{
  "type": "URL",
  "indicator": "https://cdn.ssstatic.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cdn.ssstatic.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2907515353,
      "indicator": "https://cdn.ssstatic.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "689d5115ad786de4ff048e5b",
          "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker",
          "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access",
          "modified": "2025-09-13T02:00:42.729000",
          "created": "2025-08-14T02:59:33.036000",
          "tags": [
            "url https",
            "url http",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "present sep",
            "united",
            "present aug",
            "present jul",
            "present jun",
            "moved",
            "unknown ns",
            "present may",
            "present apr",
            "passive dns",
            "date",
            "encrypt",
            "body",
            "cookie",
            "gmt server",
            "content type",
            "dynamicloader",
            "medium",
            "x17x03x01",
            "download studio",
            "high",
            "read c",
            "show",
            "windows",
            "copy",
            "powershell",
            "write",
            "anomaly",
            "next",
            "unknown",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "yara detections",
            "delphi",
            "codeoverlap",
            "win32",
            "rgba",
            "memcommit",
            "delete",
            "png image",
            "hash",
            "dock",
            "execution",
            "malware",
            "wine emulator",
            "dynamic",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "capture",
            "persistence",
            "sha256",
            "submitted",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "script",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "null",
            "august",
            "span",
            "refresh",
            "meta",
            "mirai",
            "february",
            "april",
            "june",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "caribe",
            "rest",
            "accept",
            "friday",
            "look",
            "verify",
            "restart"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6211,
            "domain": 682,
            "hostname": 1661,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 1386,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 10162,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "218 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665ec0cfd110b0694c51fbe2",
          "name": "Eset - Dorkbot",
          "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
          "modified": "2024-07-04T06:01:28.799000",
          "created": "2024-06-04T07:22:55.572000",
          "tags": [
            "historical ssl",
            "referrer",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "csl computer",
            "gmbh dba",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "contact email",
            "code",
            "united",
            "unknown",
            "aaaa",
            "as14061",
            "cname",
            "search",
            "emails",
            "dnssec",
            "showing",
            "win32",
            "title error",
            "passive dns",
            "open ports",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "body",
            "dns replication",
            "domain",
            "lookups",
            "email",
            "name server",
            "slovensko",
            "tech contact",
            "valid",
            "admin contact",
            "a domains",
            "a li",
            "span h3",
            "header link",
            "option option",
            "united kingdom",
            "test",
            "april",
            "meta",
            "paris",
            "eset",
            "yara detections",
            "nod32",
            "amon",
            "internalname",
            "online payment",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "amz cf",
            "creation date",
            "record value",
            "expiration date",
            "name servers",
            "servers",
            "status",
            "next",
            "asnone united",
            "moved",
            "certificate",
            "ipv4",
            "urls",
            "files",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "cf2a",
            "xaax04x00",
            "high",
            "dns reply",
            "noip domain",
            "et trojan",
            "createsuspended",
            "malware traffic",
            "dorkbot",
            "malware",
            "copy",
            "name verdict",
            "falcon sandbox",
            "windows nt",
            "appdata",
            "png image",
            "pattern match",
            "indicator",
            "ascii text",
            "rgba",
            "get collect",
            "vj98",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "path",
            "ms windows",
            "pe32",
            "intel",
            "microsoft asf",
            "pe32 executable",
            "database",
            "english",
            "installer",
            "template",
            "tue jun",
            "service",
            "crlf line",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "tip"
          ],
          "references": [
            "bpp.eset.com",
            "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
            "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
            "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
            "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
            "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
            "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
            "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
            "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
            "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
            "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
            "appleremotesupport.com | http://thickapple.net/index.php",
            "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
            "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
            "https://appleid-verify.servecounterstrike.com/",
            "http://schoolgirl.uxxxporn.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:GenMalicious-KAG\\ [Trj]",
              "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
              "target": null
            },
            {
              "id": ",  Win.Trojan.Agent-1286703",
              "display_name": ",  Win.Trojan.Agent-1286703",
              "target": null
            },
            {
              "id": "Trojan:Win32/DorkBot.DU",
              "display_name": "Trojan:Win32/DorkBot.DU",
              "target": "/malware/Trojan:Win32/DorkBot.DU"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Trojan.Cosmu-1058",
              "display_name": "Win.Trojan.Cosmu-1058",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [
            "Finance",
            "Healthcare",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 758,
            "FileHash-SHA1": 478,
            "FileHash-SHA256": 2561,
            "URL": 8210,
            "domain": 2202,
            "hostname": 2760,
            "email": 22,
            "CVE": 3
          },
          "indicator_count": 16994,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "654 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "https://appleid-verify.servecounterstrike.com/",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "http://schoolgirl.uxxxporn.com",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "bpp.eset.com",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.trojan.cosmu-1058",
            "Trojan:win32/zombie.a",
            ",  win.trojan.agent-1286703",
            "Win32:malware-gen",
            "Trojan:win32/dorkbot.du",
            "Win32:genmalicious-kag\\ [trj]"
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Healthcare",
            "Finance"
          ],
          "unique_indicators": 27434
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ssstatic.com",
    "whois": "http://whois.domaintools.com/ssstatic.com",
    "domain": "ssstatic.com",
    "hostname": "cdn.ssstatic.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "689d5115ad786de4ff048e5b",
      "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker",
      "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access",
      "modified": "2025-09-13T02:00:42.729000",
      "created": "2025-08-14T02:59:33.036000",
      "tags": [
        "url https",
        "url http",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "present sep",
        "united",
        "present aug",
        "present jul",
        "present jun",
        "moved",
        "unknown ns",
        "present may",
        "present apr",
        "passive dns",
        "date",
        "encrypt",
        "body",
        "cookie",
        "gmt server",
        "content type",
        "dynamicloader",
        "medium",
        "x17x03x01",
        "download studio",
        "high",
        "read c",
        "show",
        "windows",
        "copy",
        "powershell",
        "write",
        "anomaly",
        "next",
        "unknown",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "yara detections",
        "delphi",
        "codeoverlap",
        "win32",
        "rgba",
        "memcommit",
        "delete",
        "png image",
        "hash",
        "dock",
        "execution",
        "malware",
        "wine emulator",
        "dynamic",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "capture",
        "persistence",
        "sha256",
        "submitted",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "script",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "null",
        "august",
        "span",
        "refresh",
        "meta",
        "mirai",
        "february",
        "april",
        "june",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "caribe",
        "rest",
        "accept",
        "friday",
        "look",
        "verify",
        "restart"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6211,
        "domain": 682,
        "hostname": 1661,
        "FileHash-MD5": 117,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 1386,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 10162,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "218 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665ec0cfd110b0694c51fbe2",
      "name": "Eset - Dorkbot",
      "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
      "modified": "2024-07-04T06:01:28.799000",
      "created": "2024-06-04T07:22:55.572000",
      "tags": [
        "historical ssl",
        "referrer",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "csl computer",
        "gmbh dba",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "contact email",
        "code",
        "united",
        "unknown",
        "aaaa",
        "as14061",
        "cname",
        "search",
        "emails",
        "dnssec",
        "showing",
        "win32",
        "title error",
        "passive dns",
        "open ports",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "body",
        "dns replication",
        "domain",
        "lookups",
        "email",
        "name server",
        "slovensko",
        "tech contact",
        "valid",
        "admin contact",
        "a domains",
        "a li",
        "span h3",
        "header link",
        "option option",
        "united kingdom",
        "test",
        "april",
        "meta",
        "paris",
        "eset",
        "yara detections",
        "nod32",
        "amon",
        "internalname",
        "online payment",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "amz cf",
        "creation date",
        "record value",
        "expiration date",
        "name servers",
        "servers",
        "status",
        "next",
        "asnone united",
        "moved",
        "certificate",
        "ipv4",
        "urls",
        "files",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "cf2a",
        "xaax04x00",
        "high",
        "dns reply",
        "noip domain",
        "et trojan",
        "createsuspended",
        "malware traffic",
        "dorkbot",
        "malware",
        "copy",
        "name verdict",
        "falcon sandbox",
        "windows nt",
        "appdata",
        "png image",
        "pattern match",
        "indicator",
        "ascii text",
        "rgba",
        "get collect",
        "vj98",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "path",
        "ms windows",
        "pe32",
        "intel",
        "microsoft asf",
        "pe32 executable",
        "database",
        "english",
        "installer",
        "template",
        "tue jun",
        "service",
        "crlf line",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "tip"
      ],
      "references": [
        "bpp.eset.com",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "https://appleid-verify.servecounterstrike.com/",
        "http://schoolgirl.uxxxporn.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:GenMalicious-KAG\\ [Trj]",
          "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
          "target": null
        },
        {
          "id": ",  Win.Trojan.Agent-1286703",
          "display_name": ",  Win.Trojan.Agent-1286703",
          "target": null
        },
        {
          "id": "Trojan:Win32/DorkBot.DU",
          "display_name": "Trojan:Win32/DorkBot.DU",
          "target": "/malware/Trojan:Win32/DorkBot.DU"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Trojan.Cosmu-1058",
          "display_name": "Win.Trojan.Cosmu-1058",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        }
      ],
      "industries": [
        "Finance",
        "Healthcare",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 758,
        "FileHash-SHA1": 478,
        "FileHash-SHA256": 2561,
        "URL": 8210,
        "domain": 2202,
        "hostname": 2760,
        "email": 22,
        "CVE": 3
      },
      "indicator_count": 16994,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "654 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cdn.ssstatic.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cdn.ssstatic.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638575.7867517
}