{
  "type": "URL",
  "indicator": "https://bita.hamrah-akhar.tk",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://bita.hamrah-akhar.tk",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3923380268,
      "indicator": "https://bita.hamrah-akhar.tk",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "66eb1585832bcf4f494f0335",
          "name": "Telco - Swipper | Emotet and other malware spreader. BGP Bridging",
          "description": "",
          "modified": "2024-10-20T13:04:44.866000",
          "created": "2024-09-18T18:01:41.013000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ca37ac60cb425a2b3856c6",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4635,
            "domain": 771,
            "email": 11,
            "hostname": 1993,
            "FileHash-SHA256": 3185,
            "FileHash-MD5": 113,
            "FileHash-SHA1": 101,
            "CVE": 3
          },
          "indicator_count": 10814,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "547 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c661131c5003925e9bfe15",
          "name": "Telco - Swipper | Emoted and other malware spreader. BGP related ?",
          "description": "I'm not sure what to make of this. I'm unnerved. As far back as  I have been able to research, Swipper has been ever present, not even hiding in the attacks target who noticed this for themselves.Some information is no longer on the Internet , yet there are continuous command multiple IP's. This relates directly to the suspect hacker & co. Use of FreeDNS and many other tools related to this resource with the Net Handle Name: Swipper. It's seems to be prominent on Colorado, Ohio Constantly moving to the British Virgin Islands while having am Ashburn, Va [Loudon, Co]- Verizon  Business address ont he MCI block [FBI nearby] Swipper was connected to targets Notepad for years,; with FBI name and address prominently displayed. Mysterious emails, and false  MD referral locations of victim pointed back to a Swipper or Stephen Middleton IP address. It's always has a variant of Emotet. I don't know. Abuse of use by same  attorney.",
          "modified": "2024-09-20T20:04:19.210000",
          "created": "2024-08-21T21:50:11.612000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4338,
            "domain": 753,
            "email": 9,
            "hostname": 1799,
            "FileHash-SHA256": 3098,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 98,
            "CVE": 3
          },
          "indicator_count": 10210,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c66114103f15aab3b00d6c",
          "name": "Telco - Swipper | Emoted and other malware spreader. BGP related ?",
          "description": "I'm not sure what to make of this. I'm unnerved. As far back as  I have been able to research, Swipper has been ever present, not even hiding in the attacks target who noticed this for themselves.Some information is no longer on the Internet , yet there are continuous command multiple IP's. This relates directly to the suspect hacker & co. Use of FreeDNS and many other tools related to this resource with the Net Handle Name: Swipper. It's seems to be prominent on Colorado, Ohio Constantly moving to the British Virgin Islands while having am Ashburn, Va [Loudon, Co]- Verizon  Business address ont he MCI block [FBI nearby] Swipper was connected to targets Notepad for years,; with FBI name and address prominently displayed. Mysterious emails, and false  MD referral locations of victim pointed back to a Swipper or Stephen Middleton IP address. It's always has a variant of Emotet. I don't know. Abuse of use by same  attorney.",
          "modified": "2024-09-20T20:04:19.210000",
          "created": "2024-08-21T21:50:12.543000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4338,
            "domain": 753,
            "email": 9,
            "hostname": 1799,
            "FileHash-SHA256": 3098,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 98,
            "CVE": 3
          },
          "indicator_count": 10210,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ca37ac60cb425a2b3856c6",
          "name": "Telco - Swipper | Emotet and other malware spreader. BGP Hurricane Electric related ",
          "description": "",
          "modified": "2024-09-20T20:04:19.210000",
          "created": "2024-08-24T19:42:36.642000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66c66114103f15aab3b00d6c",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4338,
            "domain": 753,
            "email": 9,
            "hostname": 1799,
            "FileHash-SHA256": 3098,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 98,
            "CVE": 3
          },
          "indicator_count": 10210,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d4b052225d396d18e395c3",
          "name": " Telco - SWIPPER | Emotet and other malware spreader. BGP Hurricane Electric ",
          "description": "",
          "modified": "2024-09-20T20:04:19.210000",
          "created": "2024-09-01T18:20:02.256000",
          "tags": [
            "net152",
            "net1520000",
            "loudoun county",
            "ans core",
            "nethandle",
            "as1321",
            "parkway city",
            "as701 orgnocref",
            "swipper",
            "verizon",
            "high",
            "intel",
            "icmp traffic",
            "dns query",
            "object",
            "all scoreblue",
            "filehash",
            "malware",
            "comcast",
            "cve1102",
            "actors",
            "investigation",
            "bad domains",
            "emotet am",
            "iocs",
            "first",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "webcc",
            "gmo internet",
            "csc corporate",
            "domains",
            "alibaba cloud",
            "computing",
            "beijing",
            "dynadot",
            "ltd dba",
            "china telecom",
            "group",
            "google",
            "cloudflarenet",
            "kb txtresse",
            "mb smartsaver",
            "admin cmd",
            "mb threatsniper",
            "mb history",
            "mb gadget",
            "installer",
            "referrer",
            "styes worm",
            "historical ssl",
            "script script",
            "i span",
            "ie script",
            "win64",
            "span",
            "urls",
            "levelblue labs",
            "pulses",
            "nastya",
            "meta",
            "open",
            "date",
            "vj92",
            "uagdaaeqcqaaaag",
            "ukgbagaqcqaaaae",
            "slfrd1",
            "hostnames",
            "urls http",
            "ukgbagaqcq",
            "jid1886833764",
            "jid882556742",
            "samples",
            "unknown",
            "united",
            "as20940",
            "as2914 ntt",
            "nxdomain",
            "status",
            "as6461 zayo",
            "united kingdom",
            "as15169 google",
            "as33438",
            "search",
            "creation date",
            "name servers",
            "showing",
            "hungary unknown",
            "entries",
            "scan endpoints",
            "next",
            "cape",
            "show",
            "copy",
            "emotet malware",
            "read",
            "write",
            "delete",
            "june",
            "emotet",
            "as14627",
            "passive dns",
            "ipv4",
            "pulse pulses",
            "win32",
            "months ago",
            "created",
            "modified",
            "email",
            "glupteba",
            "hostname",
            "cyber",
            "read c",
            "port",
            "medium",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "dock",
            "execution",
            "method status",
            "url hostname",
            "ip country",
            "type get",
            "cachecontrol",
            "location https",
            "date thu",
            "gmt server",
            "code",
            "ve234 server",
            "aaaa",
            "whitelisted",
            "as44273 host",
            "as46691",
            "domain",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "trojan",
            "body"
          ],
          "references": [
            "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
            "Antivirus Detections: Other:Malware-gen\\ [Trj]",
            "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
            "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
            "Yara Detections: osx_GoLang",
            ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
            "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
            "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
            "http://appleidi-iforgot.3utilities.com/Verify.php",
            "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
            "152.199.171.19 : USDA Fort Collins, Colorado",
            "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
            "152.199.161.19: ANS Communications, Inc (ANS)",
            "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
            "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
            "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
            "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
            "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
            "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
            "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "SLF:Trojan:Win32/Grandoreiro.A",
              "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Emotet-9951800-0",
              "display_name": "Win.Trojan.Emotet-9951800-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66ca37ac60cb425a2b3856c6",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "URL": 4338,
            "domain": 753,
            "email": 9,
            "hostname": 1799,
            "FileHash-SHA256": 3098,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 98,
            "CVE": 3
          },
          "indicator_count": 10210,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "577 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66994bda3e150656cd5ac9dd",
          "name": "Browser Session Hijacking Various MyChart Phishing Scams",
          "description": "Ongoing issues with medical information hijacking. Various medical corporations affected. Tracking, medical, injection process, records retrieval, botnets.",
          "modified": "2024-08-17T16:01:11.866000",
          "created": "2024-07-18T17:07:38.719000",
          "tags": [
            "historical ssl",
            "referrer",
            "domains",
            "august",
            "phishingscams",
            "domains part",
            "domain tracker",
            "roundup",
            "new problems",
            "privacy badger",
            "startpage",
            "self",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "pragma",
            "mychartlocale",
            "urls",
            "ip detections",
            "country",
            "contacted",
            "files",
            "file type",
            "name file",
            "gmbh",
            "cloudflare",
            "tucows",
            "ii llc",
            "alibaba cloud",
            "computing",
            "sample",
            "media t1091",
            "t1497 may",
            "mitre att",
            "access ta0001",
            "replication",
            "ta0004 process",
            "injection t1055",
            "defense evasion",
            "http requests",
            "get http",
            "request",
            "host",
            "dns resolutions",
            "ip traffic",
            "hashes",
            "tsara brashears",
            "red team",
            "hackers",
            "highly targeted",
            "critical risk",
            "cyberstalking",
            "apple",
            "apple ios",
            "logistics",
            "cyber defense",
            "guloader",
            "hacktool",
            "emotet",
            "phishing",
            "facebook",
            "malware",
            "hiddentear",
            "maze",
            "server",
            "domain status",
            "date",
            "algorithm",
            "google llc",
            "registrar abuse",
            "registrar",
            "record type",
            "ttl value",
            "aaaa",
            "whois lookup",
            "admin country",
            "ca creation",
            "dnssec",
            "markmonitor",
            "siblings",
            "whois lookups",
            "expiration date",
            "registrar iana",
            "creation date",
            "first",
            "united",
            "as15169 google",
            "cname",
            "status",
            "virtool",
            "cryp",
            "as396982 google",
            "search",
            "name servers",
            "win32",
            "remote"
          ],
          "references": [
            "MyChart Phishing Scams",
            "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82",
            "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win64-Trojan/Pakes.Exp",
              "display_name": "Win64-Trojan/Pakes.Exp",
              "target": null
            },
            {
              "id": "Win64:RansomX-gen",
              "display_name": "Win64:RansomX-gen",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 37,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 3473,
            "domain": 693,
            "URL": 4384,
            "hostname": 1610,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10235,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "611 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "Yara Detections: osx_GoLang",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "MyChart Phishing Scams"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Virtool:win32/injector",
            "Slf:trojan:win32/grandoreiro.a",
            "Other:malware-gen\\ [trj]",
            "Win.trojan.emotet-9951800-0",
            "Win64:ransomx-gen",
            "Win64-trojan/pakes.exp"
          ],
          "industries": [
            "Technology",
            "Healthcare"
          ],
          "unique_indicators": 21127
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hamrah-akhar.tk",
    "whois": "http://whois.domaintools.com/hamrah-akhar.tk",
    "domain": "hamrah-akhar.tk",
    "hostname": "bita.hamrah-akhar.tk"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "66eb1585832bcf4f494f0335",
      "name": "Telco - Swipper | Emotet and other malware spreader. BGP Bridging",
      "description": "",
      "modified": "2024-10-20T13:04:44.866000",
      "created": "2024-09-18T18:01:41.013000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ca37ac60cb425a2b3856c6",
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4635,
        "domain": 771,
        "email": 11,
        "hostname": 1993,
        "FileHash-SHA256": 3185,
        "FileHash-MD5": 113,
        "FileHash-SHA1": 101,
        "CVE": 3
      },
      "indicator_count": 10814,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "547 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66c661131c5003925e9bfe15",
      "name": "Telco - Swipper | Emoted and other malware spreader. BGP related ?",
      "description": "I'm not sure what to make of this. I'm unnerved. As far back as  I have been able to research, Swipper has been ever present, not even hiding in the attacks target who noticed this for themselves.Some information is no longer on the Internet , yet there are continuous command multiple IP's. This relates directly to the suspect hacker & co. Use of FreeDNS and many other tools related to this resource with the Net Handle Name: Swipper. It's seems to be prominent on Colorado, Ohio Constantly moving to the British Virgin Islands while having am Ashburn, Va [Loudon, Co]- Verizon  Business address ont he MCI block [FBI nearby] Swipper was connected to targets Notepad for years,; with FBI name and address prominently displayed. Mysterious emails, and false  MD referral locations of victim pointed back to a Swipper or Stephen Middleton IP address. It's always has a variant of Emotet. I don't know. Abuse of use by same  attorney.",
      "modified": "2024-09-20T20:04:19.210000",
      "created": "2024-08-21T21:50:11.612000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4338,
        "domain": 753,
        "email": 9,
        "hostname": 1799,
        "FileHash-SHA256": 3098,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 98,
        "CVE": 3
      },
      "indicator_count": 10210,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "577 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66c66114103f15aab3b00d6c",
      "name": "Telco - Swipper | Emoted and other malware spreader. BGP related ?",
      "description": "I'm not sure what to make of this. I'm unnerved. As far back as  I have been able to research, Swipper has been ever present, not even hiding in the attacks target who noticed this for themselves.Some information is no longer on the Internet , yet there are continuous command multiple IP's. This relates directly to the suspect hacker & co. Use of FreeDNS and many other tools related to this resource with the Net Handle Name: Swipper. It's seems to be prominent on Colorado, Ohio Constantly moving to the British Virgin Islands while having am Ashburn, Va [Loudon, Co]- Verizon  Business address ont he MCI block [FBI nearby] Swipper was connected to targets Notepad for years,; with FBI name and address prominently displayed. Mysterious emails, and false  MD referral locations of victim pointed back to a Swipper or Stephen Middleton IP address. It's always has a variant of Emotet. I don't know. Abuse of use by same  attorney.",
      "modified": "2024-09-20T20:04:19.210000",
      "created": "2024-08-21T21:50:12.543000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4338,
        "domain": 753,
        "email": 9,
        "hostname": 1799,
        "FileHash-SHA256": 3098,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 98,
        "CVE": 3
      },
      "indicator_count": 10210,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "577 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66ca37ac60cb425a2b3856c6",
      "name": "Telco - Swipper | Emotet and other malware spreader. BGP Hurricane Electric related ",
      "description": "",
      "modified": "2024-09-20T20:04:19.210000",
      "created": "2024-08-24T19:42:36.642000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66c66114103f15aab3b00d6c",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4338,
        "domain": 753,
        "email": 9,
        "hostname": 1799,
        "FileHash-SHA256": 3098,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 98,
        "CVE": 3
      },
      "indicator_count": 10210,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "577 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d4b052225d396d18e395c3",
      "name": " Telco - SWIPPER | Emotet and other malware spreader. BGP Hurricane Electric ",
      "description": "",
      "modified": "2024-09-20T20:04:19.210000",
      "created": "2024-09-01T18:20:02.256000",
      "tags": [
        "net152",
        "net1520000",
        "loudoun county",
        "ans core",
        "nethandle",
        "as1321",
        "parkway city",
        "as701 orgnocref",
        "swipper",
        "verizon",
        "high",
        "intel",
        "icmp traffic",
        "dns query",
        "object",
        "all scoreblue",
        "filehash",
        "malware",
        "comcast",
        "cve1102",
        "actors",
        "investigation",
        "bad domains",
        "emotet am",
        "iocs",
        "first",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "webcc",
        "gmo internet",
        "csc corporate",
        "domains",
        "alibaba cloud",
        "computing",
        "beijing",
        "dynadot",
        "ltd dba",
        "china telecom",
        "group",
        "google",
        "cloudflarenet",
        "kb txtresse",
        "mb smartsaver",
        "admin cmd",
        "mb threatsniper",
        "mb history",
        "mb gadget",
        "installer",
        "referrer",
        "styes worm",
        "historical ssl",
        "script script",
        "i span",
        "ie script",
        "win64",
        "span",
        "urls",
        "levelblue labs",
        "pulses",
        "nastya",
        "meta",
        "open",
        "date",
        "vj92",
        "uagdaaeqcqaaaag",
        "ukgbagaqcqaaaae",
        "slfrd1",
        "hostnames",
        "urls http",
        "ukgbagaqcq",
        "jid1886833764",
        "jid882556742",
        "samples",
        "unknown",
        "united",
        "as20940",
        "as2914 ntt",
        "nxdomain",
        "status",
        "as6461 zayo",
        "united kingdom",
        "as15169 google",
        "as33438",
        "search",
        "creation date",
        "name servers",
        "showing",
        "hungary unknown",
        "entries",
        "scan endpoints",
        "next",
        "cape",
        "show",
        "copy",
        "emotet malware",
        "read",
        "write",
        "delete",
        "june",
        "emotet",
        "as14627",
        "passive dns",
        "ipv4",
        "pulse pulses",
        "win32",
        "months ago",
        "created",
        "modified",
        "email",
        "glupteba",
        "hostname",
        "cyber",
        "read c",
        "port",
        "medium",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "dock",
        "execution",
        "method status",
        "url hostname",
        "ip country",
        "type get",
        "cachecontrol",
        "location https",
        "date thu",
        "gmt server",
        "code",
        "ve234 server",
        "aaaa",
        "whitelisted",
        "as44273 host",
        "as46691",
        "domain",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "trojan",
        "body"
      ],
      "references": [
        "Stranger Things  | http://hopto.org/colocrossing/192.3.13.56/telco",
        "Antivirus Detections: Other:Malware-gen\\ [Trj]",
        "Yara Detections: UPXProtectorv10x2 ,  UPX Alerts dead_host network_icmp nolookup_communication",
        "Antivirus Detections: Other:Malware-gen\\ [Trj] , Win.Trojan.Emotet-9951800-0",
        "Yara Detections: osx_GoLang",
        ".trino-11062202-1d32.stress-11061903-3b4c.westus2.projecthilo.net\tprojecthilo.net",
        "0-courier.push.apple.com | https://apple-accouut.sytes.net/ | appupdate-logapple.ddnsking.com | appleidi-iforgot.3utilities.com",
        "http://appleidi-iforgot.3utilities.com/\t | https://appupdate-logapple.ddnsking.com/?reset | http://appleidi-iforgot.3utilities.com/Upload-Identity.php |",
        "http://appleidi-iforgot.3utilities.com/Verify.php",
        "device-ccf717a6-ed4f-4771-abfa-ccaafbfb6526.remotewd.com | device-local-359704df-0b29-4ae8-bbc5-f48b0a4de73c.remotewd.com | remotedev.org | dan.remotedev.org",
        "152.199.171.19 : USDA Fort Collins, Colorado",
        "Swipper: swipper@verizonbusiness.com | help4u@verizonbusiness.com",
        "152.199.161.19: ANS Communications, Inc (ANS)",
        "OrgTechHandle: SWIPP-ARIN OrgTechName: swipper OrgTechPhone: +1-800-900-0241 OrgTechEmail: swipper@verizonbusiness.com",
        "http://bat.bing.com/bat.js |  bounceme.net | bounceme.net | hopto.org | hopto.org |,serveblog.net | serveblog.net",
        "https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://hopto.org/colocrossing/192.3.13.56/telco",
        "Emotet: FileHash-SHA256 9c9459e9a5f0102c034ec013b9d801d38ed474bcd73b7aeded931e5c2a4f75cc",
        "Win.Virus.PolyRansom-5704625-0: FileHash-SHA256 f46de5d0c5dd13f5de6114372542efd1ea048e14f051b64b34c33e96c175cb09",
        "Other:Malware-gen\\ [Trj: FileHash-SHA256 4ef29fd29fd95990a36379ad7a4320f04da64e7ec63546e047e2491e533c71a3",
        "Injection Source: www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: http://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Injection Source: https://www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "SLF:Trojan:Win32/Grandoreiro.A",
          "display_name": "SLF:Trojan:Win32/Grandoreiro.A",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Emotet-9951800-0",
          "display_name": "Win.Trojan.Emotet-9951800-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66ca37ac60cb425a2b3856c6",
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "URL": 4338,
        "domain": 753,
        "email": 9,
        "hostname": 1799,
        "FileHash-SHA256": 3098,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 98,
        "CVE": 3
      },
      "indicator_count": 10210,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "577 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66994bda3e150656cd5ac9dd",
      "name": "Browser Session Hijacking Various MyChart Phishing Scams",
      "description": "Ongoing issues with medical information hijacking. Various medical corporations affected. Tracking, medical, injection process, records retrieval, botnets.",
      "modified": "2024-08-17T16:01:11.866000",
      "created": "2024-07-18T17:07:38.719000",
      "tags": [
        "historical ssl",
        "referrer",
        "domains",
        "august",
        "phishingscams",
        "domains part",
        "domain tracker",
        "roundup",
        "new problems",
        "privacy badger",
        "startpage",
        "self",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "pragma",
        "mychartlocale",
        "urls",
        "ip detections",
        "country",
        "contacted",
        "files",
        "file type",
        "name file",
        "gmbh",
        "cloudflare",
        "tucows",
        "ii llc",
        "alibaba cloud",
        "computing",
        "sample",
        "media t1091",
        "t1497 may",
        "mitre att",
        "access ta0001",
        "replication",
        "ta0004 process",
        "injection t1055",
        "defense evasion",
        "http requests",
        "get http",
        "request",
        "host",
        "dns resolutions",
        "ip traffic",
        "hashes",
        "tsara brashears",
        "red team",
        "hackers",
        "highly targeted",
        "critical risk",
        "cyberstalking",
        "apple",
        "apple ios",
        "logistics",
        "cyber defense",
        "guloader",
        "hacktool",
        "emotet",
        "phishing",
        "facebook",
        "malware",
        "hiddentear",
        "maze",
        "server",
        "domain status",
        "date",
        "algorithm",
        "google llc",
        "registrar abuse",
        "registrar",
        "record type",
        "ttl value",
        "aaaa",
        "whois lookup",
        "admin country",
        "ca creation",
        "dnssec",
        "markmonitor",
        "siblings",
        "whois lookups",
        "expiration date",
        "registrar iana",
        "creation date",
        "first",
        "united",
        "as15169 google",
        "cname",
        "status",
        "virtool",
        "cryp",
        "as396982 google",
        "search",
        "name servers",
        "win32",
        "remote"
      ],
      "references": [
        "MyChart Phishing Scams",
        "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82",
        "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win64-Trojan/Pakes.Exp",
          "display_name": "Win64-Trojan/Pakes.Exp",
          "target": null
        },
        {
          "id": "Win64:RansomX-gen",
          "display_name": "Win64:RansomX-gen",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 37,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 3473,
        "domain": 693,
        "URL": 4384,
        "hostname": 1610,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10235,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "611 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://bita.hamrah-akhar.tk",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://bita.hamrah-akhar.tk",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776727233.9881372
}