{
  "type": "URL",
  "indicator": "https://c.microsoftstart.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://c.microsoftstart.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3783945481,
      "indicator": "https://c.microsoftstart.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "68a0cb6a89a10d13623a0018",
          "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet",
          "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and  investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets  personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told  their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink",
          "modified": "2025-09-15T16:04:47.043000",
          "created": "2025-08-16T18:18:18.657000",
          "tags": [
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "entries",
            "httponly",
            "samesitelax",
            "read c",
            "medium",
            "rgba",
            "unicode",
            "port",
            "memcommit",
            "delete",
            "next",
            "dock",
            "write",
            "execution",
            "present aug",
            "united",
            "ip address",
            "name servers",
            "unknown ns",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "pattern match",
            "show technique",
            "ck matrix",
            "refresh",
            "body",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "href",
            "size",
            "t1480 execution",
            "file defense",
            "ascii text",
            "trojan",
            "passive dns",
            "trojandropper",
            "next associated",
            "fastly error",
            "please",
            "sea p",
            "mozilla",
            "accept",
            "ipv4 add",
            "urls",
            "files",
            "location united",
            "ipv4",
            "url analysis",
            "america flag",
            "america asn",
            "backdoor",
            "win32",
            "malware",
            "date",
            "domain",
            "segoe ui",
            "a domains",
            "security tls",
            "san jose",
            "asn8075",
            "reverse dns",
            "software",
            "resource hash",
            "general full",
            "status",
            "emails",
            "expiration date",
            "asp",
            "microsoft oem",
            "found",
            "running webserver",
            "netherlands",
            "creation date",
            "aaaa",
            "certificate",
            "protocol h2",
            "name value",
            "hash",
            "present jun",
            "present apr",
            "moved",
            "control att",
            "t1573 encrypted",
            "channel command",
            "decrypted ssl",
            "runtime process",
            "appdata",
            "windows nt",
            "svg scalable",
            "patch",
            "internal",
            "core",
            "high",
            "tcp syn",
            "icmp traffic",
            "dns query",
            "av detections",
            "ashburn",
            "ai device id",
            "telnet",
            "windows script",
            "microsoft",
            "host",
            "yara detections",
            "pdb path",
            "pe resource",
            "script host",
            "test",
            "hostname add",
            "files ip",
            "domains",
            "hashes",
            "ireland",
            "mtb jun",
            "mtb may",
            "device local",
            "remotewd",
            "nemtih",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses otx",
            "present jul",
            "domain add",
            "colorado",
            "quasi",
            "contracts",
            "botnet",
            "remote access",
            "virginia",
            "c++",
            "hacking",
            "monitored target",
            "silencing campaign",
            "audio recording",
            "cameras",
            "full service",
            "tactics"
          ],
          "references": [
            "Handled by Lumen Technologies | What kind of darkness is this?",
            "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll  https://myhpnmedicaid.com/Provider",
            "dev.myhpnmedicaid.com",
            "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113",
            "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f",
            "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851",
            "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5",
            "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/   https://dotnet.microsoft.com/en-us/apps/aspnet",
            "Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/",
            "https://dotnet.microsoft.com/en-us/apps/aspnet",
            "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .",
            "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.",
            "ASP.net Open source. A framework for building web apps and services with .NET and C#",
            "Registrant Org: Japan Computer Emergency Response Team Coordination Center",
            "Interesting: unitedhealthcare  cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com",
            "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/",
            "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx",
            "Interesting: memberforms.optumrx.com \u2022  myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com",
            "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Packed.Generic-9967832-0",
              "display_name": "Win.Packed.Generic-9967832-0",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Daws",
              "display_name": "Trojan:Win32/Daws",
              "target": "/malware/Trojan:Win32/Daws"
            },
            {
              "id": "ELF:Mirai-ATI",
              "display_name": "ELF:Mirai-ATI",
              "target": null
            },
            {
              "id": "Trojan:Win32/IRCbot",
              "display_name": "Trojan:Win32/IRCbot",
              "target": "/malware/Trojan:Win32/IRCbot"
            },
            {
              "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/Muldrop.V!MTB",
              "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
              "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            },
            {
              "id": "T1001.003",
              "name": "Protocol Impersonation",
              "display_name": "T1001.003 - Protocol Impersonation"
            },
            {
              "id": "T1092",
              "name": "Communication Through Removable Media",
              "display_name": "T1092 - Communication Through Removable Media"
            },
            {
              "id": "T1433",
              "name": "Access Call Log",
              "display_name": "T1433 - Access Call Log"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Contracts",
            "Government",
            "Finance",
            "Insurance",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4880,
            "domain": 575,
            "hostname": 1419,
            "FileHash-SHA256": 1745,
            "FileHash-MD5": 284,
            "FileHash-SHA1": 263,
            "email": 5,
            "CVE": 1
          },
          "indicator_count": 9172,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "216 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f1860d3062a8cb715ee358",
          "name": "United Healthcare sponsored Healthy Benefits Plus Attack warning - Contactec",
          "description": "",
          "modified": "2024-03-13T10:55:09.654000",
          "created": "2024-03-13T10:55:09.654000",
          "tags": [
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "alexa safe",
            "alexa",
            "malicious url",
            "team malware",
            "phishtank",
            "united",
            "cnc zeus",
            "tracker",
            "cnc server",
            "malware site",
            "malicious site",
            "engineering",
            "telefonica peru",
            "phishing site",
            "zeus",
            "pony",
            "zbot",
            "facebook",
            "andromeda",
            "emotet",
            "download",
            "team",
            "pattern match",
            "ascii text",
            "file",
            "appdata",
            "windows nt",
            "date",
            "mitre att",
            "misc attack",
            "ck id",
            "unknown",
            "click",
            "hybrid",
            "general",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "heur",
            "unsafe",
            "iframe",
            "artemis",
            "agent",
            "downldr",
            "presenoker",
            "riskware",
            "opencandy",
            "cleaner",
            "wacatac",
            "nircmd",
            "swrort",
            "tiggre",
            "filetour",
            "conduit",
            "crack",
            "exploit",
            "phishing",
            "xrat",
            "xtrat",
            "coinminer",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "installpack",
            "fusioncore",
            "raccoon",
            "redline stealer",
            "metastealer",
            "azorult",
            "service",
            "runescape",
            "bank",
            "softcnapp",
            "installcore",
            "unruy",
            "patcher",
            "adload",
            "exit",
            "traffic",
            "et tor",
            "known tor",
            "relayrouter",
            "node tcp",
            "ice fog",
            "anonymizer",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "contacted",
            "whois domain",
            "referrer",
            "contacted urls",
            "communicating",
            "resolutions",
            "roundup",
            "october",
            "skynet",
            "korplug",
            "attack",
            "possible",
            "hacktool",
            "colibri loader",
            "blacklist https",
            "suppobox",
            "cyber threat",
            "bambernek",
            "malicious",
            "ramnit",
            "zpevdo",
            "cnc ransomware",
            "threats et",
            "feodo",
            "formbook",
            "nymaim",
            "cve201711882",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers via",
            "pragma",
            "date thu",
            "solutran",
            "html info",
            "title healthy",
            "benefits plus",
            "easy",
            "access",
            "health benefits",
            "meta tags",
            "google play",
            "plus",
            "apple ios",
            "november",
            "zanubis latam",
            "banker ip",
            "unauthorized",
            "devoted high",
            "android",
            "generic malware",
            "dnspionage",
            "fri may",
            "first",
            "generic",
            "blacklist http",
            "site top",
            "site safe",
            "million alexa",
            "blacknet rat",
            "stealer",
            "cobalt strike",
            "suspicious",
            "win64",
            "show technique",
            "ck matrix",
            "accept",
            "local",
            "filerepmetagen",
            "redirector",
            "script",
            "adware",
            "maltiverse",
            "utc submissions",
            "submitters",
            "corporation",
            "cloudflarenet",
            "lg dacom",
            "attinternet4",
            "bcminfonetas",
            "google",
            "tucows",
            "level3",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "iobit",
            "dropper",
            "trojanx",
            "webshell",
            "noname057",
            "webtoolbar",
            "trojanspy",
            "microsoft",
            "union",
            "paypal",
            "ransomware",
            "virut",
            "root ca",
            "authority",
            "temp",
            "ecc root",
            "span",
            "body",
            "refresh",
            "tools",
            "mail spammer",
            "et cins",
            "active threat",
            "reputation ip",
            "cins active",
            "poor reputation",
            "ip tcp",
            "status url",
            "nixi special",
            "gandi sas",
            "dynadot llc",
            "internet se",
            "namecheap inc",
            "ionos se",
            "dynadot",
            "evoplus ltd",
            "arsys internet",
            "enom",
            "ip detections",
            "country",
            "medicare",
            "apple private",
            "data collection",
            "hostname",
            "url http",
            "author avatar",
            "apple",
            "hours ago",
            "ssdi",
            "command",
            "value",
            "value1",
            "extra",
            "currentversion",
            "partnerid0",
            "username",
            "gamesessionid",
            "false",
            "proxy",
            "firehol",
            "fakealert",
            "asyncrat",
            "applicunwnt",
            "april",
            "threat roundup",
            "368600",
            "320700",
            "startpage"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Taiwan",
            "China",
            "United States of America",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            }
          ],
          "industries": [
            "Health",
            "Food"
          ],
          "TLP": "green",
          "cloned_from": "656d71fbc00b370fde721350",
          "export_count": 49,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2265,
            "FileHash-SHA1": 1101,
            "FileHash-SHA256": 4574,
            "domain": 2209,
            "hostname": 2181,
            "URL": 8911,
            "CVE": 20,
            "email": 1,
            "URI": 1
          },
          "indicator_count": 21263,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "767 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656c2345912bea54c4eeb718",
          "name": "United Healthcare sponsored Healthy Benefits Plus | Apple cyber attack",
          "description": "I received a request regarding AIG subsidiary United healthcare medicare sponsored healthy benefit plus card. Benefits provided to elderly, disabled SSDI recipients who have lower incomes. I learned 200+ were affected.  Remote attacks, apple iOS, phi, health, vision, dental, food beneficiaries. Command and Control server. Research reveals a be deeply impacted target.\nbrowser.events.data.msn.com\nevents-sandbox.data.msn.com\n192.229.211.108 (Virus Network)\nassetscdn.isappcloud.com\nnr-data.net (Apple Private Data Collection)\nphotos1.blogger.com. (Malware site)\nhttp://www.tsarabrashears.com\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \nhttps://www.tsarabrashears.com\ntracker.adxpansion.com access tracker\ntsarabrashears.com\ntt.milehighmedia.com",
          "modified": "2024-01-02T06:03:26.454000",
          "created": "2023-12-03T06:42:13.993000",
          "tags": [
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "alexa safe",
            "alexa",
            "malicious url",
            "team malware",
            "phishtank",
            "united",
            "cnc zeus",
            "tracker",
            "cnc server",
            "malware site",
            "malicious site",
            "engineering",
            "telefonica peru",
            "phishing site",
            "zeus",
            "pony",
            "zbot",
            "facebook",
            "andromeda",
            "emotet",
            "download",
            "team",
            "pattern match",
            "ascii text",
            "file",
            "appdata",
            "windows nt",
            "date",
            "mitre att",
            "misc attack",
            "ck id",
            "unknown",
            "click",
            "hybrid",
            "general",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "heur",
            "unsafe",
            "iframe",
            "artemis",
            "agent",
            "downldr",
            "presenoker",
            "riskware",
            "opencandy",
            "cleaner",
            "wacatac",
            "nircmd",
            "swrort",
            "tiggre",
            "filetour",
            "conduit",
            "crack",
            "exploit",
            "phishing",
            "xrat",
            "xtrat",
            "coinminer",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "installpack",
            "fusioncore",
            "raccoon",
            "redline stealer",
            "metastealer",
            "azorult",
            "service",
            "runescape",
            "bank",
            "softcnapp",
            "installcore",
            "unruy",
            "patcher",
            "adload",
            "exit",
            "traffic",
            "et tor",
            "known tor",
            "relayrouter",
            "node tcp",
            "ice fog",
            "anonymizer",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "contacted",
            "whois domain",
            "referrer",
            "contacted urls",
            "communicating",
            "resolutions",
            "roundup",
            "october",
            "skynet",
            "korplug",
            "attack",
            "possible",
            "hacktool",
            "colibri loader",
            "blacklist https",
            "suppobox",
            "cyber threat",
            "bambernek",
            "malicious",
            "ramnit",
            "zpevdo",
            "cnc ransomware",
            "threats et",
            "feodo",
            "formbook",
            "nymaim",
            "cve201711882",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers via",
            "pragma",
            "date thu",
            "solutran",
            "html info",
            "title healthy",
            "benefits plus",
            "easy",
            "access",
            "health benefits",
            "meta tags",
            "google play",
            "plus",
            "apple ios",
            "november",
            "zanubis latam",
            "banker ip",
            "unauthorized",
            "devoted high",
            "android",
            "generic malware",
            "dnspionage",
            "fri may",
            "first",
            "generic",
            "blacklist http",
            "site top",
            "site safe",
            "million alexa",
            "blacknet rat",
            "stealer",
            "cobalt strike",
            "suspicious",
            "win64",
            "show technique",
            "ck matrix",
            "accept",
            "local",
            "filerepmetagen",
            "redirector",
            "script",
            "adware",
            "maltiverse",
            "utc submissions",
            "submitters",
            "corporation",
            "cloudflarenet",
            "lg dacom",
            "attinternet4",
            "bcminfonetas",
            "google",
            "tucows",
            "level3",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "iobit",
            "dropper",
            "trojanx",
            "webshell",
            "noname057",
            "webtoolbar",
            "trojanspy",
            "microsoft",
            "union",
            "paypal",
            "ransomware",
            "virut",
            "root ca",
            "authority",
            "temp",
            "ecc root",
            "span",
            "body",
            "refresh",
            "tools",
            "mail spammer",
            "et cins",
            "active threat",
            "reputation ip",
            "cins active",
            "poor reputation",
            "ip tcp",
            "status url",
            "nixi special",
            "gandi sas",
            "dynadot llc",
            "internet se",
            "namecheap inc",
            "ionos se",
            "dynadot",
            "evoplus ltd",
            "arsys internet",
            "enom",
            "ip detections",
            "country",
            "medicare",
            "apple private",
            "data collection",
            "hostname",
            "url http",
            "author avatar",
            "apple",
            "hours ago",
            "ssdi",
            "command",
            "value",
            "value1",
            "extra",
            "currentversion",
            "partnerid0",
            "username",
            "gamesessionid",
            "false",
            "proxy",
            "firehol",
            "fakealert",
            "asyncrat",
            "applicunwnt",
            "april",
            "threat roundup",
            "368600",
            "320700",
            "startpage"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Taiwan",
            "China",
            "United States of America",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            }
          ],
          "industries": [
            "Health",
            "Food"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 121,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2265,
            "FileHash-SHA1": 1101,
            "FileHash-SHA256": 4574,
            "domain": 2209,
            "hostname": 2181,
            "URL": 8911,
            "CVE": 20,
            "email": 1,
            "URI": 1
          },
          "indicator_count": 21263,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "838 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656d71fbc00b370fde721350",
          "name": "United Healthcare sponsored Healthy Benefits Plus | Apple cyber ",
          "description": "",
          "modified": "2024-01-02T06:03:26.454000",
          "created": "2023-12-04T06:30:19.057000",
          "tags": [
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "alexa safe",
            "alexa",
            "malicious url",
            "team malware",
            "phishtank",
            "united",
            "cnc zeus",
            "tracker",
            "cnc server",
            "malware site",
            "malicious site",
            "engineering",
            "telefonica peru",
            "phishing site",
            "zeus",
            "pony",
            "zbot",
            "facebook",
            "andromeda",
            "emotet",
            "download",
            "team",
            "pattern match",
            "ascii text",
            "file",
            "appdata",
            "windows nt",
            "date",
            "mitre att",
            "misc attack",
            "ck id",
            "unknown",
            "click",
            "hybrid",
            "general",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "heur",
            "unsafe",
            "iframe",
            "artemis",
            "agent",
            "downldr",
            "presenoker",
            "riskware",
            "opencandy",
            "cleaner",
            "wacatac",
            "nircmd",
            "swrort",
            "tiggre",
            "filetour",
            "conduit",
            "crack",
            "exploit",
            "phishing",
            "xrat",
            "xtrat",
            "coinminer",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "installpack",
            "fusioncore",
            "raccoon",
            "redline stealer",
            "metastealer",
            "azorult",
            "service",
            "runescape",
            "bank",
            "softcnapp",
            "installcore",
            "unruy",
            "patcher",
            "adload",
            "exit",
            "traffic",
            "et tor",
            "known tor",
            "relayrouter",
            "node tcp",
            "ice fog",
            "anonymizer",
            "ssl certificate",
            "whois record",
            "whois whois",
            "historical ssl",
            "contacted",
            "whois domain",
            "referrer",
            "contacted urls",
            "communicating",
            "resolutions",
            "roundup",
            "october",
            "skynet",
            "korplug",
            "attack",
            "possible",
            "hacktool",
            "colibri loader",
            "blacklist https",
            "suppobox",
            "cyber threat",
            "bambernek",
            "malicious",
            "ramnit",
            "zpevdo",
            "cnc ransomware",
            "threats et",
            "feodo",
            "formbook",
            "nymaim",
            "cve201711882",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers via",
            "pragma",
            "date thu",
            "solutran",
            "html info",
            "title healthy",
            "benefits plus",
            "easy",
            "access",
            "health benefits",
            "meta tags",
            "google play",
            "plus",
            "apple ios",
            "november",
            "zanubis latam",
            "banker ip",
            "unauthorized",
            "devoted high",
            "android",
            "generic malware",
            "dnspionage",
            "fri may",
            "first",
            "generic",
            "blacklist http",
            "site top",
            "site safe",
            "million alexa",
            "blacknet rat",
            "stealer",
            "cobalt strike",
            "suspicious",
            "win64",
            "show technique",
            "ck matrix",
            "accept",
            "local",
            "filerepmetagen",
            "redirector",
            "script",
            "adware",
            "maltiverse",
            "utc submissions",
            "submitters",
            "corporation",
            "cloudflarenet",
            "lg dacom",
            "attinternet4",
            "bcminfonetas",
            "google",
            "tucows",
            "level3",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "iobit",
            "dropper",
            "trojanx",
            "webshell",
            "noname057",
            "webtoolbar",
            "trojanspy",
            "microsoft",
            "union",
            "paypal",
            "ransomware",
            "virut",
            "root ca",
            "authority",
            "temp",
            "ecc root",
            "span",
            "body",
            "refresh",
            "tools",
            "mail spammer",
            "et cins",
            "active threat",
            "reputation ip",
            "cins active",
            "poor reputation",
            "ip tcp",
            "status url",
            "nixi special",
            "gandi sas",
            "dynadot llc",
            "internet se",
            "namecheap inc",
            "ionos se",
            "dynadot",
            "evoplus ltd",
            "arsys internet",
            "enom",
            "ip detections",
            "country",
            "medicare",
            "apple private",
            "data collection",
            "hostname",
            "url http",
            "author avatar",
            "apple",
            "hours ago",
            "ssdi",
            "command",
            "value",
            "value1",
            "extra",
            "currentversion",
            "partnerid0",
            "username",
            "gamesessionid",
            "false",
            "proxy",
            "firehol",
            "fakealert",
            "asyncrat",
            "applicunwnt",
            "april",
            "threat roundup",
            "368600",
            "320700",
            "startpage"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Taiwan",
            "China",
            "United States of America",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            }
          ],
          "industries": [
            "Health",
            "Food"
          ],
          "TLP": "green",
          "cloned_from": "656c2345912bea54c4eeb718",
          "export_count": 126,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2265,
            "FileHash-SHA1": 1101,
            "FileHash-SHA256": 4574,
            "domain": 2209,
            "hostname": 2181,
            "URL": 8911,
            "CVE": 20,
            "email": 1,
            "URI": 1
          },
          "indicator_count": 21263,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "838 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6564fa9a3d90d1cd14928b16",
          "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
          "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
          "modified": "2023-12-27T19:03:02.665000",
          "created": "2023-11-27T20:22:50.050000",
          "tags": [
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json url",
            "urls",
            "detection list",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "malicious site",
            "phishing site",
            "malicious url",
            "phishing",
            "riskware",
            "presenoker",
            "artemis",
            "agent",
            "unsafe",
            "opencandy",
            "ursnif",
            "wacatac",
            "team",
            "facebook",
            "runescape",
            "service",
            "downldr",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "installcore",
            "fareit",
            "secrisk",
            "exploit",
            "mimikatz",
            "sorano",
            "emotet",
            "genkryptik",
            "fuery",
            "dbatloader",
            "qakbot",
            "alexa",
            "malicious",
            "union",
            "lumma stealer",
            "fusioncore",
            "cleaner",
            "azorult",
            "bank",
            "blacknet rat",
            "stealer",
            "iframe",
            "trojanspy",
            "analysis",
            "united",
            "firehol",
            "proxy",
            "mail spammer",
            "downloader",
            "malware site",
            "meterpreter",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "unruy",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "generic",
            "dnspionage",
            "expirestue",
            "path",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "alberta",
            "university",
            "edmonton",
            "html info",
            "alberta meta",
            "tags",
            "trackers google",
            "tag manager",
            "gtmkr32",
            "blacklist",
            "low risk",
            "apache",
            "domain",
            "malware found",
            "unknown",
            "minimal low",
            "security risk",
            "medium high",
            "critical",
            "protect",
            "college",
            "mtis",
            "faculties",
            "research",
            "health",
            "a about",
            "news",
            "events",
            "sport",
            "life",
            "find",
            "story",
            "tools",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "pattern match",
            "file",
            "date",
            "factory",
            "hybrid",
            "general",
            "cookie",
            "click",
            "strings",
            "djin",
            "no data",
            "tag count",
            "sample",
            "samples",
            "netsky",
            "cobalt strike",
            "xrat",
            "fakealert",
            "raccoon",
            "redline stealer",
            "metastealer",
            "icedid",
            "quasar rat",
            "acint",
            "anonymizer",
            "blockchain",
            "social engineering",
            "read c",
            "search",
            "show",
            "medium",
            "entries",
            "whitelisted",
            "memcommit",
            "delete",
            "yara detections",
            "next",
            "dock",
            "write",
            "execution",
            "copy",
            "south carolina",
            "federal credit",
            "team proxy",
            "static engine",
            "covid19",
            "redirector",
            "suspic",
            "tue mar",
            "zbot",
            "size68b type",
            "count blacklist",
            "tag tag",
            "rejected sample",
            "icon",
            "analyzed",
            "hwp support",
            "falcon sandbox",
            "multi scan",
            "update",
            "view details",
            "upgrade",
            "blacklist https",
            "keyloggers"
          ],
          "references": [
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
            "uchealth.com",
            "http://michaela.young@uchealth.com",
            "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
            "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
            "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "MimiKatz",
              "display_name": "MimiKatz",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Network RAT",
              "display_name": "Network RAT",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Raccoon",
              "display_name": "Raccoon",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Meterpreter",
              "display_name": "Meterpreter",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "TrojanX",
              "display_name": "TrojanX",
              "target": null
            },
            {
              "id": "BlackNET RAT",
              "display_name": "BlackNET RAT",
              "target": null
            },
            {
              "id": "Brontok",
              "display_name": "Brontok",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1588.004",
              "name": "Digital Certificates",
              "display_name": "T1588.004 - Digital Certificates"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1126",
              "name": "Network Share Connection Removal",
              "display_name": "T1126 - Network Share Connection Removal"
            },
            {
              "id": "T1136",
              "name": "Create Account",
              "display_name": "T1136 - Create Account"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1134.004",
              "name": "Parent PID Spoofing",
              "display_name": "T1134.004 - Parent PID Spoofing"
            }
          ],
          "industries": [
            "Education",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 320,
            "FileHash-SHA1": 172,
            "FileHash-SHA256": 4302,
            "URL": 8243,
            "CIDR": 1,
            "domain": 1742,
            "hostname": 2270,
            "CVE": 18,
            "SSLCertFingerprint": 3,
            "email": 4
          },
          "indicator_count": 17075,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "844 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655a13e4538e896c00f2077e",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "This report is generated by MITRE ATT&CK\u2122 and produced by the team at the University of California, San Francisco, and is available on the web, via the Microsoft Research website.\nTulach, 114.114.114.114, spyware, phishing, fraud, malvertizing, password cracker, iPhone unlocker, malicious, media sharing, miscellaneous attacks.",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-19T13:55:48.898000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655af35616dbd4781c681948",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-20T05:49:10.586000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655a13e4538e896c00f2077e",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5",
        "https://dotnet.microsoft.com/en-us/apps/aspnet",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "Handled by Lumen Technologies | What kind of darkness is this?",
        "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f",
        "Interesting: unitedhealthcare  cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/",
        "uchealth.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "Interesting: memberforms.optumrx.com \u2022  myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com",
        "ASP.net Open source. A framework for building web apps and services with .NET and C#",
        "Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/",
        "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll  https://myhpnmedicaid.com/Provider",
        "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf",
        "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.",
        "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx",
        "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .",
        "http://michaela.young@uchealth.com",
        "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/   https://dotnet.microsoft.com/en-us/apps/aspnet",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851",
        "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113",
        "Registrant Org: Japan Computer Emergency Response Team Coordination Center",
        "dev.myhpnmedicaid.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.packed.generic-9967832-0",
            "Trojanspy",
            "Raccoon",
            "Meterpreter",
            "Network rat",
            "Brontok",
            "Alf:jasyp:trojan:win32/ircbot!atmn",
            "Maltiverse",
            "Trojan:win32/daws",
            "Trojan:win32/ircbot",
            "Webtoolbar",
            "Emotet",
            "Opencandy",
            "Mimikatz",
            "Trojandropper:win32/muldrop.v!mtb",
            "Quasar rat",
            "Custom malware",
            "Trojanx",
            "Malware",
            "Tofsee",
            "Trojan:win32/zombie.a",
            "Generic",
            "Redline stealer",
            "Elf:mirai-ati",
            "Lumma stealer",
            "Qakbot",
            "Unruy",
            "Blacknet rat"
          ],
          "industries": [
            "Food",
            "Contracts",
            "Civil society",
            "Health",
            "Finance",
            "Healthcare",
            "Telecommunications",
            "Government",
            "Technology",
            "Education",
            "Insurance"
          ],
          "unique_indicators": 53236
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/microsoftstart.com",
    "whois": "http://whois.domaintools.com/microsoftstart.com",
    "domain": "microsoftstart.com",
    "hostname": "c.microsoftstart.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "68a0cb6a89a10d13623a0018",
      "name": "Medicaid Mirai Botnet | United Healthcare Mirai Botnet",
      "description": "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll. Medicaid Botnet work managed by Lumen Technologies as part of a massive silencing campaign. |\n\nPhone calls routed since forces and  investigated disclosures of several attack resulting in great bodily harm and life threatening, ending injuries.\nThis campaign date has one start date 11/13/2013.\n#missed assaults internal investigated 10/08/2013 -11/31/ 2013.\nI\u2019m sure other targets are impacted . This stems from targets  personal , documented experiences. \nFormerly k/a Century Link was confronted by associate of targets when a plain clothed male entered targets yard in 11/ 2013, told  their box controlled entire neighborhood. Continuously accessed properties. \n\n\n\n#rip #lumen #botnet #fencing #malware #silencing #civil_liberties # monitored_target #remote #corruption #privacy_abuse #centurylink",
      "modified": "2025-09-15T16:04:47.043000",
      "created": "2025-08-16T18:18:18.657000",
      "tags": [
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "entries",
        "httponly",
        "samesitelax",
        "read c",
        "medium",
        "rgba",
        "unicode",
        "port",
        "memcommit",
        "delete",
        "next",
        "dock",
        "write",
        "execution",
        "present aug",
        "united",
        "ip address",
        "name servers",
        "unknown ns",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "pattern match",
        "show technique",
        "ck matrix",
        "refresh",
        "body",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "href",
        "size",
        "t1480 execution",
        "file defense",
        "ascii text",
        "trojan",
        "passive dns",
        "trojandropper",
        "next associated",
        "fastly error",
        "please",
        "sea p",
        "mozilla",
        "accept",
        "ipv4 add",
        "urls",
        "files",
        "location united",
        "ipv4",
        "url analysis",
        "america flag",
        "america asn",
        "backdoor",
        "win32",
        "malware",
        "date",
        "domain",
        "segoe ui",
        "a domains",
        "security tls",
        "san jose",
        "asn8075",
        "reverse dns",
        "software",
        "resource hash",
        "general full",
        "status",
        "emails",
        "expiration date",
        "asp",
        "microsoft oem",
        "found",
        "running webserver",
        "netherlands",
        "creation date",
        "aaaa",
        "certificate",
        "protocol h2",
        "name value",
        "hash",
        "present jun",
        "present apr",
        "moved",
        "control att",
        "t1573 encrypted",
        "channel command",
        "decrypted ssl",
        "runtime process",
        "appdata",
        "windows nt",
        "svg scalable",
        "patch",
        "internal",
        "core",
        "high",
        "tcp syn",
        "icmp traffic",
        "dns query",
        "av detections",
        "ashburn",
        "ai device id",
        "telnet",
        "windows script",
        "microsoft",
        "host",
        "yara detections",
        "pdb path",
        "pe resource",
        "script host",
        "test",
        "hostname add",
        "files ip",
        "domains",
        "hashes",
        "ireland",
        "mtb jun",
        "mtb may",
        "device local",
        "remotewd",
        "nemtih",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses otx",
        "present jul",
        "domain add",
        "colorado",
        "quasi",
        "contracts",
        "botnet",
        "remote access",
        "virginia",
        "c++",
        "hacking",
        "monitored target",
        "silencing campaign",
        "audio recording",
        "cameras",
        "full service",
        "tactics"
      ],
      "references": [
        "Handled by Lumen Technologies | What kind of darkness is this?",
        "https://myhpnmedicaid.com/Looking-For-A-Plan/Enroll  https://myhpnmedicaid.com/Provider",
        "dev.myhpnmedicaid.com",
        "ELF:Mirai-ATI | United Healthcare Dark? | https://otx.alienvault.com/indicator/ip/205.132.162.113",
        "https://hybrid-analysis.com/sample/e439d3dd3d943ecc702d12998a32e15c00008a8f276e6c89cb54f6de43f36de8/689fccb81c4f237eb6009b0f",
        "https://hybrid-analysis.com/sample/f095ee58f390749315e72cfa46d979cb25a15884b66c7951719c844ebc82b3a3/689fcc753aca4827cd036851",
        "https://hybrid-analysis.com/sample/dd09e575e6dfa77f081bf0014b2494e02f90cb23723fbb35d6b2a92e7c629920/689fcc40b786f8eaa20534b5",
        "Primary Request aspnet dotnet.microsoft.com/en-us/apps/ Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/   https://dotnet.microsoft.com/en-us/apps/aspnet",
        "Redirect Chain  http://asp.net/   https://asp.net/   https://www.asp.net/",
        "https://dotnet.microsoft.com/en-us/apps/aspnet",
        "ASP.net - Hack Together: Mar 1-15 Join the hack. Build an app with NET & Microsoft Graph for a\u2026 .",
        "ASP.net - chance to win prizes! \u53e3\u3001\u4ecb\u5973\u8fa3 All Microsoft Learn more ASP.NET Free. Cross-platform\u2026.",
        "ASP.net Open source. A framework for building web apps and services with .NET and C#",
        "Registrant Org: Japan Computer Emergency Response Team Coordination Center",
        "Interesting: unitedhealthcare  cdn.member.unitedhealthcare.com \u2022 data.aca.unitedhealthcare.com \u2022 data.member.unitedhealthcare.com",
        "Interesting Domain Tactics: https://click.benefits.unitedhealthcare.com/",
        "Interesting: dev-optum-dataintelligence.com \u2022 optumcoding.xxx \u2022 optuminsightcoding.xxx \u2022 optumrx.xxx",
        "Interesting: memberforms.optumrx.com \u2022  myoptum.info \u2022 optumrx.com \u2022 cte-scl.new.optumrx.com \u2022 dev-scl.optumrx.com",
        "http://www.nexcentra.com/fox-news-faces-another-sexual-harassment-lawsuit"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Packed.Generic-9967832-0",
          "display_name": "Win.Packed.Generic-9967832-0",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Daws",
          "display_name": "Trojan:Win32/Daws",
          "target": "/malware/Trojan:Win32/Daws"
        },
        {
          "id": "ELF:Mirai-ATI",
          "display_name": "ELF:Mirai-ATI",
          "target": null
        },
        {
          "id": "Trojan:Win32/IRCbot",
          "display_name": "Trojan:Win32/IRCbot",
          "target": "/malware/Trojan:Win32/IRCbot"
        },
        {
          "id": "alf:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "alf:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/Muldrop.V!MTB",
          "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
          "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        },
        {
          "id": "T1001.003",
          "name": "Protocol Impersonation",
          "display_name": "T1001.003 - Protocol Impersonation"
        },
        {
          "id": "T1092",
          "name": "Communication Through Removable Media",
          "display_name": "T1092 - Communication Through Removable Media"
        },
        {
          "id": "T1433",
          "name": "Access Call Log",
          "display_name": "T1433 - Access Call Log"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Contracts",
        "Government",
        "Finance",
        "Insurance",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4880,
        "domain": 575,
        "hostname": 1419,
        "FileHash-SHA256": 1745,
        "FileHash-MD5": 284,
        "FileHash-SHA1": 263,
        "email": 5,
        "CVE": 1
      },
      "indicator_count": 9172,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "216 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f1860d3062a8cb715ee358",
      "name": "United Healthcare sponsored Healthy Benefits Plus Attack warning - Contactec",
      "description": "",
      "modified": "2024-03-13T10:55:09.654000",
      "created": "2024-03-13T10:55:09.654000",
      "tags": [
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "alexa safe",
        "alexa",
        "malicious url",
        "team malware",
        "phishtank",
        "united",
        "cnc zeus",
        "tracker",
        "cnc server",
        "malware site",
        "malicious site",
        "engineering",
        "telefonica peru",
        "phishing site",
        "zeus",
        "pony",
        "zbot",
        "facebook",
        "andromeda",
        "emotet",
        "download",
        "team",
        "pattern match",
        "ascii text",
        "file",
        "appdata",
        "windows nt",
        "date",
        "mitre att",
        "misc attack",
        "ck id",
        "unknown",
        "click",
        "hybrid",
        "general",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "heur",
        "unsafe",
        "iframe",
        "artemis",
        "agent",
        "downldr",
        "presenoker",
        "riskware",
        "opencandy",
        "cleaner",
        "wacatac",
        "nircmd",
        "swrort",
        "tiggre",
        "filetour",
        "conduit",
        "crack",
        "exploit",
        "phishing",
        "xrat",
        "xtrat",
        "coinminer",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "installpack",
        "fusioncore",
        "raccoon",
        "redline stealer",
        "metastealer",
        "azorult",
        "service",
        "runescape",
        "bank",
        "softcnapp",
        "installcore",
        "unruy",
        "patcher",
        "adload",
        "exit",
        "traffic",
        "et tor",
        "known tor",
        "relayrouter",
        "node tcp",
        "ice fog",
        "anonymizer",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "contacted",
        "whois domain",
        "referrer",
        "contacted urls",
        "communicating",
        "resolutions",
        "roundup",
        "october",
        "skynet",
        "korplug",
        "attack",
        "possible",
        "hacktool",
        "colibri loader",
        "blacklist https",
        "suppobox",
        "cyber threat",
        "bambernek",
        "malicious",
        "ramnit",
        "zpevdo",
        "cnc ransomware",
        "threats et",
        "feodo",
        "formbook",
        "nymaim",
        "cve201711882",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers via",
        "pragma",
        "date thu",
        "solutran",
        "html info",
        "title healthy",
        "benefits plus",
        "easy",
        "access",
        "health benefits",
        "meta tags",
        "google play",
        "plus",
        "apple ios",
        "november",
        "zanubis latam",
        "banker ip",
        "unauthorized",
        "devoted high",
        "android",
        "generic malware",
        "dnspionage",
        "fri may",
        "first",
        "generic",
        "blacklist http",
        "site top",
        "site safe",
        "million alexa",
        "blacknet rat",
        "stealer",
        "cobalt strike",
        "suspicious",
        "win64",
        "show technique",
        "ck matrix",
        "accept",
        "local",
        "filerepmetagen",
        "redirector",
        "script",
        "adware",
        "maltiverse",
        "utc submissions",
        "submitters",
        "corporation",
        "cloudflarenet",
        "lg dacom",
        "attinternet4",
        "bcminfonetas",
        "google",
        "tucows",
        "level3",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "adaptivebee",
        "iobit",
        "dropper",
        "trojanx",
        "webshell",
        "noname057",
        "webtoolbar",
        "trojanspy",
        "microsoft",
        "union",
        "paypal",
        "ransomware",
        "virut",
        "root ca",
        "authority",
        "temp",
        "ecc root",
        "span",
        "body",
        "refresh",
        "tools",
        "mail spammer",
        "et cins",
        "active threat",
        "reputation ip",
        "cins active",
        "poor reputation",
        "ip tcp",
        "status url",
        "nixi special",
        "gandi sas",
        "dynadot llc",
        "internet se",
        "namecheap inc",
        "ionos se",
        "dynadot",
        "evoplus ltd",
        "arsys internet",
        "enom",
        "ip detections",
        "country",
        "medicare",
        "apple private",
        "data collection",
        "hostname",
        "url http",
        "author avatar",
        "apple",
        "hours ago",
        "ssdi",
        "command",
        "value",
        "value1",
        "extra",
        "currentversion",
        "partnerid0",
        "username",
        "gamesessionid",
        "false",
        "proxy",
        "firehol",
        "fakealert",
        "asyncrat",
        "applicunwnt",
        "april",
        "threat roundup",
        "368600",
        "320700",
        "startpage"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Taiwan",
        "China",
        "United States of America",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        }
      ],
      "industries": [
        "Health",
        "Food"
      ],
      "TLP": "green",
      "cloned_from": "656d71fbc00b370fde721350",
      "export_count": 49,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2265,
        "FileHash-SHA1": 1101,
        "FileHash-SHA256": 4574,
        "domain": 2209,
        "hostname": 2181,
        "URL": 8911,
        "CVE": 20,
        "email": 1,
        "URI": 1
      },
      "indicator_count": 21263,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "767 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656c2345912bea54c4eeb718",
      "name": "United Healthcare sponsored Healthy Benefits Plus | Apple cyber attack",
      "description": "I received a request regarding AIG subsidiary United healthcare medicare sponsored healthy benefit plus card. Benefits provided to elderly, disabled SSDI recipients who have lower incomes. I learned 200+ were affected.  Remote attacks, apple iOS, phi, health, vision, dental, food beneficiaries. Command and Control server. Research reveals a be deeply impacted target.\nbrowser.events.data.msn.com\nevents-sandbox.data.msn.com\n192.229.211.108 (Virus Network)\nassetscdn.isappcloud.com\nnr-data.net (Apple Private Data Collection)\nphotos1.blogger.com. (Malware site)\nhttp://www.tsarabrashears.com\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \nhttps://www.tsarabrashears.com\ntracker.adxpansion.com access tracker\ntsarabrashears.com\ntt.milehighmedia.com",
      "modified": "2024-01-02T06:03:26.454000",
      "created": "2023-12-03T06:42:13.993000",
      "tags": [
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "alexa safe",
        "alexa",
        "malicious url",
        "team malware",
        "phishtank",
        "united",
        "cnc zeus",
        "tracker",
        "cnc server",
        "malware site",
        "malicious site",
        "engineering",
        "telefonica peru",
        "phishing site",
        "zeus",
        "pony",
        "zbot",
        "facebook",
        "andromeda",
        "emotet",
        "download",
        "team",
        "pattern match",
        "ascii text",
        "file",
        "appdata",
        "windows nt",
        "date",
        "mitre att",
        "misc attack",
        "ck id",
        "unknown",
        "click",
        "hybrid",
        "general",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "heur",
        "unsafe",
        "iframe",
        "artemis",
        "agent",
        "downldr",
        "presenoker",
        "riskware",
        "opencandy",
        "cleaner",
        "wacatac",
        "nircmd",
        "swrort",
        "tiggre",
        "filetour",
        "conduit",
        "crack",
        "exploit",
        "phishing",
        "xrat",
        "xtrat",
        "coinminer",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "installpack",
        "fusioncore",
        "raccoon",
        "redline stealer",
        "metastealer",
        "azorult",
        "service",
        "runescape",
        "bank",
        "softcnapp",
        "installcore",
        "unruy",
        "patcher",
        "adload",
        "exit",
        "traffic",
        "et tor",
        "known tor",
        "relayrouter",
        "node tcp",
        "ice fog",
        "anonymizer",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "contacted",
        "whois domain",
        "referrer",
        "contacted urls",
        "communicating",
        "resolutions",
        "roundup",
        "october",
        "skynet",
        "korplug",
        "attack",
        "possible",
        "hacktool",
        "colibri loader",
        "blacklist https",
        "suppobox",
        "cyber threat",
        "bambernek",
        "malicious",
        "ramnit",
        "zpevdo",
        "cnc ransomware",
        "threats et",
        "feodo",
        "formbook",
        "nymaim",
        "cve201711882",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers via",
        "pragma",
        "date thu",
        "solutran",
        "html info",
        "title healthy",
        "benefits plus",
        "easy",
        "access",
        "health benefits",
        "meta tags",
        "google play",
        "plus",
        "apple ios",
        "november",
        "zanubis latam",
        "banker ip",
        "unauthorized",
        "devoted high",
        "android",
        "generic malware",
        "dnspionage",
        "fri may",
        "first",
        "generic",
        "blacklist http",
        "site top",
        "site safe",
        "million alexa",
        "blacknet rat",
        "stealer",
        "cobalt strike",
        "suspicious",
        "win64",
        "show technique",
        "ck matrix",
        "accept",
        "local",
        "filerepmetagen",
        "redirector",
        "script",
        "adware",
        "maltiverse",
        "utc submissions",
        "submitters",
        "corporation",
        "cloudflarenet",
        "lg dacom",
        "attinternet4",
        "bcminfonetas",
        "google",
        "tucows",
        "level3",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "adaptivebee",
        "iobit",
        "dropper",
        "trojanx",
        "webshell",
        "noname057",
        "webtoolbar",
        "trojanspy",
        "microsoft",
        "union",
        "paypal",
        "ransomware",
        "virut",
        "root ca",
        "authority",
        "temp",
        "ecc root",
        "span",
        "body",
        "refresh",
        "tools",
        "mail spammer",
        "et cins",
        "active threat",
        "reputation ip",
        "cins active",
        "poor reputation",
        "ip tcp",
        "status url",
        "nixi special",
        "gandi sas",
        "dynadot llc",
        "internet se",
        "namecheap inc",
        "ionos se",
        "dynadot",
        "evoplus ltd",
        "arsys internet",
        "enom",
        "ip detections",
        "country",
        "medicare",
        "apple private",
        "data collection",
        "hostname",
        "url http",
        "author avatar",
        "apple",
        "hours ago",
        "ssdi",
        "command",
        "value",
        "value1",
        "extra",
        "currentversion",
        "partnerid0",
        "username",
        "gamesessionid",
        "false",
        "proxy",
        "firehol",
        "fakealert",
        "asyncrat",
        "applicunwnt",
        "april",
        "threat roundup",
        "368600",
        "320700",
        "startpage"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Taiwan",
        "China",
        "United States of America",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        }
      ],
      "industries": [
        "Health",
        "Food"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 121,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2265,
        "FileHash-SHA1": 1101,
        "FileHash-SHA256": 4574,
        "domain": 2209,
        "hostname": 2181,
        "URL": 8911,
        "CVE": 20,
        "email": 1,
        "URI": 1
      },
      "indicator_count": 21263,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "838 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656d71fbc00b370fde721350",
      "name": "United Healthcare sponsored Healthy Benefits Plus | Apple cyber ",
      "description": "",
      "modified": "2024-01-02T06:03:26.454000",
      "created": "2023-12-04T06:30:19.057000",
      "tags": [
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "alexa safe",
        "alexa",
        "malicious url",
        "team malware",
        "phishtank",
        "united",
        "cnc zeus",
        "tracker",
        "cnc server",
        "malware site",
        "malicious site",
        "engineering",
        "telefonica peru",
        "phishing site",
        "zeus",
        "pony",
        "zbot",
        "facebook",
        "andromeda",
        "emotet",
        "download",
        "team",
        "pattern match",
        "ascii text",
        "file",
        "appdata",
        "windows nt",
        "date",
        "mitre att",
        "misc attack",
        "ck id",
        "unknown",
        "click",
        "hybrid",
        "general",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "heur",
        "unsafe",
        "iframe",
        "artemis",
        "agent",
        "downldr",
        "presenoker",
        "riskware",
        "opencandy",
        "cleaner",
        "wacatac",
        "nircmd",
        "swrort",
        "tiggre",
        "filetour",
        "conduit",
        "crack",
        "exploit",
        "phishing",
        "xrat",
        "xtrat",
        "coinminer",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "installpack",
        "fusioncore",
        "raccoon",
        "redline stealer",
        "metastealer",
        "azorult",
        "service",
        "runescape",
        "bank",
        "softcnapp",
        "installcore",
        "unruy",
        "patcher",
        "adload",
        "exit",
        "traffic",
        "et tor",
        "known tor",
        "relayrouter",
        "node tcp",
        "ice fog",
        "anonymizer",
        "ssl certificate",
        "whois record",
        "whois whois",
        "historical ssl",
        "contacted",
        "whois domain",
        "referrer",
        "contacted urls",
        "communicating",
        "resolutions",
        "roundup",
        "october",
        "skynet",
        "korplug",
        "attack",
        "possible",
        "hacktool",
        "colibri loader",
        "blacklist https",
        "suppobox",
        "cyber threat",
        "bambernek",
        "malicious",
        "ramnit",
        "zpevdo",
        "cnc ransomware",
        "threats et",
        "feodo",
        "formbook",
        "nymaim",
        "cve201711882",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers via",
        "pragma",
        "date thu",
        "solutran",
        "html info",
        "title healthy",
        "benefits plus",
        "easy",
        "access",
        "health benefits",
        "meta tags",
        "google play",
        "plus",
        "apple ios",
        "november",
        "zanubis latam",
        "banker ip",
        "unauthorized",
        "devoted high",
        "android",
        "generic malware",
        "dnspionage",
        "fri may",
        "first",
        "generic",
        "blacklist http",
        "site top",
        "site safe",
        "million alexa",
        "blacknet rat",
        "stealer",
        "cobalt strike",
        "suspicious",
        "win64",
        "show technique",
        "ck matrix",
        "accept",
        "local",
        "filerepmetagen",
        "redirector",
        "script",
        "adware",
        "maltiverse",
        "utc submissions",
        "submitters",
        "corporation",
        "cloudflarenet",
        "lg dacom",
        "attinternet4",
        "bcminfonetas",
        "google",
        "tucows",
        "level3",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "adaptivebee",
        "iobit",
        "dropper",
        "trojanx",
        "webshell",
        "noname057",
        "webtoolbar",
        "trojanspy",
        "microsoft",
        "union",
        "paypal",
        "ransomware",
        "virut",
        "root ca",
        "authority",
        "temp",
        "ecc root",
        "span",
        "body",
        "refresh",
        "tools",
        "mail spammer",
        "et cins",
        "active threat",
        "reputation ip",
        "cins active",
        "poor reputation",
        "ip tcp",
        "status url",
        "nixi special",
        "gandi sas",
        "dynadot llc",
        "internet se",
        "namecheap inc",
        "ionos se",
        "dynadot",
        "evoplus ltd",
        "arsys internet",
        "enom",
        "ip detections",
        "country",
        "medicare",
        "apple private",
        "data collection",
        "hostname",
        "url http",
        "author avatar",
        "apple",
        "hours ago",
        "ssdi",
        "command",
        "value",
        "value1",
        "extra",
        "currentversion",
        "partnerid0",
        "username",
        "gamesessionid",
        "false",
        "proxy",
        "firehol",
        "fakealert",
        "asyncrat",
        "applicunwnt",
        "april",
        "threat roundup",
        "368600",
        "320700",
        "startpage"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Taiwan",
        "China",
        "United States of America",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        }
      ],
      "industries": [
        "Health",
        "Food"
      ],
      "TLP": "green",
      "cloned_from": "656c2345912bea54c4eeb718",
      "export_count": 126,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2265,
        "FileHash-SHA1": 1101,
        "FileHash-SHA256": 4574,
        "domain": 2209,
        "hostname": 2181,
        "URL": 8911,
        "CVE": 20,
        "email": 1,
        "URI": 1
      },
      "indicator_count": 21263,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "838 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6564fa9a3d90d1cd14928b16",
      "name": "Lumma \u2022 University of Alberta \"No Problems\" | T1036 - Masquerading",
      "description": "I was contacted on this forum re: University of Alberta issue. Based on research  www.ualberta.ca redirects. There hasn't been a research effort for redirect. I researched a spoofed website. After viewing senders request, my devices operating system changed, isn't recognized by any accounts, keyloggers.\nFound: Anonymizers, Redirector, Masquerading, Network RAT, Serious Social Engineering, Botnetwork Army, Stealers, Lumma and weirdly targeted  'Tsara Brashears' as a malicious link on a spoofed University in Canada, UCHealth Colorado links.",
      "modified": "2023-12-27T19:03:02.665000",
      "created": "2023-11-27T20:22:50.050000",
      "tags": [
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json url",
        "urls",
        "detection list",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "malicious site",
        "phishing site",
        "malicious url",
        "phishing",
        "riskware",
        "presenoker",
        "artemis",
        "agent",
        "unsafe",
        "opencandy",
        "ursnif",
        "wacatac",
        "team",
        "facebook",
        "runescape",
        "service",
        "downldr",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "installcore",
        "fareit",
        "secrisk",
        "exploit",
        "mimikatz",
        "sorano",
        "emotet",
        "genkryptik",
        "fuery",
        "dbatloader",
        "qakbot",
        "alexa",
        "malicious",
        "union",
        "lumma stealer",
        "fusioncore",
        "cleaner",
        "azorult",
        "bank",
        "blacknet rat",
        "stealer",
        "iframe",
        "trojanspy",
        "analysis",
        "united",
        "firehol",
        "proxy",
        "mail spammer",
        "downloader",
        "malware site",
        "meterpreter",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "unruy",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "generic",
        "dnspionage",
        "expirestue",
        "path",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "alberta",
        "university",
        "edmonton",
        "html info",
        "alberta meta",
        "tags",
        "trackers google",
        "tag manager",
        "gtmkr32",
        "blacklist",
        "low risk",
        "apache",
        "domain",
        "malware found",
        "unknown",
        "minimal low",
        "security risk",
        "medium high",
        "critical",
        "protect",
        "college",
        "mtis",
        "faculties",
        "research",
        "health",
        "a about",
        "news",
        "events",
        "sport",
        "life",
        "find",
        "story",
        "tools",
        "getprocaddress",
        "indicator",
        "prefetch8",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "pattern match",
        "file",
        "date",
        "factory",
        "hybrid",
        "general",
        "cookie",
        "click",
        "strings",
        "djin",
        "no data",
        "tag count",
        "sample",
        "samples",
        "netsky",
        "cobalt strike",
        "xrat",
        "fakealert",
        "raccoon",
        "redline stealer",
        "metastealer",
        "icedid",
        "quasar rat",
        "acint",
        "anonymizer",
        "blockchain",
        "social engineering",
        "read c",
        "search",
        "show",
        "medium",
        "entries",
        "whitelisted",
        "memcommit",
        "delete",
        "yara detections",
        "next",
        "dock",
        "write",
        "execution",
        "copy",
        "south carolina",
        "federal credit",
        "team proxy",
        "static engine",
        "covid19",
        "redirector",
        "suspic",
        "tue mar",
        "zbot",
        "size68b type",
        "count blacklist",
        "tag tag",
        "rejected sample",
        "icon",
        "analyzed",
        "hwp support",
        "falcon sandbox",
        "multi scan",
        "update",
        "view details",
        "upgrade",
        "blacklist https",
        "keyloggers"
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ phishing",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  (iPhone unlocker)",
        "uchealth.com",
        "http://michaela.young@uchealth.com",
        "http://intranet.uchealth.com/Policies/Corporate%20Policies/Standards%20of%20Performance%20and%20Conduct.pdf",
        "https://api2018.uchealth.com/apihc/tass/webportal/apihealthcare_live/default.aspx",
        "https://www.uchealth.com/wp-content/uploads/2017/12/UCHealthInsuranceIndex_120417.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "MimiKatz",
          "display_name": "MimiKatz",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Network RAT",
          "display_name": "Network RAT",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Raccoon",
          "display_name": "Raccoon",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "Meterpreter",
          "display_name": "Meterpreter",
          "target": null
        },
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "TrojanX",
          "display_name": "TrojanX",
          "target": null
        },
        {
          "id": "BlackNET RAT",
          "display_name": "BlackNET RAT",
          "target": null
        },
        {
          "id": "Brontok",
          "display_name": "Brontok",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1588.004",
          "name": "Digital Certificates",
          "display_name": "T1588.004 - Digital Certificates"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1126",
          "name": "Network Share Connection Removal",
          "display_name": "T1126 - Network Share Connection Removal"
        },
        {
          "id": "T1136",
          "name": "Create Account",
          "display_name": "T1136 - Create Account"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1134.004",
          "name": "Parent PID Spoofing",
          "display_name": "T1134.004 - Parent PID Spoofing"
        }
      ],
      "industries": [
        "Education",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 320,
        "FileHash-SHA1": 172,
        "FileHash-SHA256": 4302,
        "URL": 8243,
        "CIDR": 1,
        "domain": 1742,
        "hostname": 2270,
        "CVE": 18,
        "SSLCertFingerprint": 3,
        "email": 4
      },
      "indicator_count": 17075,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "844 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655a13e4538e896c00f2077e",
      "name": "Spyware: http://browser.events.data.microsoftstart.cn",
      "description": "This report is generated by MITRE ATT&CK\u2122 and produced by the team at the University of California, San Francisco, and is available on the web, via the Microsoft Research website.\nTulach, 114.114.114.114, spyware, phishing, fraud, malvertizing, password cracker, iPhone unlocker, malicious, media sharing, miscellaneous attacks.",
      "modified": "2023-12-19T13:01:12.394000",
      "created": "2023-11-19T13:55:48.898000",
      "tags": [
        "linkid246338",
        "whois record",
        "ssl certificate",
        "contacted",
        "execution",
        "historical ssl",
        "whois whois",
        "communicating",
        "resolutions",
        "referrer",
        "random",
        "august",
        "lockbit",
        "attack",
        "core",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "done adding",
        "catalog file",
        "authority",
        "class",
        "mitre att",
        "script",
        "temp",
        "ascii text",
        "date",
        "unknown",
        "service",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "local",
        "click",
        "strings",
        "threat roundup"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 34,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2526,
        "URL": 3515,
        "domain": 458,
        "hostname": 1092
      },
      "indicator_count": 7653,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655af35616dbd4781c681948",
      "name": "Spyware: http://browser.events.data.microsoftstart.cn",
      "description": "",
      "modified": "2023-12-19T13:01:12.394000",
      "created": "2023-11-20T05:49:10.586000",
      "tags": [
        "linkid246338",
        "whois record",
        "ssl certificate",
        "contacted",
        "execution",
        "historical ssl",
        "whois whois",
        "communicating",
        "resolutions",
        "referrer",
        "random",
        "august",
        "lockbit",
        "attack",
        "core",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "done adding",
        "catalog file",
        "authority",
        "class",
        "mitre att",
        "script",
        "temp",
        "ascii text",
        "date",
        "unknown",
        "service",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "local",
        "click",
        "strings",
        "threat roundup"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655a13e4538e896c00f2077e",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 34,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2526,
        "URL": 3515,
        "domain": 458,
        "hostname": 1092
      },
      "indicator_count": 7653,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://c.microsoftstart.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://c.microsoftstart.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638805.9363503
}