain",
        "body",
        "pe32",
        "intel",
        "ms windows",
        "windows activex",
        "control panel",
        "item",
        "win16 ne",
        "pe32 compiler",
        "exe32",
        "compiler",
        "javascript",
        "win32 exe",
        "kb file",
        "files",
        "file type",
        "javascript code",
        "windows",
        "text",
        "web open",
        "font format",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "connection",
        "date fri",
        "contacted",
        "whois record",
        "pe resource",
        "execution",
        "communicating",
        "siblings",
        "referrer",
        "whois whois",
        "bundled",
        "resolutions",
        "contacted urls",
        "siblings domain",
        "parent domain",
        "ssl certificate",
        "historical ssl",
        "whois domain",
        "set cookie",
        "gmt path",
        "url analysis",
        "find",
        "service",
        "as15169 google",
        "as9009 m247",
        "as14061",
        "as16276",
        "name servers",
        "alienvault",
        "open threat",
        "yara rule",
        "high",
        "show",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "accept",
        "copy",
        "write",
        "pecompact",
        "february",
        "packer",
        "delphi",
        "win32",
        "malware",
        "zusy",
        "local",
        "json",
        "delete c",
        "ascii text",
        "suspicious",
        "cookie",
        "jpeg image",
        "exif standard",
        "tiff image",
        "autoit",
        "markus",
        "april",
        "dropper",
        "default",
        "delete",
        "switch",
        "as20940",
        "dynamicloader",
        "medium",
        "http",
        "write c",
        "ciphersuite",
        "a li",
        "amazon ses",
        "moved",
        "pepo campaigns",
        "advanced email",
        "twitter",
        "span",
        "servers",
        "authority",
        "win32upatre feb",
        "artro",
        "apple",
        "typosquatting",
        "botnet",
        "network",
        "advertising botnet",
        "adware",
        "mining",
        "spyware",
        "cnc",
        "mbs"
      ],
      "references": [
        "http://www.tabxexplorer.com/lenovo",
        "114.80.179.242 \u2022 61.170.80.193 [malware hosting]",
        "IDS Detections Zusy Variant CnC Checkin",
        "IDS Signatures: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\t192.168.122.30\t104.18.12.173",
        "Registry:   Read - DisableUserModeCallbackFilter",
        "OTX Alerts: procmem_yara injection_inter_process \u2022 ransomware_file_modifications \u2022 stack_pivot stealth_file antiav_detectfile \u2022 deletes_self",
        "OTX Alerts: cape_extracted_content \u2022 infostealer_cookies \u2022 recon_fingerprint \u2022 suricata_alert \u2022 anomalous_deletefile dead_connect \u2022dynamic_function_loading ipc_namedpipe powershell_download createtoolhelp32snapshot_module_enumeration reads_self antidebug_ntsetinformationthread injection_rwx network_http",
        "Stack pivoting was detected when using a critical API",
        "Tracking: trackite.com \u2022 track.beanstalkdata.com \u2022 http://tracking.butterflymx.com/ls/click?upn= \u2022 sonymobilemail.com \u2022 connect.grovelfun.com",
        "apple.ios-slgn-in.com \u2022 appleid.com \u2022 apple.com  \u2022 http://apple.ddianle.com \u2022 http://write.52toolbox.com/cms/privacy_policy_lenovo.html",
        "http://desk.52toolbox.com/cms/agreement_lenovo.html \u2022 http://chat.52toolbox.com/cms/agreement_lenovo.html \u2022 www.tabxexplorer.com",
        "https://www.starbucks.com.cn/mobile-view/en/help/terms/digital-starbucks-rewards-kit?supportTel=fals \u2022 https://u.ysepay.com:8288/MobileGate/login.do",
        "https://download.tenorshare.cn/go/reiboot-for-android_2420.exe?track[banner]=home&track[mobilebanner]=ferragosto20220719&track[tslateset]=undefined&track[w]=3840&track[h]=220?linksource&track[utm_source]=awin&track[utm_medium]=affiliate&track[utm_term]=213429&track[awc]=18616_1659086165_ce9efdb1e9f159a1234acd82324b61a8&track[realMedium]=affiliate&track[cross_end_id]=-LyP4be7B42T9sbA&track[type]=2&track[page]=https://www.tenorshare.cn/guide/ios-system-recovery.html&track[sid]=118",
        "http://www.beneat.cn/mobile/index/index \u2022 http://www.beneat.cn/mobile/index/startAdv \u2022 http://www.beneat.cn/mobile/live/index",
        "http://www.beneat.cn/mobile/room/index \u2022 http://www.beneat.cn/mobile/user/cate  \u2022 http://www.tabxexplorer.com/channel/Commonapi?pid",
        "http://gahub.qijihezi.cn/outlink/others/UbisoftConnectInstaller.exe \u2022 http://zb1.baidu581.com/zhuobiao2/?nid=63047\\r\\nConnection: [location]",
        "accountchooser.com [malicious remote drive by] pop up covers screen, chooses from listed acompromised phone | no click |",
        "Multiple remotewd remotewd.com [DGA domain name changed, moved still active as]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Generickdz-9982080-0",
          "display_name": "Win.Malware.Generickdz-9982080-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
          "display_name": "#Lowfi:HSTR:AutoitItV3ModGUIDMark",
          "target": null
        },
        {
          "id": "Win.Malware.Autoit-7732194-0",
          "display_name": "Win.Malware.Autoit-7732194-0",
          "target": null
        },
        {
          "id": "DarkComet",
          "display_name": "DarkComet",
          "target": null
        },
        {
          "id": "!AutoIt_3_00_Third_Party",
          "display_name": "!AutoIt_3_00_Third_Party",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1463",
          "name": "Manipulate Device Communication",
          "display_name": "T1463 - Manipulate Device Communication"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1037.003",
          "name": "Network Logon Script",
          "display_name": "T1037.003 - Network Logon Script"
        }
      ],
      "industries": [
        "Civil Society",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8359,
        "domain": 1687,
        "hostname": 1746,
        "email": 7,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 224,
        "FileHash-SHA256": 1862,
        "CVE": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 14244,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "749 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://bbs.kanxue.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://bbs.kanxue.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776680212.9288323
}