{
  "type": "URL",
  "indicator": "https://carprlce.ru",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://carprlce.ru",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4140852561,
      "indicator": "https://carprlce.ru",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68fa56f45f0516a0b3075e7b",
          "name": "EbeeOct2025 Pt3",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2025-11-22T16:03:43.896000",
          "created": "2025-10-23T16:25:24.750000",
          "tags": [],
          "references": [
            "Oct week.3.pdf"
          ],
          "public": 1,
          "adversary": "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 61,
            "CIDR": 2,
            "CVE": 3,
            "FileHash-MD5": 175,
            "FileHash-SHA1": 135,
            "FileHash-SHA256": 190,
            "URL": 42,
            "email": 8,
            "hostname": 48
          },
          "indicator_count": 664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 40,
          "modified_text": "191 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f8370dbfa4975d9b54d236",
          "name": "IOC - Operation MotorBeacon : Threat Actor targets Russian Automotive Sector using .NET Implant",
          "description": "SEQRITE Labs Research Team has recently uncovered a campaign which involves targeting Russian Automobile-Commerce industry which involves commercial as well as automobile oriented transactions , we saw the use of unknown .NET malware which we have dubbed as CAPI Backdoor.\n\nIn this blog, we will explore the technical details of this campaign we encountered during our initial analysis and examine the various stages of the infection chain, starting with a deep dive into the decoy document, to analyzing the CAPI Backdoor. we will then look into the infrastructure along with the common tactics , techniques and procedures (TTPs).",
          "modified": "2025-11-21T01:00:09.046000",
          "created": "2025-10-22T01:44:45.919000",
          "tags": [
            "md5 file",
            "c2 https"
          ],
          "references": [
            "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3,
            "URL": 1,
            "domain": 1
          },
          "indicator_count": 11,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "193 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f777e034d05d1ba2453114",
          "name": "CAPI Backdoor: .NET Stealer Targeting Russian Auto-Commerce",
          "description": "A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.",
          "modified": "2025-11-20T12:03:22.671000",
          "created": "2025-10-21T12:09:04.804000",
          "tags": [
            "malware campaign 2025",
            "e-commerce threats",
            "russian automobile industry",
            "stealer",
            "seqrite labs",
            "threat intelligence",
            "persistence techniques",
            "zero trust protection",
            "rundll32",
            "spearphishing",
            "lnk malware",
            "iocs",
            "mitre att&ck",
            "carprlce.ru",
            "capi backdoor",
            "browser data exfiltration",
            ".net malware",
            "cyber attack analysis",
            "infection chain",
            "adobe.dll",
            "c2 server",
            "zip file",
            "october",
            "malicious",
            "dll implant",
            "lnk script",
            "capi",
            "stage",
            "lolbin",
            "play",
            "team",
            "virustotal",
            "hypervisor"
          ],
          "references": [
            "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "CAPI",
              "display_name": "CAPI",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            }
          ],
          "industries": [
            "Automotive",
            "Automobile"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunter_NL",
            "id": "171283",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3,
            "URL": 1,
            "domain": 2,
            "hostname": 1
          },
          "indicator_count": 13,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 863,
          "modified_text": "193 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68f29195e472fa405a916a2c",
          "name": "Operation MotorBeacon : Threat Actor targets Russian Automotive Sector using .NET Implant.",
          "description": "A recent cybersecurity campaign, dubbed Operation MotorBeacon, has been identified targeting the Russian automotive sector, which encompasses both automotive manufacturing and commerce. The threat actor is utilizing a .NET malware called CAPI Backdoor, discovered on October 3, 2025. This malware was distributed through a malicious ZIP archive that surfaced on VirusTotal, containing decoy documents with PDF and LNK file extensions designed for spear-phishing attacks.",
          "modified": "2025-11-16T18:02:41.412000",
          "created": "2025-10-17T18:57:25.647000",
          "tags": [
            "infection chain",
            "seqrite labs",
            ".net malware",
            "rundll32",
            "threat intelligence",
            "stealer",
            "e-commerce threats",
            "persistence techniques",
            "adobe.dll",
            "russian automobile industry",
            "carprlce.ru",
            "zero trust protection",
            "mitre att&ck",
            "lnk malware",
            "spearphishing",
            "cyber attack analysis",
            "malware campaign 2025",
            "iocs",
            "c2 server",
            "zip file",
            "october",
            "malicious",
            "dll implant",
            "lnk script",
            "capi",
            "stage",
            "lolbin",
            "play",
            "team",
            "virustotal",
            "hypervisor"
          ],
          "references": [
            "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "CAPI",
              "display_name": "CAPI",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1218.010",
              "name": "Regsvr32",
              "display_name": "T1218.010 - Regsvr32"
            },
            {
              "id": "T1564.001",
              "name": "Hidden Files and Directories",
              "display_name": "T1564.001 - Hidden Files and Directories"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 3,
            "URL": 1,
            "domain": 2,
            "hostname": 1
          },
          "indicator_count": 13,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 542,
          "modified_text": "197 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/",
        "Oct week.3.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor"
          ],
          "malware_families": [
            "Capi"
          ],
          "industries": [
            "Automotive",
            "Automobile"
          ],
          "unique_indicators": 778
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/carprlce.ru",
    "whois": "http://whois.domaintools.com/carprlce.ru",
    "domain": "carprlce.ru",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68fa56f45f0516a0b3075e7b",
      "name": "EbeeOct2025 Pt3",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2025-11-22T16:03:43.896000",
      "created": "2025-10-23T16:25:24.750000",
      "tags": [],
      "references": [
        "Oct week.3.pdf"
      ],
      "public": 1,
      "adversary": "Operation Phantom Net, VoxelGhostBat RAT, QilinLinkPro rootkit, Operation MotorBeacon (CAPI Backdoor",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 61,
        "CIDR": 2,
        "CVE": 3,
        "FileHash-MD5": 175,
        "FileHash-SHA1": 135,
        "FileHash-SHA256": 190,
        "URL": 42,
        "email": 8,
        "hostname": 48
      },
      "indicator_count": 664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 40,
      "modified_text": "191 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f8370dbfa4975d9b54d236",
      "name": "IOC - Operation MotorBeacon : Threat Actor targets Russian Automotive Sector using .NET Implant",
      "description": "SEQRITE Labs Research Team has recently uncovered a campaign which involves targeting Russian Automobile-Commerce industry which involves commercial as well as automobile oriented transactions , we saw the use of unknown .NET malware which we have dubbed as CAPI Backdoor.\n\nIn this blog, we will explore the technical details of this campaign we encountered during our initial analysis and examine the various stages of the infection chain, starting with a deep dive into the decoy document, to analyzing the CAPI Backdoor. we will then look into the infrastructure along with the common tactics , techniques and procedures (TTPs).",
      "modified": "2025-11-21T01:00:09.046000",
      "created": "2025-10-22T01:44:45.919000",
      "tags": [
        "md5 file",
        "c2 https"
      ],
      "references": [
        "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3,
        "URL": 1,
        "domain": 1
      },
      "indicator_count": 11,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "193 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f777e034d05d1ba2453114",
      "name": "CAPI Backdoor: .NET Stealer Targeting Russian Auto-Commerce",
      "description": "A spear-phishing campaign targeting the Russian Automobile-Commerce industry using a malicious.NET implant has been uncovered by Seqrite Labs Research Team and is now being investigated by the FBI.",
      "modified": "2025-11-20T12:03:22.671000",
      "created": "2025-10-21T12:09:04.804000",
      "tags": [
        "malware campaign 2025",
        "e-commerce threats",
        "russian automobile industry",
        "stealer",
        "seqrite labs",
        "threat intelligence",
        "persistence techniques",
        "zero trust protection",
        "rundll32",
        "spearphishing",
        "lnk malware",
        "iocs",
        "mitre att&ck",
        "carprlce.ru",
        "capi backdoor",
        "browser data exfiltration",
        ".net malware",
        "cyber attack analysis",
        "infection chain",
        "adobe.dll",
        "c2 server",
        "zip file",
        "october",
        "malicious",
        "dll implant",
        "lnk script",
        "capi",
        "stage",
        "lolbin",
        "play",
        "team",
        "virustotal",
        "hypervisor"
      ],
      "references": [
        "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "CAPI",
          "display_name": "CAPI",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        }
      ],
      "industries": [
        "Automotive",
        "Automobile"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunter_NL",
        "id": "171283",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3,
        "URL": 1,
        "domain": 2,
        "hostname": 1
      },
      "indicator_count": 13,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 863,
      "modified_text": "193 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68f29195e472fa405a916a2c",
      "name": "Operation MotorBeacon : Threat Actor targets Russian Automotive Sector using .NET Implant.",
      "description": "A recent cybersecurity campaign, dubbed Operation MotorBeacon, has been identified targeting the Russian automotive sector, which encompasses both automotive manufacturing and commerce. The threat actor is utilizing a .NET malware called CAPI Backdoor, discovered on October 3, 2025. This malware was distributed through a malicious ZIP archive that surfaced on VirusTotal, containing decoy documents with PDF and LNK file extensions designed for spear-phishing attacks.",
      "modified": "2025-11-16T18:02:41.412000",
      "created": "2025-10-17T18:57:25.647000",
      "tags": [
        "infection chain",
        "seqrite labs",
        ".net malware",
        "rundll32",
        "threat intelligence",
        "stealer",
        "e-commerce threats",
        "persistence techniques",
        "adobe.dll",
        "russian automobile industry",
        "carprlce.ru",
        "zero trust protection",
        "mitre att&ck",
        "lnk malware",
        "spearphishing",
        "cyber attack analysis",
        "malware campaign 2025",
        "iocs",
        "c2 server",
        "zip file",
        "october",
        "malicious",
        "dll implant",
        "lnk script",
        "capi",
        "stage",
        "lolbin",
        "play",
        "team",
        "virustotal",
        "hypervisor"
      ],
      "references": [
        "https://www.seqrite.com/blog/seqrite-capi-backdoor-dotnet-stealer-russian-auto-commerce-oct-2025/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "CAPI",
          "display_name": "CAPI",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1218.010",
          "name": "Regsvr32",
          "display_name": "T1218.010 - Regsvr32"
        },
        {
          "id": "T1564.001",
          "name": "Hidden Files and Directories",
          "display_name": "T1564.001 - Hidden Files and Directories"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 3,
        "URL": 1,
        "domain": 2,
        "hostname": 1
      },
      "indicator_count": 13,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 542,
      "modified_text": "197 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://carprlce.ru",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://carprlce.ru",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780396666.2092884
}