{
  "type": "URL",
  "indicator": "https://cdn.jsdelivr.net/npm/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cdn.jsdelivr.net/npm/",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #742",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain jsdelivr.net",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain jsdelivr.net",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3849295889,
      "indicator": "https://cdn.jsdelivr.net/npm/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69d49d4f50bbcbba448e8216",
          "name": "CAPE Sandbox",
          "description": "< (RAD) 2016-17:00 BST, 1 July 2017.. and 1 September 2017: \u00c2\u00a31.5m>",
          "modified": "2026-05-07T05:26:39.895000",
          "created": "2026-04-07T05:59:43.870000",
          "tags": [
            "commission",
            "kids meta",
            "tags robots",
            "noindex",
            "program",
            "tags https",
            "trackers google",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "crlf",
            "lf line",
            "cname",
            "dns tcp",
            "udp http",
            "smtp irc",
            "icmp name",
            "response",
            "nxdomain"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 171,
            "URL": 93,
            "email": 1,
            "hostname": 135,
            "domain": 4,
            "FileHash-MD5": 90,
            "FileHash-SHA1": 82
          },
          "indicator_count": 576,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "24 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d49d51414978cc91975d89",
          "name": "CAPE Sandbox",
          "description": "< (RAD) 2016-17:00 BST, 1 July 2017.. and 1 September 2017: \u00c2\u00a31.5m>",
          "modified": "2026-05-07T05:26:39.895000",
          "created": "2026-04-07T05:59:45.176000",
          "tags": [
            "commission",
            "kids meta",
            "tags robots",
            "noindex",
            "program",
            "tags https",
            "trackers google",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "crlf",
            "lf line",
            "cname",
            "dns tcp",
            "udp http",
            "smtp irc",
            "icmp name",
            "response",
            "nxdomain"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 171,
            "URL": 93,
            "email": 1,
            "hostname": 130,
            "domain": 4,
            "FileHash-MD5": 90,
            "FileHash-SHA1": 82
          },
          "indicator_count": 571,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "24 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c954a80675ccc89b0e9b63",
          "name": "Trump #45470 | Palantir container | virus:DOS/Hellspawn + ioS (compromised)",
          "description": "Overt. Trump support campaign text message from #45470. Malicious. Received on a victims hyper compromised iPhone. Attempts to or did take CnC of device. Stutters device, changed App Store , has delete service, device sweep,  shuts down service , halts all pages, denial of service, throttles service, steals\npasswords,  bots , I don\u2019t know if device can be refurbished or research purposes - Palantir DC DGA domains - Trump. Multiple IoC\u2019s , malware with code overlap, it appears to be from a legitimate text for updates #. Visibly affected all aspects of device and software. Commands device shut down. \n[OTX populated: Failed to retrieve suggested indicator for beta-ui, according to the latest results from the Welsh Government's Office for National Statistics (ONS) and the National Data Centre (NDS))",
          "modified": "2025-10-16T12:03:14.279000",
          "created": "2025-09-16T12:14:32.327000",
          "tags": [
            "ttl value",
            "extraction",
            "data upload",
            "failed",
            "extra data",
            "include review",
            "exclude sugges",
            "stop",
            "line",
            "path",
            "polyline",
            "getprocaddress",
            "circle",
            "span",
            "ck id",
            "mitre att",
            "ck matrix",
            "null",
            "error",
            "open",
            "spinner",
            "title",
            "code",
            "iframe",
            "window",
            "void",
            "infinity",
            "crypto",
            "footer",
            "generator",
            "general",
            "format",
            "click",
            "strings",
            "meta",
            "install",
            "encoder",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "evasion att",
            "t1480 execution",
            "file defense",
            "adversaries",
            "calls",
            "reads",
            "defense evasion",
            "model",
            "server",
            "registrar abuse",
            "ascio",
            "contact phone",
            "admin city",
            "admin country",
            "admin postal",
            "dnssec",
            "http",
            "ip address",
            "passive dns",
            "related nids",
            "urls",
            "files location",
            "united",
            "flag united",
            "a domains",
            "search",
            "unknown aaaa",
            "certificate",
            "yara detections",
            "av detections",
            "ids detections",
            "alerts",
            "entries elf",
            "filehash",
            "name servers",
            "servers",
            "moved",
            "script script",
            "aaaa",
            "unknown ns",
            "domain add",
            "formbook cnc",
            "checkin",
            "lowfi",
            "mtb jun",
            "github pages",
            "twitter",
            "accept",
            "cryptobit",
            "extra",
            "referen data",
            "trojanproxy",
            "dynamicloader",
            "high",
            "write c",
            "medium",
            "intel",
            "ms windows",
            "entries",
            "pe32",
            "explorer",
            "worm",
            "write",
            "next",
            "trojan",
            "hellspawn",
            "md5 add",
            "malware",
            "data",
            "included iocs",
            "script urls",
            "script domains",
            "gmt content",
            "cash amtincart",
            "expirestue",
            "domain related",
            "sea x",
            "accept encoding",
            "request id",
            "body doctype",
            "apache",
            "encrypt",
            "skynet",
            "third eye tv",
            "calling",
            "delete app",
            "potus",
            "mtb aug",
            "backdoor",
            "gmt cache",
            "sameorigin",
            "443 ma2592000",
            "ipv4 add",
            "utilads",
            "trojandropper",
            "mtb sep",
            "win32upatre aug",
            "yara rule",
            "as15169",
            "guard",
            "smartassembly",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "domain",
            "url analysis",
            "files",
            "date",
            "delete service",
            "45470",
            "text",
            "hybrid",
            "present sep",
            "body",
            "fastly error",
            "please",
            "xor xor",
            "sha256 add",
            "analysis date",
            "file score",
            "detections alf",
            "june",
            "delphi",
            "attempts",
            "yara",
            "high security",
            "file type",
            "pe packer",
            "ransom"
          ],
          "references": [
            "skynet-dev.tcxn.net tcxn.net Registrar Ascio Technologies, Inc - connection to cloud proxy",
            "TrojanProxy:Win32/Malynfits CodeOverlap TrojanSpy:Win32/Nivdort CodeOverlap virus:Win32/Lywer CodeOverlap",
            "https://cryptobit.live/build/assets/app-CkRYqsKL.js \u2022 cryptobit.live \u2022 t.page \u2022 cdn.wallets.cryptobit.live",
            "Trump Support campaign \u2022_\u2022 lantana-mgmt.washington.palantircloud.com \u2022 containers-reishi.palantirfedstart.com",
            "Virus:DOS/Hellspawn 192.168.122.49 10/16/25\t\u2022  IPv4 142.251.9.105",
            "IDS Detections: Win32/Enosch.A gtalk connectivity check | W32/MoonLight.worm User-Agent (HellSpawn)",
            "PWS:Win32/Ymacco.AA50 Win.Trojan.Generic-9959068-0\t SLF:MSIL/PSTAnomaly.A Win.Dropper.Shakblades-7614016-0\t#LowFI:VBExpensiveLoop Win.Packed.Barys-10031677-0\tTEL:Trojan:MSIL/AgentTesla.VPA!MTB Win.Trojan. Backdoor:MSIL/Remcos!MTB",
            "hasownproperty.call \u2022 fireeye.grhd.",
            "Apple Store verified drop down breach  \u2018Apple took a screenshot of pages\u201d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "TrojanProxy:Win32/Malynfits",
              "display_name": "TrojanProxy:Win32/Malynfits",
              "target": "/malware/TrojanProxy:Win32/Malynfits"
            },
            {
              "id": "Virus:Win32/Lywer",
              "display_name": "Virus:Win32/Lywer",
              "target": "/malware/Virus:Win32/Lywer"
            },
            {
              "id": "Worm:Win32/Lightmoon.H",
              "display_name": "Worm:Win32/Lightmoon.H",
              "target": "/malware/Worm:Win32/Lightmoon.H"
            },
            {
              "id": "Virus:DOS/Hellspawn",
              "display_name": "Virus:DOS/Hellspawn",
              "target": "/malware/Virus:DOS/Hellspawn"
            },
            {
              "id": "Win.Trojan.Dialer-266",
              "display_name": "Win.Trojan.Dialer-266",
              "target": null
            },
            {
              "id": "AgentTesla",
              "display_name": "AgentTesla",
              "target": null
            },
            {
              "id": "Backdoor:MSIL/Remcos",
              "display_name": "Backdoor:MSIL/Remcos",
              "target": "/malware/Backdoor:MSIL/Remcos"
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/Muldrop.V!MTB",
              "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
              "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "#LowFI:VBExpensiveLoop",
              "display_name": "#LowFI:VBExpensiveLoop",
              "target": null
            },
            {
              "id": "TEL:Trojan:MSIL/AgentTesla.VPA!MTB",
              "display_name": "TEL:Trojan:MSIL/AgentTesla.VPA!MTB",
              "target": null
            },
            {
              "id": "PWS:Win32/VB.CU",
              "display_name": "PWS:Win32/VB.CU",
              "target": "/malware/PWS:Win32/VB.CU"
            },
            {
              "id": "ALF:Ransom:Win32/Babax.SG!MTB",
              "display_name": "ALF:Ransom:Win32/Babax.SG!MTB",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1489",
              "name": "Service Stop",
              "display_name": "T1489 - Service Stop"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 690,
            "URL": 1479,
            "domain": 476,
            "FileHash-MD5": 526,
            "FileHash-SHA1": 505,
            "FileHash-SHA256": 1509,
            "email": 6
          },
          "indicator_count": 5191,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f1accda30d94af7e846357",
          "name": "Zendesk as VirusTotal \u00bb Ransom:Win32/CVE",
          "description": "*https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088 |||\n\n*In this situation a target received a VirusTotal / Zendesk drive by pop up message that site was unauthorized , fraud risk. The link has it all! Downloaders, install core, browser bar malware, ransomware, python script. Heavy attack. Desires deletion of device , accounts and contents.\n |||\nALF:HeraklezEval:Ransom:Win32/CVE , \nALF:Trojan:Win32/Cassini_6d4ebdc9 ,\nBackdoor:Win32/Zegost ,\nCVE-2023-22518 ,\nCVE-2023-4966 ,\nFakeAV.FOR ,\nMalware:AddsCopyToStartup ,\nNinite ,\nNoobyProtect ,\nTEL:Trojan:Win64/GoCLR ,\nTELPER:HSTR:CLEAN:Ninite ,\nTrojan:Win32/Cobaltstrike ,\nTrojan:Win32/Dridex ,\nTrojan:Win32/Fanop ,\nTrojan:Win32/Neconyd ,\nTrojan:Win32/Startpage ,\nTrojan:Win32/Zombie ,\nVirTool:Win32/Injector.gen!BQ ,\nVirTool:Win32/Obfuscator ,\nWin.Trojan.Generic-9935365-0 ,\nWorm:Win32/Autorun",
          "modified": "2024-10-23T17:03:27.463000",
          "created": "2024-09-23T18:00:45.146000",
          "tags": [
            "as396982 google",
            "setup",
            "passive dns",
            "unknown",
            "ninite sep",
            "a td",
            "443 ma2592000",
            "accept",
            "gmt cache",
            "trojan",
            "status",
            "name servers",
            "urls",
            "creation date",
            "search",
            "emails",
            "servers",
            "as15169 google",
            "aaaa",
            "cname",
            "virtool",
            "cryp",
            "as19527 google",
            "win32",
            "related pulses",
            "file samples",
            "files matching",
            "date hash",
            "trojan features",
            "entries",
            "search otx",
            "telper",
            "worm",
            "copyright",
            "levelblue",
            "files domain",
            "files related",
            "pulses none",
            "accept accept",
            "as16625 akamai",
            "as20940",
            "asnone united",
            "nxdomain",
            "expiration date",
            "as21342",
            "as132147",
            "china",
            "as9808 china",
            "body",
            "all scoreblue",
            "backdoor",
            "alf features",
            "all search",
            "domain",
            "as15133 verizon",
            "as16552 tiggee",
            "url https",
            "http",
            "hostname",
            "ninite",
            "united states",
            "scan endpoints",
            "show",
            "showing",
            "next",
            "united",
            "as54113",
            "github pages",
            "formbook cnc",
            "checkin",
            "mtb aug",
            "a domains",
            "class",
            "twitter",
            "certificate",
            "record value",
            "pulse pulses",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "div div",
            "github",
            "meta",
            "homepage",
            "form",
            "as36459",
            "g2 tls",
            "rsa sha256",
            "as29791",
            "dynamicloader",
            "medium",
            "yara detections",
            "dynamic",
            "filehash",
            "sha256",
            "february",
            "copy",
            "otx telemetry",
            "related tags",
            "a li",
            "span p",
            "dj ai",
            "dongjun jeong",
            "a h2",
            "writeups",
            "infosec journey",
            "script urls",
            "netherlands",
            "a nxdomain",
            "aaaa nxdomain",
            "cloudfront",
            "trojandropper",
            "china unknown",
            "msie",
            "chrome",
            "ipv4",
            "noobyprotect",
            "files",
            "peeringdb",
            "sign",
            "github copilot",
            "view",
            "notifications",
            "branches tags",
            "code issues",
            "pull",
            "write",
            "star",
            "code",
            "stars",
            "python",
            "shell",
            "footer",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "as62597 nsone",
            "dnssec",
            "win32mydoom sep",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "query",
            "jpn write",
            "e0e8e",
            "observed dns",
            "expiro",
            "defender",
            "malware",
            "possible",
            "suspicious",
            "activity dns",
            "mtb may",
            "sameorigin",
            "domain name",
            "error",
            "moved",
            "server",
            "mtb sep",
            "win32cve sep",
            "cloud provider",
            "reverse dns",
            "america asn",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "pulses",
            "default",
            "yara rule",
            "high",
            "cnc checkin",
            "cape",
            "powershell",
            "vmprotect",
            "local",
            "agent",
            "domainabuse",
            "su liao",
            "zhi pin",
            "application",
            "expiro malware",
            "anomalous file",
            "june",
            "fakedout threat",
            "analyzer paste",
            "iocs",
            "samples",
            "exploit",
            "germany unknown",
            "as14636",
            "russia unknown",
            "as9123 timeweb",
            "as45102 alibaba",
            "as43830",
            "read c",
            "write c",
            "process32nextw",
            "regsetvalueexa",
            "regdword",
            "installcore",
            "format",
            "delphi",
            "stack",
            "downloader",
            "urls http",
            "delete c",
            "tls handshake",
            "number",
            "failure",
            "delete",
            "ids detections",
            "fadok",
            "template",
            "slcc2",
            "media center",
            "contacted",
            "ollydbg",
            "internal",
            "simda",
            "brian sabey",
            "going dark",
            "stop",
            "as14061",
            "hostnames",
            "as48287 jsc",
            "as50340",
            "czechia unknown",
            "date"
          ],
          "references": [
            "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088",
            "GitHub - peeringdb/peeringdb-py: PeeringDB python client",
            "00-skillsetparadesarrollo.zendesk.com",
            "https://github.com/peeringdb/peeringdb-py",
            "From the lovely Cyber Folks .PL Cover"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Poland",
            "Australia",
            "Austria",
            "Canada",
            "Netherlands",
            "China"
          ],
          "malware_families": [
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "CVE-2023-4966",
              "display_name": "CVE-2023-4966",
              "target": null
            },
            {
              "id": "FakeAV.FOR",
              "display_name": "FakeAV.FOR",
              "target": null
            },
            {
              "id": "TELPER:HSTR:CLEAN:Ninite",
              "display_name": "TELPER:HSTR:CLEAN:Ninite",
              "target": null
            },
            {
              "id": "VirTool:Win32/Obfuscator",
              "display_name": "VirTool:Win32/Obfuscator",
              "target": "/malware/VirTool:Win32/Obfuscator"
            },
            {
              "id": "Trojan:Win32/Dridex",
              "display_name": "Trojan:Win32/Dridex",
              "target": "/malware/Trojan:Win32/Dridex"
            },
            {
              "id": "Worm:Win32/Autorun",
              "display_name": "Worm:Win32/Autorun",
              "target": "/malware/Worm:Win32/Autorun"
            },
            {
              "id": "Malware:AddsCopyToStartup",
              "display_name": "Malware:AddsCopyToStartup",
              "target": null
            },
            {
              "id": "Trojan:Win32/Cobaltstrike",
              "display_name": "Trojan:Win32/Cobaltstrike",
              "target": "/malware/Trojan:Win32/Cobaltstrike"
            },
            {
              "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9",
              "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9",
              "target": null
            },
            {
              "id": "Trojan:Win32/Startpage",
              "display_name": "Trojan:Win32/Startpage",
              "target": "/malware/Trojan:Win32/Startpage"
            },
            {
              "id": "Backdoor:Win32/Zegost",
              "display_name": "Backdoor:Win32/Zegost",
              "target": "/malware/Backdoor:Win32/Zegost"
            },
            {
              "id": "Trojan:Win32/Fanop",
              "display_name": "Trojan:Win32/Fanop",
              "target": "/malware/Trojan:Win32/Fanop"
            },
            {
              "id": "Trojan:Win32/Neconyd",
              "display_name": "Trojan:Win32/Neconyd",
              "target": "/malware/Trojan:Win32/Neconyd"
            },
            {
              "id": "Trojan:Win32/Zombie",
              "display_name": "Trojan:Win32/Zombie",
              "target": "/malware/Trojan:Win32/Zombie"
            },
            {
              "id": "Win.Trojan.Generic-9935365-0",
              "display_name": "Win.Trojan.Generic-9935365-0",
              "target": null
            },
            {
              "id": "Ninite",
              "display_name": "Ninite",
              "target": null
            },
            {
              "id": "NoobyProtect",
              "display_name": "NoobyProtect",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win64/GoCLR",
              "display_name": "TEL:Trojan:Win64/GoCLR",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector.gen!BQ",
              "display_name": "VirTool:Win32/Injector.gen!BQ",
              "target": "/malware/VirTool:Win32/Injector.gen!BQ"
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4891,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2436,
            "CVE": 3,
            "FileHash-MD5": 2510,
            "FileHash-SHA1": 2063,
            "FileHash-SHA256": 4054,
            "hostname": 1788,
            "URL": 1228,
            "email": 16
          },
          "indicator_count": 14098,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 244,
          "modified_text": "585 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66c08b488620dac7697026c7",
          "name": "Fakefolder | Ransom:Win32/CVE affecting HCA Healthcare cloud",
          "description": "Cloud computing - User Acceptance Testing (UAT)\napparently used by HCA one of the nations leading healthcare providers. It's seems HCA's cloud is compromised. The cloud has a number of high priority vulnerabilities, malware, ransomware, zero day, etc.  Patient accounts aiming involved, (some patients received letters of serious PII, PHI compromise) lost records, patient blacklisting, hacking, and nefarious manipulations by providers. I've been made aware of CORHIO closing compromised patient accounts. Some patients account access and data has reportedly been lost.\n#VirTool:Win32/Obfuscator.ADB\nALF:HeraklezEval:Ransom:Win32/CVE\nRansom:Win32/StopCrypt.AK!MTB\nRansom:Win32/Wannaren.A\nTrojan:Win32/BlackMon\nTrojan:Win32/Fakefolder\nTulach Malware",
          "modified": "2024-10-15T14:02:54.772000",
          "created": "2024-08-17T11:36:40.810000",
          "tags": [
            "microsoft edge",
            "iocs",
            "alberta ndp",
            "security",
            "vc rescue",
            "disk",
            "apple",
            "google",
            "windows",
            "powershell",
            "security https",
            "no data",
            "tag count",
            "analyzer threat",
            "url summary",
            "ip summary",
            "summary",
            "sample",
            "detection list",
            "site",
            "cisco umbrella",
            "alexa top",
            "blacklist",
            "million",
            "mail spammer",
            "firehol",
            "ip address",
            "noname057",
            "anonymizer",
            "firehol proxy",
            "proxy",
            "india mail",
            "malware",
            "full name",
            "first",
            "v3 serial",
            "number",
            "cus odigicert",
            "global tls",
            "rsa4096 sha256",
            "ca1 validity",
            "subject public",
            "key info",
            "dns replication",
            "date",
            "script script",
            "as12912",
            "a domains",
            "a li",
            "poland unknown",
            "t mobile",
            "domains",
            "przejd",
            "passive dns",
            "authority",
            "meta",
            "accept",
            "cname",
            "record type",
            "ttl value",
            "aaaa",
            "poland",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "location poland",
            "asnone united",
            "moved",
            "location",
            "vary",
            "accept encoding",
            "content type",
            "virtool",
            "related pulses",
            "file samples",
            "files matching",
            "show",
            "search",
            "date hash",
            "next",
            "showing",
            "as39198",
            "body",
            "window",
            "certificate",
            "hostname",
            "unknown",
            "red bull",
            "script urls",
            "as2828 verizon",
            "ireland unknown",
            "gmt content",
            "as8068",
            "as8075",
            "servers",
            "creation date",
            "united",
            "trojan",
            "trojan features",
            "win32",
            "msr aug",
            "urls",
            "reverse dns",
            "trojandropper",
            "historical ssl",
            "referrer",
            "infiltrate",
            "threat network",
            "malicious",
            "snapchat",
            "eternal blue",
            "sneaky simay",
            "groups",
            "covert",
            "probe",
            "whois lookup",
            "domain name",
            "united",
            "as15169 google",
            "a nxdomain",
            "germany",
            "dynamicloader",
            "yara rule",
            "high",
            "medium",
            "port",
            "dynamic",
            "domain",
            "file name",
            "pcap",
            "copy",
            "url host",
            "port method",
            "user agent",
            "okrnserver",
            "002000",
            "hit tcpmemhit",
            "algorithm",
            "data",
            "cus oentrust",
            "entrust",
            "l1k validity",
            "cpl lwarszawa",
            "ot mobile",
            "status",
            "name servers",
            "as6354",
            "mtb aug",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "info",
            "location united",
            "win32 exe",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "vs2010",
            "info compiler",
            "products",
            "vs2008",
            "header intel",
            "name md5",
            "type",
            "language",
            "ascii text",
            "cyrillic",
            "registrar of",
            "domain names",
            "ii llc",
            "contacted",
            "file type",
            "mb file",
            "graph",
            "ip detections",
            "country",
            "type name",
            "network",
            "tsara brashears",
            "december",
            "typhon reborn",
            "speakez securus",
            "hacktool",
            "emotet",
            "formbook",
            "critical",
            "installer",
            "tofsee",
            "hiddentear",
            "cnc",
            "email collection",
            "apple data",
            "data collection",
            "tsara brashears",
            "for privacy",
            "record value",
            "emails",
            "expiration date",
            "swipper",
            "tulach",
            "aitm",
            "query",
            "observed dns",
            "activity dns",
            "total",
            "google llc",
            "pe32",
            "write",
            "april",
            "defender",
            "otx telemetry",
            "win32cve aug",
            "polska s",
            "copyright",
            "levelblue",
            "dashboard",
            "pulse submit",
            "url analysis",
            "as20940",
            "as16625 akamai",
            "entrustdns",
            "france",
            "entries",
            "refresh",
            "443 ma2592000",
            "net174",
            "net1740000",
            "mcics",
            "read c",
            "write c",
            "tlsv1",
            "default",
            "module load",
            "execution",
            "dock",
            "persistence",
            "xport",
            "redacted for",
            "privacy tech",
            "privacy admin",
            "organization",
            "postal code",
            "stateprovince",
            "server",
            "registrar abuse",
            "code",
            "high priority",
            "critical",
            "CVE-2023-29059"
          ],
          "references": [
            "uat.drw.hcahealthcare.cloud | developers.t-mobile.pl | kwvjuemg.exe",
            "uat.drw.hcahealthcare.cloud US Admin Email: cd2fa1f805494bc7s@ehc.com Admin Organization: HCA - Information Technology & Services, Inc.",
            "Antivirus Detections: Ransom:Win32/Wannaren.A UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX Alerts procmem_yara creates_largekey process_creation_suspicious_location network_bind deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window cape_extracted_content injection_rwx network_http",
            "Yara Detections: LZMA ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser , UPX",
            "Alerts: procmem_yara creates_largekey process_creation_suspicious_location network_bind cape_extracted_content",
            "Alerts: deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request injection_rwx network_http",
            "Alerts: network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window",
            "nr-data.net [Apple Private Data Collection]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://twitter.com/PORNO_SEXYBABES | twitter.com | www.pornhub.com | www.anyxxxtube.net",
            "Apple path:https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 | itunes.apple.com",
            "record-viewer-application.hcahealthcare.cloud",
            "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowled",
            "Tulach IP: 114.114.114.114",
            "Antivirus Detections: #VirTool:Win32/Obfuscator.ADB | IDS Detections:Observed DNS Query to .biz TLD | Domains Contacted: pywolwnvd.biz",
            "Yara Detections: SUSP_Unsigned_GoogleUpdate OriginalFilenameGoogleUpdate.exe | Alerts cape_extracted_content",
            "Parent: NET174 (NET-174-0-0-0-0) NetType: Direct Allocation Organization: Verizon Business (MCICS) 'Swipper'",
            "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059\\",
            "cvename.cg | https://cve.mitre.org/cgi | https://cve.mitre.org/cgi-bin/cvename.cg... | https://cve.mitre.org/cgi-bin/cvename.cgi?nam...",
            "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | https://cve.mitre.org/css/main.css",
            "https://cve.mitre.org/images/cvelogobanner.png | https://cve.mitre.org/images/linkedin.jpg | https://cve.mitre.org/images/medium.png",
            "https://cve.mitre.org/images/nvd-logo.png | https://cve.mitre.org/images/search_icon.png | https://cve.mitre.org/images/twitter.jpg",
            "https://cve.mitre.org/images/youtube.png | https://cve.mitre.org/includes/browserheight.js | https://cve.mitre.org/includes/jquery-3.2.1.min.js",
            "https://cve.mitre.org/css/print.css | https://cve.mitre.org/favicon.ico | https://cve.mitre.org/images/GitHub_round_sm",
            "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | cve.mitre.org"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/BlackMon",
              "display_name": "Trojan:Win32/BlackMon",
              "target": "/malware/Trojan:Win32/BlackMon"
            },
            {
              "id": "Trojan:Win32/Fakefolder",
              "display_name": "Trojan:Win32/Fakefolder",
              "target": "/malware/Trojan:Win32/Fakefolder"
            },
            {
              "id": "Ransom:Win32/Wannaren.A",
              "display_name": "Ransom:Win32/Wannaren.A",
              "target": "/malware/Ransom:Win32/Wannaren.A"
            },
            {
              "id": "Ransom:Win32/StopCrypt.AK!MTB",
              "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
              "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology",
            "Civilian Society",
            "Telecommunications",
            "Networking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 53,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1975,
            "FileHash-SHA1": 1731,
            "FileHash-SHA256": 4646,
            "URL": 636,
            "domain": 283,
            "hostname": 798,
            "email": 12,
            "CVE": 3,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 10086,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "593 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e3d1a94659d50264a78fd4",
          "name": "Phishing | TabExplorer attacks compromised networks and devices",
          "description": "",
          "modified": "2024-04-02T01:01:20.068000",
          "created": "2024-03-03T01:26:01.043000",
          "tags": [
            "command decode",
            "suricata ipv4",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "suricata udpv4",
            "date",
            "united",
            "windows nt",
            "win64",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "url http",
            "url https",
            "scan endpoints",
            "all octoseek",
            "report spam",
            "hour ago",
            "whois record",
            "glasgow",
            "scan",
            "iocs",
            "next",
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "ipv4",
            "contacted",
            "execution",
            "pe resource",
            "communicating",
            "urls http",
            "referrer",
            "resolutions",
            "whois whois",
            "collections ip",
            "phishing",
            "attack",
            "loaded module",
            "remote procedure call",
            "search",
            "as15133 verizon",
            "passive dns",
            "urls",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "as8075",
            "as15169 google",
            "as8068",
            "aaaa",
            "cname",
            "a domains",
            "meta",
            "entries",
            "gmt server",
            "ecacc saa83dd",
            "cobalt strike",
            "mozilla",
            "body",
            "brian sabey",
            "hallrender",
            "dynamicloader",
            "show",
            "alerts",
            "trojan",
            "copy",
            "dynamic",
            "medium",
            "reads",
            "write",
            "stealth network",
            "stealth_network",
            "script urls",
            "certificate",
            "rsa sha256",
            "exports data",
            "high",
            "yara rule",
            "yara detections",
            "njrat",
            "cape",
            "njrat malware",
            "sniffs",
            "guard",
            "write c",
            "delete c",
            "ms windows",
            "default",
            "intel",
            "openpgp public",
            "stream",
            "antivm_generic_disk",
            "antivm_generic_bios",
            "network_bind",
            "stealth_file spawns_dev_utility",
            "procmem_yara",
            "enumerates_physical_drives",
            "persistence_ads",
            "dynamic_function_loading",
            "reads_self",
            "suspicious_command_tools",
            "network",
            "rat"
          ],
          "references": [
            "http://www.tabxexplorer.com [phishing]",
            "http://www.tabxexplorer.com/lenovo",
            "GET /lenovo HTTP/1.1 Host: www.tabxexplorer.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0",
            "identity_helper.exe",
            "cdn.easykeys.com",
            "hive21.ctcsoftware.com",
            "www.moxa.com",
            "msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com",
            "IDS Detections: Cobalt Strike Malleable C2 JQuery",
            "IDS Detections: Nullsoft Mozilla UA (NSISDL)",
            "IDS Detections: Observed Suspicious UA (NSISDL/1.2 (Mozilla))",
            "IDS Detections: SSL excessive fatal alerts (possible POODLE attack against server)",
            "IDS Detections: GENERIC Likely Malicious Fake IE Downloading .exe",
            "Tulach Malware: 114.114.114.114",
            "ns3.hallgrandsale.ru",
            "AgentTesla.KM: FileHash-MD5 e0801d62e8379b98177fd94a027e8b30",
            "AgentTesla.KM: FileHash-SHA1 0fa00a939ca8af08c90310b808d1d8fc70a518c3",
            "Yara Detection: Nullsoft_NSIS"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "ALF:Trojan:MSIL/AgentTesla.KM",
              "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
              "target": null
            },
            {
              "id": "ALF:Win32/GbdInf_305B1C9A.J!ibt",
              "display_name": "ALF:Win32/GbdInf_305B1C9A.J!ibt",
              "target": "/malware/ALF:Win32/GbdInf_305B1C9A.J!ibt"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HackTool:Win32/CobaltStrike.A",
              "display_name": "HackTool:Win32/CobaltStrike.A",
              "target": "/malware/HackTool:Win32/CobaltStrike.A"
            },
            {
              "id": "HackTool:Win32/Atosev.A",
              "display_name": "HackTool:Win32/Atosev.A",
              "target": "/malware/HackTool:Win32/Atosev.A"
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Win.Malware.Generickdz-9938530-0",
              "display_name": "Win.Malware.Generickdz-9938530-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Civil Society",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 55,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5551,
            "hostname": 1690,
            "domain": 929,
            "FileHash-SHA256": 2696,
            "FileHash-MD5": 405,
            "FileHash-SHA1": 315,
            "email": 4,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 11591,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "789 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059\\",
        "Alerts: network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window",
        "skynet-dev.tcxn.net tcxn.net Registrar Ascio Technologies, Inc - connection to cloud proxy",
        "Apple Store verified drop down breach  \u2018Apple took a screenshot of pages\u201d",
        "https://cryptobit.live/build/assets/app-CkRYqsKL.js \u2022 cryptobit.live \u2022 t.page \u2022 cdn.wallets.cryptobit.live",
        "Antivirus Detections: Ransom:Win32/Wannaren.A UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX Alerts procmem_yara creates_largekey process_creation_suspicious_location network_bind deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window cape_extracted_content injection_rwx network_http",
        "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | cve.mitre.org",
        "Yara Detections: LZMA ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser , UPX",
        "AgentTesla.KM: FileHash-SHA1 0fa00a939ca8af08c90310b808d1d8fc70a518c3",
        "uat.drw.hcahealthcare.cloud US Admin Email: cd2fa1f805494bc7s@ehc.com Admin Organization: HCA - Information Technology & Services, Inc.",
        "Alerts: deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request injection_rwx network_http",
        "Yara Detections: SUSP_Unsigned_GoogleUpdate OriginalFilenameGoogleUpdate.exe | Alerts cape_extracted_content",
        "IDS Detections: GENERIC Likely Malicious Fake IE Downloading .exe",
        "record-viewer-application.hcahealthcare.cloud",
        "GET /lenovo HTTP/1.1 Host: www.tabxexplorer.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0",
        "hasownproperty.call \u2022 fireeye.grhd.",
        "From the lovely Cyber Folks .PL Cover",
        "https://cve.mitre.org/images/youtube.png | https://cve.mitre.org/includes/browserheight.js | https://cve.mitre.org/includes/jquery-3.2.1.min.js",
        "http://www.tabxexplorer.com/lenovo",
        "cdn.easykeys.com",
        "msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com",
        "IDS Detections: Cobalt Strike Malleable C2 JQuery",
        "cvename.cg | https://cve.mitre.org/cgi | https://cve.mitre.org/cgi-bin/cvename.cg... | https://cve.mitre.org/cgi-bin/cvename.cgi?nam...",
        "IDS Detections: Nullsoft Mozilla UA (NSISDL)",
        "Apple path:https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 | itunes.apple.com",
        "Tulach IP: 114.114.114.114",
        "https://cve.mitre.org/images/cvelogobanner.png | https://cve.mitre.org/images/linkedin.jpg | https://cve.mitre.org/images/medium.png",
        "IDS Detections: SSL excessive fatal alerts (possible POODLE attack against server)",
        "Yara Detection: Nullsoft_NSIS",
        "00-skillsetparadesarrollo.zendesk.com",
        "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088",
        "IDS Detections: Win32/Enosch.A gtalk connectivity check | W32/MoonLight.worm User-Agent (HellSpawn)",
        "Alerts: procmem_yara creates_largekey process_creation_suspicious_location network_bind cape_extracted_content",
        "https://cve.mitre.org/css/print.css | https://cve.mitre.org/favicon.ico | https://cve.mitre.org/images/GitHub_round_sm",
        "http://www.tabxexplorer.com [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Trump Support campaign \u2022_\u2022 lantana-mgmt.washington.palantircloud.com \u2022 containers-reishi.palantirfedstart.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Parent: NET174 (NET-174-0-0-0-0) NetType: Direct Allocation Organization: Verizon Business (MCICS) 'Swipper'",
        "ns3.hallgrandsale.ru",
        "PWS:Win32/Ymacco.AA50 Win.Trojan.Generic-9959068-0\t SLF:MSIL/PSTAnomaly.A Win.Dropper.Shakblades-7614016-0\t#LowFI:VBExpensiveLoop Win.Packed.Barys-10031677-0\tTEL:Trojan:MSIL/AgentTesla.VPA!MTB Win.Trojan. Backdoor:MSIL/Remcos!MTB",
        "www.moxa.com",
        "Antivirus Detections: #VirTool:Win32/Obfuscator.ADB | IDS Detections:Observed DNS Query to .biz TLD | Domains Contacted: pywolwnvd.biz",
        "Virus:DOS/Hellspawn 192.168.122.49 10/16/25\t\u2022  IPv4 142.251.9.105",
        "https://cve.mitre.org/images/nvd-logo.png | https://cve.mitre.org/images/search_icon.png | https://cve.mitre.org/images/twitter.jpg",
        "GitHub - peeringdb/peeringdb-py: PeeringDB python client",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowled",
        "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | https://cve.mitre.org/css/main.css",
        "Tulach Malware: 114.114.114.114",
        "https://github.com/peeringdb/peeringdb-py",
        "https://twitter.com/PORNO_SEXYBABES | twitter.com | www.pornhub.com | www.anyxxxtube.net",
        "hive21.ctcsoftware.com",
        "identity_helper.exe",
        "AgentTesla.KM: FileHash-MD5 e0801d62e8379b98177fd94a027e8b30",
        "nr-data.net [Apple Private Data Collection]",
        "uat.drw.hcahealthcare.cloud | developers.t-mobile.pl | kwvjuemg.exe",
        "TrojanProxy:Win32/Malynfits CodeOverlap TrojanSpy:Win32/Nivdort CodeOverlap virus:Win32/Lywer CodeOverlap",
        "IDS Detections: Observed Suspicious UA (NSISDL/1.2 (Mozilla))"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cve-2023-4966",
            "Tulach malware",
            "Backdoor:win32/zegost",
            "Noobyprotect",
            "Cve-2023-22518",
            "Sabey",
            "Trojan:win32/startpage",
            "Trojan:win32/zombie",
            "Tel:trojan:win64/goclr",
            "Ransom:win32/wannaren.a",
            "Alf:trojan:msil/agenttesla.km",
            "#lowfi:vbexpensiveloop",
            "Win.malware.generickdz-9938530-0",
            "Trojan:win32/cobaltstrike",
            "Win.trojan.generic-9935365-0",
            "Trojanspy:win32/nivdort",
            "Virtool:win32/obfuscator",
            "Malware:addscopytostartup",
            "Alf:win32/gbdinf_305b1c9a.j!ibt",
            "Agenttesla",
            "Telper:hstr:clean:ninite",
            "Tel:trojan:msil/agenttesla.vpa!mtb",
            "Trojandropper:win32/muldrop.v!mtb",
            "Trojan:win32/neconyd",
            "Trojan:win32/dridex",
            "Virtool:win32/injector.gen!bq",
            "Ninite",
            "Trojanproxy:win32/malynfits",
            "Worm:win32/lightmoon.h",
            "Cobalt strike",
            "Virus:dos/hellspawn",
            "Alf:jasyp:trojan:win32/ircbot!atmn",
            "Trojan:win32/fakefolder",
            "Trojan:win32/blackmon",
            "Virus:win32/lywer",
            "Trojan:win32/fanop",
            "Alf:ransom:win32/babax.sg!mtb",
            "Fakeav.for",
            "Ransom:win32/stopcrypt.ak!mtb",
            "Backdoor:msil/remcos",
            "Pws:win32/vb.cu",
            "Alf:heraklezeval:ransom:win32/cve",
            "Hacktool:win32/atosev.a",
            "Alf:trojan:win32/cassini_6d4ebdc9",
            "Tulach",
            "Worm:win32/autorun",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "#virtool:win32/obfuscator.adb",
            "Hallrender",
            "Trojan:win32/zombie.a",
            "Hacktool:win32/cobaltstrike.a",
            "Win.trojan.dialer-266"
          ],
          "industries": [
            "Networking",
            "Technology",
            "Telecommunications",
            "Civilian society",
            "Healthcare",
            "Civil society"
          ],
          "unique_indicators": 42711
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/jsdelivr.net",
    "whois": "http://whois.domaintools.com/jsdelivr.net",
    "domain": "jsdelivr.net",
    "hostname": "cdn.jsdelivr.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69d49d4f50bbcbba448e8216",
      "name": "CAPE Sandbox",
      "description": "< (RAD) 2016-17:00 BST, 1 July 2017.. and 1 September 2017: \u00c2\u00a31.5m>",
      "modified": "2026-05-07T05:26:39.895000",
      "created": "2026-04-07T05:59:43.870000",
      "tags": [
        "commission",
        "kids meta",
        "tags robots",
        "noindex",
        "program",
        "tags https",
        "trackers google",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "crlf",
        "lf line",
        "cname",
        "dns tcp",
        "udp http",
        "smtp irc",
        "icmp name",
        "response",
        "nxdomain"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 171,
        "URL": 93,
        "email": 1,
        "hostname": 135,
        "domain": 4,
        "FileHash-MD5": 90,
        "FileHash-SHA1": 82
      },
      "indicator_count": 576,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "24 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d49d51414978cc91975d89",
      "name": "CAPE Sandbox",
      "description": "< (RAD) 2016-17:00 BST, 1 July 2017.. and 1 September 2017: \u00c2\u00a31.5m>",
      "modified": "2026-05-07T05:26:39.895000",
      "created": "2026-04-07T05:59:45.176000",
      "tags": [
        "commission",
        "kids meta",
        "tags robots",
        "noindex",
        "program",
        "tags https",
        "trackers google",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "crlf",
        "lf line",
        "cname",
        "dns tcp",
        "udp http",
        "smtp irc",
        "icmp name",
        "response",
        "nxdomain"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 171,
        "URL": 93,
        "email": 1,
        "hostname": 130,
        "domain": 4,
        "FileHash-MD5": 90,
        "FileHash-SHA1": 82
      },
      "indicator_count": 571,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "24 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c954a80675ccc89b0e9b63",
      "name": "Trump #45470 | Palantir container | virus:DOS/Hellspawn + ioS (compromised)",
      "description": "Overt. Trump support campaign text message from #45470. Malicious. Received on a victims hyper compromised iPhone. Attempts to or did take CnC of device. Stutters device, changed App Store , has delete service, device sweep,  shuts down service , halts all pages, denial of service, throttles service, steals\npasswords,  bots , I don\u2019t know if device can be refurbished or research purposes - Palantir DC DGA domains - Trump. Multiple IoC\u2019s , malware with code overlap, it appears to be from a legitimate text for updates #. Visibly affected all aspects of device and software. Commands device shut down. \n[OTX populated: Failed to retrieve suggested indicator for beta-ui, according to the latest results from the Welsh Government's Office for National Statistics (ONS) and the National Data Centre (NDS))",
      "modified": "2025-10-16T12:03:14.279000",
      "created": "2025-09-16T12:14:32.327000",
      "tags": [
        "ttl value",
        "extraction",
        "data upload",
        "failed",
        "extra data",
        "include review",
        "exclude sugges",
        "stop",
        "line",
        "path",
        "polyline",
        "getprocaddress",
        "circle",
        "span",
        "ck id",
        "mitre att",
        "ck matrix",
        "null",
        "error",
        "open",
        "spinner",
        "title",
        "code",
        "iframe",
        "window",
        "void",
        "infinity",
        "crypto",
        "footer",
        "generator",
        "general",
        "format",
        "click",
        "strings",
        "meta",
        "install",
        "encoder",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "evasion att",
        "t1480 execution",
        "file defense",
        "adversaries",
        "calls",
        "reads",
        "defense evasion",
        "model",
        "server",
        "registrar abuse",
        "ascio",
        "contact phone",
        "admin city",
        "admin country",
        "admin postal",
        "dnssec",
        "http",
        "ip address",
        "passive dns",
        "related nids",
        "urls",
        "files location",
        "united",
        "flag united",
        "a domains",
        "search",
        "unknown aaaa",
        "certificate",
        "yara detections",
        "av detections",
        "ids detections",
        "alerts",
        "entries elf",
        "filehash",
        "name servers",
        "servers",
        "moved",
        "script script",
        "aaaa",
        "unknown ns",
        "domain add",
        "formbook cnc",
        "checkin",
        "lowfi",
        "mtb jun",
        "github pages",
        "twitter",
        "accept",
        "cryptobit",
        "extra",
        "referen data",
        "trojanproxy",
        "dynamicloader",
        "high",
        "write c",
        "medium",
        "intel",
        "ms windows",
        "entries",
        "pe32",
        "explorer",
        "worm",
        "write",
        "next",
        "trojan",
        "hellspawn",
        "md5 add",
        "malware",
        "data",
        "included iocs",
        "script urls",
        "script domains",
        "gmt content",
        "cash amtincart",
        "expirestue",
        "domain related",
        "sea x",
        "accept encoding",
        "request id",
        "body doctype",
        "apache",
        "encrypt",
        "skynet",
        "third eye tv",
        "calling",
        "delete app",
        "potus",
        "mtb aug",
        "backdoor",
        "gmt cache",
        "sameorigin",
        "443 ma2592000",
        "ipv4 add",
        "utilads",
        "trojandropper",
        "mtb sep",
        "win32upatre aug",
        "yara rule",
        "as15169",
        "guard",
        "smartassembly",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "domain",
        "url analysis",
        "files",
        "date",
        "delete service",
        "45470",
        "text",
        "hybrid",
        "present sep",
        "body",
        "fastly error",
        "please",
        "xor xor",
        "sha256 add",
        "analysis date",
        "file score",
        "detections alf",
        "june",
        "delphi",
        "attempts",
        "yara",
        "high security",
        "file type",
        "pe packer",
        "ransom"
      ],
      "references": [
        "skynet-dev.tcxn.net tcxn.net Registrar Ascio Technologies, Inc - connection to cloud proxy",
        "TrojanProxy:Win32/Malynfits CodeOverlap TrojanSpy:Win32/Nivdort CodeOverlap virus:Win32/Lywer CodeOverlap",
        "https://cryptobit.live/build/assets/app-CkRYqsKL.js \u2022 cryptobit.live \u2022 t.page \u2022 cdn.wallets.cryptobit.live",
        "Trump Support campaign \u2022_\u2022 lantana-mgmt.washington.palantircloud.com \u2022 containers-reishi.palantirfedstart.com",
        "Virus:DOS/Hellspawn 192.168.122.49 10/16/25\t\u2022  IPv4 142.251.9.105",
        "IDS Detections: Win32/Enosch.A gtalk connectivity check | W32/MoonLight.worm User-Agent (HellSpawn)",
        "PWS:Win32/Ymacco.AA50 Win.Trojan.Generic-9959068-0\t SLF:MSIL/PSTAnomaly.A Win.Dropper.Shakblades-7614016-0\t#LowFI:VBExpensiveLoop Win.Packed.Barys-10031677-0\tTEL:Trojan:MSIL/AgentTesla.VPA!MTB Win.Trojan. Backdoor:MSIL/Remcos!MTB",
        "hasownproperty.call \u2022 fireeye.grhd.",
        "Apple Store verified drop down breach  \u2018Apple took a screenshot of pages\u201d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "TrojanProxy:Win32/Malynfits",
          "display_name": "TrojanProxy:Win32/Malynfits",
          "target": "/malware/TrojanProxy:Win32/Malynfits"
        },
        {
          "id": "Virus:Win32/Lywer",
          "display_name": "Virus:Win32/Lywer",
          "target": "/malware/Virus:Win32/Lywer"
        },
        {
          "id": "Worm:Win32/Lightmoon.H",
          "display_name": "Worm:Win32/Lightmoon.H",
          "target": "/malware/Worm:Win32/Lightmoon.H"
        },
        {
          "id": "Virus:DOS/Hellspawn",
          "display_name": "Virus:DOS/Hellspawn",
          "target": "/malware/Virus:DOS/Hellspawn"
        },
        {
          "id": "Win.Trojan.Dialer-266",
          "display_name": "Win.Trojan.Dialer-266",
          "target": null
        },
        {
          "id": "AgentTesla",
          "display_name": "AgentTesla",
          "target": null
        },
        {
          "id": "Backdoor:MSIL/Remcos",
          "display_name": "Backdoor:MSIL/Remcos",
          "target": "/malware/Backdoor:MSIL/Remcos"
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/Muldrop.V!MTB",
          "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
          "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "#LowFI:VBExpensiveLoop",
          "display_name": "#LowFI:VBExpensiveLoop",
          "target": null
        },
        {
          "id": "TEL:Trojan:MSIL/AgentTesla.VPA!MTB",
          "display_name": "TEL:Trojan:MSIL/AgentTesla.VPA!MTB",
          "target": null
        },
        {
          "id": "PWS:Win32/VB.CU",
          "display_name": "PWS:Win32/VB.CU",
          "target": "/malware/PWS:Win32/VB.CU"
        },
        {
          "id": "ALF:Ransom:Win32/Babax.SG!MTB",
          "display_name": "ALF:Ransom:Win32/Babax.SG!MTB",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1489",
          "name": "Service Stop",
          "display_name": "T1489 - Service Stop"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 690,
        "URL": 1479,
        "domain": 476,
        "FileHash-MD5": 526,
        "FileHash-SHA1": 505,
        "FileHash-SHA256": 1509,
        "email": 6
      },
      "indicator_count": 5191,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f1accda30d94af7e846357",
      "name": "Zendesk as VirusTotal \u00bb Ransom:Win32/CVE",
      "description": "*https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088 |||\n\n*In this situation a target received a VirusTotal / Zendesk drive by pop up message that site was unauthorized , fraud risk. The link has it all! Downloaders, install core, browser bar malware, ransomware, python script. Heavy attack. Desires deletion of device , accounts and contents.\n |||\nALF:HeraklezEval:Ransom:Win32/CVE , \nALF:Trojan:Win32/Cassini_6d4ebdc9 ,\nBackdoor:Win32/Zegost ,\nCVE-2023-22518 ,\nCVE-2023-4966 ,\nFakeAV.FOR ,\nMalware:AddsCopyToStartup ,\nNinite ,\nNoobyProtect ,\nTEL:Trojan:Win64/GoCLR ,\nTELPER:HSTR:CLEAN:Ninite ,\nTrojan:Win32/Cobaltstrike ,\nTrojan:Win32/Dridex ,\nTrojan:Win32/Fanop ,\nTrojan:Win32/Neconyd ,\nTrojan:Win32/Startpage ,\nTrojan:Win32/Zombie ,\nVirTool:Win32/Injector.gen!BQ ,\nVirTool:Win32/Obfuscator ,\nWin.Trojan.Generic-9935365-0 ,\nWorm:Win32/Autorun",
      "modified": "2024-10-23T17:03:27.463000",
      "created": "2024-09-23T18:00:45.146000",
      "tags": [
        "as396982 google",
        "setup",
        "passive dns",
        "unknown",
        "ninite sep",
        "a td",
        "443 ma2592000",
        "accept",
        "gmt cache",
        "trojan",
        "status",
        "name servers",
        "urls",
        "creation date",
        "search",
        "emails",
        "servers",
        "as15169 google",
        "aaaa",
        "cname",
        "virtool",
        "cryp",
        "as19527 google",
        "win32",
        "related pulses",
        "file samples",
        "files matching",
        "date hash",
        "trojan features",
        "entries",
        "search otx",
        "telper",
        "worm",
        "copyright",
        "levelblue",
        "files domain",
        "files related",
        "pulses none",
        "accept accept",
        "as16625 akamai",
        "as20940",
        "asnone united",
        "nxdomain",
        "expiration date",
        "as21342",
        "as132147",
        "china",
        "as9808 china",
        "body",
        "all scoreblue",
        "backdoor",
        "alf features",
        "all search",
        "domain",
        "as15133 verizon",
        "as16552 tiggee",
        "url https",
        "http",
        "hostname",
        "ninite",
        "united states",
        "scan endpoints",
        "show",
        "showing",
        "next",
        "united",
        "as54113",
        "github pages",
        "formbook cnc",
        "checkin",
        "mtb aug",
        "a domains",
        "class",
        "twitter",
        "certificate",
        "record value",
        "pulse pulses",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "div div",
        "github",
        "meta",
        "homepage",
        "form",
        "as36459",
        "g2 tls",
        "rsa sha256",
        "as29791",
        "dynamicloader",
        "medium",
        "yara detections",
        "dynamic",
        "filehash",
        "sha256",
        "february",
        "copy",
        "otx telemetry",
        "related tags",
        "a li",
        "span p",
        "dj ai",
        "dongjun jeong",
        "a h2",
        "writeups",
        "infosec journey",
        "script urls",
        "netherlands",
        "a nxdomain",
        "aaaa nxdomain",
        "cloudfront",
        "trojandropper",
        "china unknown",
        "msie",
        "chrome",
        "ipv4",
        "noobyprotect",
        "files",
        "peeringdb",
        "sign",
        "github copilot",
        "view",
        "notifications",
        "branches tags",
        "code issues",
        "pull",
        "write",
        "star",
        "code",
        "stars",
        "python",
        "shell",
        "footer",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "as62597 nsone",
        "dnssec",
        "win32mydoom sep",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "query",
        "jpn write",
        "e0e8e",
        "observed dns",
        "expiro",
        "defender",
        "malware",
        "possible",
        "suspicious",
        "activity dns",
        "mtb may",
        "sameorigin",
        "domain name",
        "error",
        "moved",
        "server",
        "mtb sep",
        "win32cve sep",
        "cloud provider",
        "reverse dns",
        "america asn",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "pulses",
        "default",
        "yara rule",
        "high",
        "cnc checkin",
        "cape",
        "powershell",
        "vmprotect",
        "local",
        "agent",
        "domainabuse",
        "su liao",
        "zhi pin",
        "application",
        "expiro malware",
        "anomalous file",
        "june",
        "fakedout threat",
        "analyzer paste",
        "iocs",
        "samples",
        "exploit",
        "germany unknown",
        "as14636",
        "russia unknown",
        "as9123 timeweb",
        "as45102 alibaba",
        "as43830",
        "read c",
        "write c",
        "process32nextw",
        "regsetvalueexa",
        "regdword",
        "installcore",
        "format",
        "delphi",
        "stack",
        "downloader",
        "urls http",
        "delete c",
        "tls handshake",
        "number",
        "failure",
        "delete",
        "ids detections",
        "fadok",
        "template",
        "slcc2",
        "media center",
        "contacted",
        "ollydbg",
        "internal",
        "simda",
        "brian sabey",
        "going dark",
        "stop",
        "as14061",
        "hostnames",
        "as48287 jsc",
        "as50340",
        "czechia unknown",
        "date"
      ],
      "references": [
        "https://virustotal.zendesk.com/frontendevents/dl?client=1B752747-5778-429A-A0E0-83861AF69088",
        "GitHub - peeringdb/peeringdb-py: PeeringDB python client",
        "00-skillsetparadesarrollo.zendesk.com",
        "https://github.com/peeringdb/peeringdb-py",
        "From the lovely Cyber Folks .PL Cover"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Poland",
        "Australia",
        "Austria",
        "Canada",
        "Netherlands",
        "China"
      ],
      "malware_families": [
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "CVE-2023-4966",
          "display_name": "CVE-2023-4966",
          "target": null
        },
        {
          "id": "FakeAV.FOR",
          "display_name": "FakeAV.FOR",
          "target": null
        },
        {
          "id": "TELPER:HSTR:CLEAN:Ninite",
          "display_name": "TELPER:HSTR:CLEAN:Ninite",
          "target": null
        },
        {
          "id": "VirTool:Win32/Obfuscator",
          "display_name": "VirTool:Win32/Obfuscator",
          "target": "/malware/VirTool:Win32/Obfuscator"
        },
        {
          "id": "Trojan:Win32/Dridex",
          "display_name": "Trojan:Win32/Dridex",
          "target": "/malware/Trojan:Win32/Dridex"
        },
        {
          "id": "Worm:Win32/Autorun",
          "display_name": "Worm:Win32/Autorun",
          "target": "/malware/Worm:Win32/Autorun"
        },
        {
          "id": "Malware:AddsCopyToStartup",
          "display_name": "Malware:AddsCopyToStartup",
          "target": null
        },
        {
          "id": "Trojan:Win32/Cobaltstrike",
          "display_name": "Trojan:Win32/Cobaltstrike",
          "target": "/malware/Trojan:Win32/Cobaltstrike"
        },
        {
          "id": "ALF:Trojan:Win32/Cassini_6d4ebdc9",
          "display_name": "ALF:Trojan:Win32/Cassini_6d4ebdc9",
          "target": null
        },
        {
          "id": "Trojan:Win32/Startpage",
          "display_name": "Trojan:Win32/Startpage",
          "target": "/malware/Trojan:Win32/Startpage"
        },
        {
          "id": "Backdoor:Win32/Zegost",
          "display_name": "Backdoor:Win32/Zegost",
          "target": "/malware/Backdoor:Win32/Zegost"
        },
        {
          "id": "Trojan:Win32/Fanop",
          "display_name": "Trojan:Win32/Fanop",
          "target": "/malware/Trojan:Win32/Fanop"
        },
        {
          "id": "Trojan:Win32/Neconyd",
          "display_name": "Trojan:Win32/Neconyd",
          "target": "/malware/Trojan:Win32/Neconyd"
        },
        {
          "id": "Trojan:Win32/Zombie",
          "display_name": "Trojan:Win32/Zombie",
          "target": "/malware/Trojan:Win32/Zombie"
        },
        {
          "id": "Win.Trojan.Generic-9935365-0",
          "display_name": "Win.Trojan.Generic-9935365-0",
          "target": null
        },
        {
          "id": "Ninite",
          "display_name": "Ninite",
          "target": null
        },
        {
          "id": "NoobyProtect",
          "display_name": "NoobyProtect",
          "target": null
        },
        {
          "id": "TEL:Trojan:Win64/GoCLR",
          "display_name": "TEL:Trojan:Win64/GoCLR",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector.gen!BQ",
          "display_name": "VirTool:Win32/Injector.gen!BQ",
          "target": "/malware/VirTool:Win32/Injector.gen!BQ"
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4891,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2436,
        "CVE": 3,
        "FileHash-MD5": 2510,
        "FileHash-SHA1": 2063,
        "FileHash-SHA256": 4054,
        "hostname": 1788,
        "URL": 1228,
        "email": 16
      },
      "indicator_count": 14098,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 244,
      "modified_text": "585 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66c08b488620dac7697026c7",
      "name": "Fakefolder | Ransom:Win32/CVE affecting HCA Healthcare cloud",
      "description": "Cloud computing - User Acceptance Testing (UAT)\napparently used by HCA one of the nations leading healthcare providers. It's seems HCA's cloud is compromised. The cloud has a number of high priority vulnerabilities, malware, ransomware, zero day, etc.  Patient accounts aiming involved, (some patients received letters of serious PII, PHI compromise) lost records, patient blacklisting, hacking, and nefarious manipulations by providers. I've been made aware of CORHIO closing compromised patient accounts. Some patients account access and data has reportedly been lost.\n#VirTool:Win32/Obfuscator.ADB\nALF:HeraklezEval:Ransom:Win32/CVE\nRansom:Win32/StopCrypt.AK!MTB\nRansom:Win32/Wannaren.A\nTrojan:Win32/BlackMon\nTrojan:Win32/Fakefolder\nTulach Malware",
      "modified": "2024-10-15T14:02:54.772000",
      "created": "2024-08-17T11:36:40.810000",
      "tags": [
        "microsoft edge",
        "iocs",
        "alberta ndp",
        "security",
        "vc rescue",
        "disk",
        "apple",
        "google",
        "windows",
        "powershell",
        "security https",
        "no data",
        "tag count",
        "analyzer threat",
        "url summary",
        "ip summary",
        "summary",
        "sample",
        "detection list",
        "site",
        "cisco umbrella",
        "alexa top",
        "blacklist",
        "million",
        "mail spammer",
        "firehol",
        "ip address",
        "noname057",
        "anonymizer",
        "firehol proxy",
        "proxy",
        "india mail",
        "malware",
        "full name",
        "first",
        "v3 serial",
        "number",
        "cus odigicert",
        "global tls",
        "rsa4096 sha256",
        "ca1 validity",
        "subject public",
        "key info",
        "dns replication",
        "date",
        "script script",
        "as12912",
        "a domains",
        "a li",
        "poland unknown",
        "t mobile",
        "domains",
        "przejd",
        "passive dns",
        "authority",
        "meta",
        "accept",
        "cname",
        "record type",
        "ttl value",
        "aaaa",
        "poland",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "location poland",
        "asnone united",
        "moved",
        "location",
        "vary",
        "accept encoding",
        "content type",
        "virtool",
        "related pulses",
        "file samples",
        "files matching",
        "show",
        "search",
        "date hash",
        "next",
        "showing",
        "as39198",
        "body",
        "window",
        "certificate",
        "hostname",
        "unknown",
        "red bull",
        "script urls",
        "as2828 verizon",
        "ireland unknown",
        "gmt content",
        "as8068",
        "as8075",
        "servers",
        "creation date",
        "united",
        "trojan",
        "trojan features",
        "win32",
        "msr aug",
        "urls",
        "reverse dns",
        "trojandropper",
        "historical ssl",
        "referrer",
        "infiltrate",
        "threat network",
        "malicious",
        "snapchat",
        "eternal blue",
        "sneaky simay",
        "groups",
        "covert",
        "probe",
        "whois lookup",
        "domain name",
        "united",
        "as15169 google",
        "a nxdomain",
        "germany",
        "dynamicloader",
        "yara rule",
        "high",
        "medium",
        "port",
        "dynamic",
        "domain",
        "file name",
        "pcap",
        "copy",
        "url host",
        "port method",
        "user agent",
        "okrnserver",
        "002000",
        "hit tcpmemhit",
        "algorithm",
        "data",
        "cus oentrust",
        "entrust",
        "l1k validity",
        "cpl lwarszawa",
        "ot mobile",
        "status",
        "name servers",
        "as6354",
        "mtb aug",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "info",
        "location united",
        "win32 exe",
        "pe32 executable",
        "ms windows",
        "intel",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "vs2010",
        "info compiler",
        "products",
        "vs2008",
        "header intel",
        "name md5",
        "type",
        "language",
        "ascii text",
        "cyrillic",
        "registrar of",
        "domain names",
        "ii llc",
        "contacted",
        "file type",
        "mb file",
        "graph",
        "ip detections",
        "country",
        "type name",
        "network",
        "tsara brashears",
        "december",
        "typhon reborn",
        "speakez securus",
        "hacktool",
        "emotet",
        "formbook",
        "critical",
        "installer",
        "tofsee",
        "hiddentear",
        "cnc",
        "email collection",
        "apple data",
        "data collection",
        "tsara brashears",
        "for privacy",
        "record value",
        "emails",
        "expiration date",
        "swipper",
        "tulach",
        "aitm",
        "query",
        "observed dns",
        "activity dns",
        "total",
        "google llc",
        "pe32",
        "write",
        "april",
        "defender",
        "otx telemetry",
        "win32cve aug",
        "polska s",
        "copyright",
        "levelblue",
        "dashboard",
        "pulse submit",
        "url analysis",
        "as20940",
        "as16625 akamai",
        "entrustdns",
        "france",
        "entries",
        "refresh",
        "443 ma2592000",
        "net174",
        "net1740000",
        "mcics",
        "read c",
        "write c",
        "tlsv1",
        "default",
        "module load",
        "execution",
        "dock",
        "persistence",
        "xport",
        "redacted for",
        "privacy tech",
        "privacy admin",
        "organization",
        "postal code",
        "stateprovince",
        "server",
        "registrar abuse",
        "code",
        "high priority",
        "critical",
        "CVE-2023-29059"
      ],
      "references": [
        "uat.drw.hcahealthcare.cloud | developers.t-mobile.pl | kwvjuemg.exe",
        "uat.drw.hcahealthcare.cloud US Admin Email: cd2fa1f805494bc7s@ehc.com Admin Organization: HCA - Information Technology & Services, Inc.",
        "Antivirus Detections: Ransom:Win32/Wannaren.A UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX Alerts procmem_yara creates_largekey process_creation_suspicious_location network_bind deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window cape_extracted_content injection_rwx network_http",
        "Yara Detections: LZMA ,  UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser , UPXv20MarkusLaszloReiser , UPX",
        "Alerts: procmem_yara creates_largekey process_creation_suspicious_location network_bind cape_extracted_content",
        "Alerts: deletes_executed_files dead_connect dynamic_function_loading encrypted_ioc http_request injection_rwx network_http",
        "Alerts: network_cnc_https_generic powershell_download powershell_request enumerates_running_processes stealth_window",
        "nr-data.net [Apple Private Data Collection]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://twitter.com/PORNO_SEXYBABES | twitter.com | www.pornhub.com | www.anyxxxtube.net",
        "Apple path:https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 | itunes.apple.com",
        "record-viewer-application.hcahealthcare.cloud",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowled",
        "Tulach IP: 114.114.114.114",
        "Antivirus Detections: #VirTool:Win32/Obfuscator.ADB | IDS Detections:Observed DNS Query to .biz TLD | Domains Contacted: pywolwnvd.biz",
        "Yara Detections: SUSP_Unsigned_GoogleUpdate OriginalFilenameGoogleUpdate.exe | Alerts cape_extracted_content",
        "Parent: NET174 (NET-174-0-0-0-0) NetType: Direct Allocation Organization: Verizon Business (MCICS) 'Swipper'",
        "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059 | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29059\\",
        "cvename.cg | https://cve.mitre.org/cgi | https://cve.mitre.org/cgi-bin/cvename.cg... | https://cve.mitre.org/cgi-bin/cvename.cgi?nam...",
        "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | https://cve.mitre.org/css/main.css",
        "https://cve.mitre.org/images/cvelogobanner.png | https://cve.mitre.org/images/linkedin.jpg | https://cve.mitre.org/images/medium.png",
        "https://cve.mitre.org/images/nvd-logo.png | https://cve.mitre.org/images/search_icon.png | https://cve.mitre.org/images/twitter.jpg",
        "https://cve.mitre.org/images/youtube.png | https://cve.mitre.org/includes/browserheight.js | https://cve.mitre.org/includes/jquery-3.2.1.min.js",
        "https://cve.mitre.org/css/print.css | https://cve.mitre.org/favicon.ico | https://cve.mitre.org/images/GitHub_round_sm",
        "https://cve.mitre.org/includes/jquery-migrate-3.0.0.min.js | https://cve.mitre.org/includes/printerfriendly.js | cve.mitre.org"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/BlackMon",
          "display_name": "Trojan:Win32/BlackMon",
          "target": "/malware/Trojan:Win32/BlackMon"
        },
        {
          "id": "Trojan:Win32/Fakefolder",
          "display_name": "Trojan:Win32/Fakefolder",
          "target": "/malware/Trojan:Win32/Fakefolder"
        },
        {
          "id": "Ransom:Win32/Wannaren.A",
          "display_name": "Ransom:Win32/Wannaren.A",
          "target": "/malware/Ransom:Win32/Wannaren.A"
        },
        {
          "id": "Ransom:Win32/StopCrypt.AK!MTB",
          "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
          "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "display_name": "ALF:HeraklezEval:Ransom:Win32/CVE",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology",
        "Civilian Society",
        "Telecommunications",
        "Networking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 53,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1975,
        "FileHash-SHA1": 1731,
        "FileHash-SHA256": 4646,
        "URL": 636,
        "domain": 283,
        "hostname": 798,
        "email": 12,
        "CVE": 3,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 10086,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "593 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65e3d1a94659d50264a78fd4",
      "name": "Phishing | TabExplorer attacks compromised networks and devices",
      "description": "",
      "modified": "2024-04-02T01:01:20.068000",
      "created": "2024-03-03T01:26:01.043000",
      "tags": [
        "command decode",
        "suricata ipv4",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "suricata udpv4",
        "date",
        "united",
        "windows nt",
        "win64",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "url http",
        "url https",
        "scan endpoints",
        "all octoseek",
        "report spam",
        "hour ago",
        "whois record",
        "glasgow",
        "scan",
        "iocs",
        "next",
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "ipv4",
        "contacted",
        "execution",
        "pe resource",
        "communicating",
        "urls http",
        "referrer",
        "resolutions",
        "whois whois",
        "collections ip",
        "phishing",
        "attack",
        "loaded module",
        "remote procedure call",
        "search",
        "as15133 verizon",
        "passive dns",
        "urls",
        "creation date",
        "record value",
        "showing",
        "unknown",
        "as8075",
        "as15169 google",
        "as8068",
        "aaaa",
        "cname",
        "a domains",
        "meta",
        "entries",
        "gmt server",
        "ecacc saa83dd",
        "cobalt strike",
        "mozilla",
        "body",
        "brian sabey",
        "hallrender",
        "dynamicloader",
        "show",
        "alerts",
        "trojan",
        "copy",
        "dynamic",
        "medium",
        "reads",
        "write",
        "stealth network",
        "stealth_network",
        "script urls",
        "certificate",
        "rsa sha256",
        "exports data",
        "high",
        "yara rule",
        "yara detections",
        "njrat",
        "cape",
        "njrat malware",
        "sniffs",
        "guard",
        "write c",
        "delete c",
        "ms windows",
        "default",
        "intel",
        "openpgp public",
        "stream",
        "antivm_generic_disk",
        "antivm_generic_bios",
        "network_bind",
        "stealth_file spawns_dev_utility",
        "procmem_yara",
        "enumerates_physical_drives",
        "persistence_ads",
        "dynamic_function_loading",
        "reads_self",
        "suspicious_command_tools",
        "network",
        "rat"
      ],
      "references": [
        "http://www.tabxexplorer.com [phishing]",
        "http://www.tabxexplorer.com/lenovo",
        "GET /lenovo HTTP/1.1 Host: www.tabxexplorer.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 Edg/121.0.0.0",
        "identity_helper.exe",
        "cdn.easykeys.com",
        "hive21.ctcsoftware.com",
        "www.moxa.com",
        "msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com",
        "IDS Detections: Cobalt Strike Malleable C2 JQuery",
        "IDS Detections: Nullsoft Mozilla UA (NSISDL)",
        "IDS Detections: Observed Suspicious UA (NSISDL/1.2 (Mozilla))",
        "IDS Detections: SSL excessive fatal alerts (possible POODLE attack against server)",
        "IDS Detections: GENERIC Likely Malicious Fake IE Downloading .exe",
        "Tulach Malware: 114.114.114.114",
        "ns3.hallgrandsale.ru",
        "AgentTesla.KM: FileHash-MD5 e0801d62e8379b98177fd94a027e8b30",
        "AgentTesla.KM: FileHash-SHA1 0fa00a939ca8af08c90310b808d1d8fc70a518c3",
        "Yara Detection: Nullsoft_NSIS"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "ALF:Trojan:MSIL/AgentTesla.KM",
          "display_name": "ALF:Trojan:MSIL/AgentTesla.KM",
          "target": null
        },
        {
          "id": "ALF:Win32/GbdInf_305B1C9A.J!ibt",
          "display_name": "ALF:Win32/GbdInf_305B1C9A.J!ibt",
          "target": "/malware/ALF:Win32/GbdInf_305B1C9A.J!ibt"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HackTool:Win32/CobaltStrike.A",
          "display_name": "HackTool:Win32/CobaltStrike.A",
          "target": "/malware/HackTool:Win32/CobaltStrike.A"
        },
        {
          "id": "HackTool:Win32/Atosev.A",
          "display_name": "HackTool:Win32/Atosev.A",
          "target": "/malware/HackTool:Win32/Atosev.A"
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Win.Malware.Generickdz-9938530-0",
          "display_name": "Win.Malware.Generickdz-9938530-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Civil Society",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 55,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5551,
        "hostname": 1690,
        "domain": 929,
        "FileHash-SHA256": 2696,
        "FileHash-MD5": 405,
        "FileHash-SHA1": 315,
        "email": 4,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 11591,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "789 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cdn.jsdelivr.net/npm/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cdn.jsdelivr.net/npm/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780259082.47162
}