{
  "type": "URL",
  "indicator": "https://cebsec9.dn2.n-helix.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cebsec9.dn2.n-helix.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4177873939,
      "indicator": "https://cebsec9.dn2.n-helix.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69bdecb269c9d6fad107de1f",
          "name": "Google - BOT Beacon | Ransomware present | Active phishing campaigns",
          "description": "",
          "modified": "2026-04-19T00:22:55.777000",
          "created": "2026-03-21T00:56:18.458000",
          "tags": [
            "dynamicloader",
            "get na",
            "high",
            "request",
            "google",
            "write c",
            "explorer",
            "malware",
            "virus",
            "polyransom",
            "ransom",
            "phishing",
            "cnc",
            "virlock",
            "system impact",
            "encrypts user",
            "slows",
            "ransom",
            "4 detection",
            "removal modern",
            "kaspersky",
            "3 prevention",
            "tips",
            "modifies itself",
            "polymorphic ransomware",
            "encrypts files",
            "\"parasitic\" virus",
            "modifies existing files",
            "spreader",
            "google llc",
            "file Infection",
            "algorithm",
            "ouno sni",
            "key usage",
            "data",
            "v3 serial",
            "number",
            "public key",
            "info",
            "key algorithm",
            "subject key",
            "self-signed",
            "mitre att",
            "defense evasion",
            "ta0005",
            "software",
            "evasion",
            "artifacts v",
            "full reports",
            "v help",
            "dns resolutions",
            "traffic udp",
            "hashes",
            "trojan",
            "redirects",
            "ms windows",
            "pe32",
            "users",
            "medium",
            "yara rule",
            "cache",
            "search",
            "intel",
            "music",
            "write",
            "unknown",
            "virtool",
            "copy",
            "guard",
            "suspicious",
            "defender",
            "launch",
            "tracker",
            "media",
            "next"
          ],
          "references": [
            "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
            "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
            "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
            "Yara Detections: UPX",
            "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
            "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
            "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
            "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
            "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
            "142.250.147.101 \u2022 142.251.33.206 command_and_control",
            "http://142.251.33.206/ phishing",
            "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
            "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824",
            "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
            "System Impact: Slows down system performance.",
            "System Impact: Attempts to spread to network shares and cloud storage",
            "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
            "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
            "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
            "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Virus.PolyRansom-5704625-0",
              "display_name": "Win.Virus.PolyRansom-5704625-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1044",
              "name": "File System Permissions Weakness",
              "display_name": "T1044 - File System Permissions Weakness"
            },
            {
              "id": "T1222.001",
              "name": "Windows File and Directory Permissions Modification",
              "display_name": "T1222.001 - Windows File and Directory Permissions Modification"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 14,
            "URL": 431,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 478,
            "domain": 141,
            "hostname": 199,
            "email": 1,
            "CIDR": 1
          },
          "indicator_count": 1421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "17 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6964c08bf79bcb252eaa9e15",
          "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
          "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
          "modified": "2026-02-11T09:03:20.933000",
          "created": "2026-01-12T09:36:11.701000",
          "tags": [
            "google",
            "fastly",
            "googlecl",
            "january",
            "http",
            "domain",
            "akamaias",
            "cloudflar",
            "page url",
            "de summary",
            "april",
            "reverse dns",
            "url https",
            "general full",
            "software",
            "united",
            "resource hash",
            "protocol h3",
            "security quic",
            "protocol h2",
            "security tls",
            "main",
            "present jan",
            "title",
            "gmt max",
            "certificate",
            "moved",
            "lowfi",
            "gmt content",
            "meta",
            "present dec",
            "status",
            "aaaa",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "win32",
            "files",
            "verdict",
            "files ip",
            "address",
            "mtb jan",
            "trojandropper",
            "backdoor",
            "win32upatre jan",
            "origin trial",
            "gmt cache",
            "443 ma2592000",
            "possible",
            "worm",
            "trojan",
            "ip address",
            "record value",
            "dark",
            "found",
            "ipv4 add",
            "error",
            "trojanspy",
            "emails",
            "servers",
            "pegasus",
            "america flag",
            "america asn",
            "tlsv1",
            "read c",
            "show",
            "medium",
            "lstockholm",
            "ospotify ab",
            "odigicert inc",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "dynamicloader",
            "yara rule",
            "ms windows",
            "pe32",
            "named pipe",
            "smartassembly",
            "delphi",
            "malware",
            "united states",
            "pe file",
            "filehash",
            "md5 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "high",
            "write c",
            "tls sni",
            "tls handshake",
            "delete",
            "as15169",
            "stun binding",
            "request",
            "port",
            "win64",
            "themida",
            "guard",
            "risepro",
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "ck techniques",
            "evasion att",
            "t1480 execution",
            "directui",
            "element",
            "hwndhost",
            "classinfobase",
            "hwndelement",
            "value",
            "explorer",
            "insert",
            "movie",
            "hacktool",
            "showing",
            "entries http",
            "scans show",
            "california",
            "location united",
            "next associated",
            "pulse pulses",
            "name servers",
            "found request",
            "unique",
            "url add",
            "related nids",
            "files location",
            "expiration",
            "flag united",
            "present nov",
            "present sep",
            "href",
            "suricata stream",
            "command decode",
            "starfield",
            "encrypt",
            "iframe",
            "date",
            "title error",
            "hostname",
            "pulse submit",
            "memcommit",
            "checks",
            "windows",
            "capture",
            "cloudfront",
            "colorado",
            "creation date",
            "hostname add",
            "eset",
            "binary file",
            "pdb path",
            "internalname",
            "nod32",
            "amon"
          ],
          "references": [
            "open.spotify.com \u2022",
            "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
            "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
            "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
            "https://target.tccwest.www.littleswimmers.fr/",
            "www.onyx-ware.com \u2022 endgamesystems.com",
            "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Win.Packed.Stealerc-10017074-0",
              "display_name": "Win.Packed.Stealerc-10017074-0",
              "target": null
            },
            {
              "id": "#Lowfi:Win32/AutoIt",
              "display_name": "#Lowfi:Win32/AutoIt",
              "target": "/malware/#Lowfi:Win32/AutoIt"
            },
            {
              "id": "Win.Packed.Generic-9967832-0",
              "display_name": "Win.Packed.Generic-9967832-0",
              "target": null
            },
            {
              "id": "TrojanSpy:MSIL/Yakbeex.A",
              "display_name": "TrojanSpy:MSIL/Yakbeex.A",
              "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Win32:HacktoolX-gen\\ [Trj]",
              "display_name": "Win32:HacktoolX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "nUFS_unicode",
              "display_name": "nUFS_unicode",
              "target": null
            },
            {
              "id": "HackTool:Win32/CobaltStrike.A",
              "display_name": "HackTool:Win32/CobaltStrike.A",
              "target": "/malware/HackTool:Win32/CobaltStrike.A"
            },
            {
              "id": "Win.Dropper.PoisonIvy-9876745-0",
              "display_name": "Win.Dropper.PoisonIvy-9876745-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            }
          ],
          "industries": [
            "Entertainment",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1293,
            "URL": 3389,
            "FileHash-MD5": 635,
            "FileHash-SHA1": 531,
            "FileHash-SHA256": 2345,
            "domain": 501,
            "email": 12,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 8722,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "67 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Yara Detections: UPX",
        "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
        "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824",
        "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
        "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection.",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
        "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
        "System Impact: Slows down system performance.",
        "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
        "System Impact: Attempts to spread to network shares and cloud storage",
        "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
        "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
        "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
        "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
        "142.250.147.101 \u2022 142.251.33.206 command_and_control",
        "https://target.tccwest.www.littleswimmers.fr/",
        "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
        "open.spotify.com \u2022",
        "http://142.251.33.206/ phishing",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hacktool:win32/cobaltstrike.a",
            "Trojanspy:msil/yakbeex.a",
            "Win.dropper.poisonivy-9876745-0",
            "Other malware",
            "Trojan:win32/zombie.a",
            "Win.packed.generic-9967832-0",
            "Win32:hacktoolx-gen\\ [trj]",
            "Win.trojan.barys-10005825-0",
            "Pegasus",
            "Trojanspy",
            "Win.packed.stealerc-10017074-0",
            "Nufs_unicode",
            "Win.virus.polyransom-5704625-0",
            "#lowfi:win32/autoit"
          ],
          "industries": [
            "Entertainment",
            "Technology"
          ],
          "unique_indicators": 10259
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/n-helix.com",
    "whois": "http://whois.domaintools.com/n-helix.com",
    "domain": "n-helix.com",
    "hostname": "cebsec9.dn2.n-helix.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69bdecb269c9d6fad107de1f",
      "name": "Google - BOT Beacon | Ransomware present | Active phishing campaigns",
      "description": "",
      "modified": "2026-04-19T00:22:55.777000",
      "created": "2026-03-21T00:56:18.458000",
      "tags": [
        "dynamicloader",
        "get na",
        "high",
        "request",
        "google",
        "write c",
        "explorer",
        "malware",
        "virus",
        "polyransom",
        "ransom",
        "phishing",
        "cnc",
        "virlock",
        "system impact",
        "encrypts user",
        "slows",
        "ransom",
        "4 detection",
        "removal modern",
        "kaspersky",
        "3 prevention",
        "tips",
        "modifies itself",
        "polymorphic ransomware",
        "encrypts files",
        "\"parasitic\" virus",
        "modifies existing files",
        "spreader",
        "google llc",
        "file Infection",
        "algorithm",
        "ouno sni",
        "key usage",
        "data",
        "v3 serial",
        "number",
        "public key",
        "info",
        "key algorithm",
        "subject key",
        "self-signed",
        "mitre att",
        "defense evasion",
        "ta0005",
        "software",
        "evasion",
        "artifacts v",
        "full reports",
        "v help",
        "dns resolutions",
        "traffic udp",
        "hashes",
        "trojan",
        "redirects",
        "ms windows",
        "pe32",
        "users",
        "medium",
        "yara rule",
        "cache",
        "search",
        "intel",
        "music",
        "write",
        "unknown",
        "virtool",
        "copy",
        "guard",
        "suspicious",
        "defender",
        "launch",
        "tracker",
        "media",
        "next"
      ],
      "references": [
        "External Hosts: COUNTRY ASN 142.251.33.206\tgoogle.com |google.comUnited StatesAS15169 google llc",
        "IDS Detections: SUSPICIOUS Possible automated connectivity check (www.google.com)",
        "IDS Detections: Terse Unencrypted Request for Google - Likely Connectivity Check",
        "Yara Detections: UPX",
        "Alerts: antisandbox_sleep hardware_id_profiling physical_drive_access suspicious_iocontrol_codes",
        "Alerts: process_creation_suspicious_location infostealer_browser apc_injection persistence_autorun",
        "Alerts: persistence_autorun_tasks binary_yara procmem_yara suricata_alert antivm_bochs_keys",
        "Alerts: antivm_generic_disk deletes_executed_files disables_uac folder_enumeration",
        "Alerts: stealth_hidden_extension stealth_hiddenreg suspicious_command",
        "142.250.147.101 \u2022 142.251.33.206 command_and_control",
        "http://142.251.33.206/ phishing",
        "http://www.forensickb.com/2013/03/file-entropy-explained.html  phishing",
        "invalid2.invalid   4259517cd4e48a289d332ab3f0ab52a366322824",
        "System Impact: Once active, it typically: Encrypts user data and locks the screen.",
        "System Impact: Slows down system performance.",
        "System Impact: Attempts to spread to network shares and cloud storage",
        "Ransom Demands: Like other ransomware, it demands payment (often in cryptocurrency) to restore access to files or the system.",
        "Matches rule MALWARE-CNC Win.Trojan.Ramnit variant outbound detected",
        "Matches rule MALWARE-CNC Win.Malware.Ramnit outbound REGISTER_BOT beacon",
        "Matches rule ET MALWARE Win32/Ramnit Checkin Unique rule identifier: This rule belongs to a private collection."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Virus.PolyRansom-5704625-0",
          "display_name": "Win.Virus.PolyRansom-5704625-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1044",
          "name": "File System Permissions Weakness",
          "display_name": "T1044 - File System Permissions Weakness"
        },
        {
          "id": "T1222.001",
          "name": "Windows File and Directory Permissions Modification",
          "display_name": "T1222.001 - Windows File and Directory Permissions Modification"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 14,
        "URL": 431,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 478,
        "domain": 141,
        "hostname": 199,
        "email": 1,
        "CIDR": 1
      },
      "indicator_count": 1421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "17 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6964c08bf79bcb252eaa9e15",
      "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
      "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
      "modified": "2026-02-11T09:03:20.933000",
      "created": "2026-01-12T09:36:11.701000",
      "tags": [
        "google",
        "fastly",
        "googlecl",
        "january",
        "http",
        "domain",
        "akamaias",
        "cloudflar",
        "page url",
        "de summary",
        "april",
        "reverse dns",
        "url https",
        "general full",
        "software",
        "united",
        "resource hash",
        "protocol h3",
        "security quic",
        "protocol h2",
        "security tls",
        "main",
        "present jan",
        "title",
        "gmt max",
        "certificate",
        "moved",
        "lowfi",
        "gmt content",
        "meta",
        "present dec",
        "status",
        "aaaa",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "win32",
        "files",
        "verdict",
        "files ip",
        "address",
        "mtb jan",
        "trojandropper",
        "backdoor",
        "win32upatre jan",
        "origin trial",
        "gmt cache",
        "443 ma2592000",
        "possible",
        "worm",
        "trojan",
        "ip address",
        "record value",
        "dark",
        "found",
        "ipv4 add",
        "error",
        "trojanspy",
        "emails",
        "servers",
        "pegasus",
        "america flag",
        "america asn",
        "tlsv1",
        "read c",
        "show",
        "medium",
        "lstockholm",
        "ospotify ab",
        "odigicert inc",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "dynamicloader",
        "yara rule",
        "ms windows",
        "pe32",
        "named pipe",
        "smartassembly",
        "delphi",
        "malware",
        "united states",
        "pe file",
        "filehash",
        "md5 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "high",
        "write c",
        "tls sni",
        "tls handshake",
        "delete",
        "as15169",
        "stun binding",
        "request",
        "port",
        "win64",
        "themida",
        "guard",
        "risepro",
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "ck techniques",
        "evasion att",
        "t1480 execution",
        "directui",
        "element",
        "hwndhost",
        "classinfobase",
        "hwndelement",
        "value",
        "explorer",
        "insert",
        "movie",
        "hacktool",
        "showing",
        "entries http",
        "scans show",
        "california",
        "location united",
        "next associated",
        "pulse pulses",
        "name servers",
        "found request",
        "unique",
        "url add",
        "related nids",
        "files location",
        "expiration",
        "flag united",
        "present nov",
        "present sep",
        "href",
        "suricata stream",
        "command decode",
        "starfield",
        "encrypt",
        "iframe",
        "date",
        "title error",
        "hostname",
        "pulse submit",
        "memcommit",
        "checks",
        "windows",
        "capture",
        "cloudfront",
        "colorado",
        "creation date",
        "hostname add",
        "eset",
        "binary file",
        "pdb path",
        "internalname",
        "nod32",
        "amon"
      ],
      "references": [
        "open.spotify.com \u2022",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://target.tccwest.www.littleswimmers.fr/",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Win.Packed.Stealerc-10017074-0",
          "display_name": "Win.Packed.Stealerc-10017074-0",
          "target": null
        },
        {
          "id": "#Lowfi:Win32/AutoIt",
          "display_name": "#Lowfi:Win32/AutoIt",
          "target": "/malware/#Lowfi:Win32/AutoIt"
        },
        {
          "id": "Win.Packed.Generic-9967832-0",
          "display_name": "Win.Packed.Generic-9967832-0",
          "target": null
        },
        {
          "id": "TrojanSpy:MSIL/Yakbeex.A",
          "display_name": "TrojanSpy:MSIL/Yakbeex.A",
          "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Win32:HacktoolX-gen\\ [Trj]",
          "display_name": "Win32:HacktoolX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "nUFS_unicode",
          "display_name": "nUFS_unicode",
          "target": null
        },
        {
          "id": "HackTool:Win32/CobaltStrike.A",
          "display_name": "HackTool:Win32/CobaltStrike.A",
          "target": "/malware/HackTool:Win32/CobaltStrike.A"
        },
        {
          "id": "Win.Dropper.PoisonIvy-9876745-0",
          "display_name": "Win.Dropper.PoisonIvy-9876745-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        }
      ],
      "industries": [
        "Entertainment",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1293,
        "URL": 3389,
        "FileHash-MD5": 635,
        "FileHash-SHA1": 531,
        "FileHash-SHA256": 2345,
        "domain": 501,
        "email": 12,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 8722,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "67 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cebsec9.dn2.n-helix.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cebsec9.dn2.n-helix.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622640.6990275
}