{ "type": "URL", "indicator": "https://client-data.knak.io/pr=", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://client-data.knak.io/pr=", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4311811634, "indicator": "https://client-data.knak.io/pr=", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69df607b31f6ed471c32d4e3", "name": "CAPE Sandbox- Very Evasive and Aggressive 'bot?'.......", "description": "A full report on the Microsoft Office malware, published on 3 February 2026, has been published online by the University of California, Los Angeles, and the National Security Agency (NSA) in New York.> This is malicious.", "modified": "2026-05-15T09:06:22.083000", "created": "2026-04-15T09:55:07.649000", "tags": [ "settings", "first counter", "default", "toolspanose", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "mbisslshort", "accept", "bridge", "info", "date", "light", "agent", "shutdown", "root", "performs dns", "extra info", "attack network", "info dropped", "info processes", "zenbox verdict", "guest system", "ultimate file", "info file", "ascii text", "malicious", "next", "mitre attack", "network info", "processes extra", "overview", "overview zenbox", "verdict", "unknown" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246714&Signature=jA8ZNQzdLZfCMA%2BeZdzBjB3xA0B7xKtgmBMmVGhpCsbkEU53LPuuNVLyugFpe7diOUDoR55j7HbDl9qcOHkMPamkpv3i44NiD46yJbU4LSQkaP1qPkrF0YTWKn4PkEnuUYIAEr6z6J76c33VYseiQzUFAb%2F2EmiSrP2P0B%2BTV3lvRclFr%2FAxEVTCCZcmWffeMujO3jhC9czl3rYy9DQH1v23x4tcX0%2BcVcRjvTPUjfACcx8trhtm", "https://vtbehaviour.commondatastorage.googleapis.com/7ee979e976acf8f47699717010a1a0259a991b62d6690571d8b68dd16b294b2b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246777&Signature=yNFSBGy%2Bm8tg5Sl9XzqsISl5kfgoB4%2Fnf%2FJn6WTRwmAZFUp51dt85ONZCzDMwEPqIoiUXlYybE4s09saW5RxfASOPh2spHs6dyCMsXnDPX%2Bk97XShYdomVvaBJsmRZDzDF1inptzQCRTtdDSe9IeE0ZE0Sr7AlXrkR1sVf151d4nyK3gdcwxaojAALetWrh%2Fx%2BjcpJYEo7D5hlba1zTfWJ57CQVjWvixx1vFyzw%2B8s59JIuuvTK25JI2", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246967&Signature=Ir5y9DGvGgNLFUDY8U6XR53N35ujwlwfUYKT1GK9MfB1XTAtJk8qVigh7fO1EPVnJQP%2BkVNsUCkx1JjW9L03u0PfThYXwIBYbjulP7glaB%2BqBIqGVjsKq%2BlOwN0MLlSG408dZWbdUekl6p8wKR8L4Y1wXpN5UU%2F6gKv2dm9WFA9aHsBZd3K33gYAJ0cjsJEz%2BY4WITcbYvW0eJDyk7JGmMa1c4VaL6Wqud26xKwdeyOExz3D472vYkEAROfQ", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246921&Signature=X1jzLW3418s%2FQ18Krko%2B307kskS6d2hv1BEZN918A03%2BgNR7LtEHC48e5%2F3mRCz0n3H1wrLvbc3pB9GFSEcPI1iYWIN2YZa8TRUv8pk%2BTsrfc0GlUPG1JwElP67v80tNQVAvFXYkI00vaXUyTEIAWltRkZnJCH1iOD%2BnGOcmzDsQ28fJBY6ZXAoee8pz1CL%2B95j7wn8%2FdET4YQdhduJj0x3M%2BM5oon%2FgzuHLI70rvQ" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 254, "FileHash-SHA1": 43, "FileHash-SHA256": 49, "URL": 84, "hostname": 119, "email": 1, "domain": 12 }, "indicator_count": 562, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69df607ced5dad90593b17cb", "name": "CAPE Sandbox- Very Evasive and Aggressive 'bot?'.......", "description": "A full report on the Microsoft Office malware, published on 3 February 2026, has been published online by the University of California, Los Angeles, and the National Security Agency (NSA) in New York.> This is malicious.", "modified": "2026-05-15T09:06:22.083000", "created": "2026-04-15T09:55:08.935000", "tags": [ "settings", "first counter", "default", "toolspanose", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "mbisslshort", "accept", "bridge", "info", "date", "light", "agent", "shutdown", "root", "performs dns", "extra info", "attack network", "info dropped", "info processes", "zenbox verdict", "guest system", "ultimate file", "info file", "ascii text", "malicious", "next", "mitre attack", "network info", "processes extra", "overview", "overview zenbox", "verdict", "unknown" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246714&Signature=jA8ZNQzdLZfCMA%2BeZdzBjB3xA0B7xKtgmBMmVGhpCsbkEU53LPuuNVLyugFpe7diOUDoR55j7HbDl9qcOHkMPamkpv3i44NiD46yJbU4LSQkaP1qPkrF0YTWKn4PkEnuUYIAEr6z6J76c33VYseiQzUFAb%2F2EmiSrP2P0B%2BTV3lvRclFr%2FAxEVTCCZcmWffeMujO3jhC9czl3rYy9DQH1v23x4tcX0%2BcVcRjvTPUjfACcx8trhtm", "https://vtbehaviour.commondatastorage.googleapis.com/7ee979e976acf8f47699717010a1a0259a991b62d6690571d8b68dd16b294b2b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246777&Signature=yNFSBGy%2Bm8tg5Sl9XzqsISl5kfgoB4%2Fnf%2FJn6WTRwmAZFUp51dt85ONZCzDMwEPqIoiUXlYybE4s09saW5RxfASOPh2spHs6dyCMsXnDPX%2Bk97XShYdomVvaBJsmRZDzDF1inptzQCRTtdDSe9IeE0ZE0Sr7AlXrkR1sVf151d4nyK3gdcwxaojAALetWrh%2Fx%2BjcpJYEo7D5hlba1zTfWJ57CQVjWvixx1vFyzw%2B8s59JIuuvTK25JI2", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246967&Signature=Ir5y9DGvGgNLFUDY8U6XR53N35ujwlwfUYKT1GK9MfB1XTAtJk8qVigh7fO1EPVnJQP%2BkVNsUCkx1JjW9L03u0PfThYXwIBYbjulP7glaB%2BqBIqGVjsKq%2BlOwN0MLlSG408dZWbdUekl6p8wKR8L4Y1wXpN5UU%2F6gKv2dm9WFA9aHsBZd3K33gYAJ0cjsJEz%2BY4WITcbYvW0eJDyk7JGmMa1c4VaL6Wqud26xKwdeyOExz3D472vYkEAROfQ", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246921&Signature=X1jzLW3418s%2FQ18Krko%2B307kskS6d2hv1BEZN918A03%2BgNR7LtEHC48e5%2F3mRCz0n3H1wrLvbc3pB9GFSEcPI1iYWIN2YZa8TRUv8pk%2BTsrfc0GlUPG1JwElP67v80tNQVAvFXYkI00vaXUyTEIAWltRkZnJCH1iOD%2BnGOcmzDsQ28fJBY6ZXAoee8pz1CL%2B95j7wn8%2FdET4YQdhduJj0x3M%2BM5oon%2FgzuHLI70rvQ" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 254, "FileHash-SHA1": 43, "FileHash-SHA256": 49, "URL": 84, "hostname": 119, "email": 1, "domain": 11 }, "indicator_count": 561, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246714&Signature=jA8ZNQzdLZfCMA%2BeZdzBjB3xA0B7xKtgmBMmVGhpCsbkEU53LPuuNVLyugFpe7diOUDoR55j7HbDl9qcOHkMPamkpv3i44NiD46yJbU4LSQkaP1qPkrF0YTWKn4PkEnuUYIAEr6z6J76c33VYseiQzUFAb%2F2EmiSrP2P0B%2BTV3lvRclFr%2FAxEVTCCZcmWffeMujO3jhC9czl3rYy9DQH1v23x4tcX0%2BcVcRjvTPUjfACcx8trhtm", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246921&Signature=X1jzLW3418s%2FQ18Krko%2B307kskS6d2hv1BEZN918A03%2BgNR7LtEHC48e5%2F3mRCz0n3H1wrLvbc3pB9GFSEcPI1iYWIN2YZa8TRUv8pk%2BTsrfc0GlUPG1JwElP67v80tNQVAvFXYkI00vaXUyTEIAWltRkZnJCH1iOD%2BnGOcmzDsQ28fJBY6ZXAoee8pz1CL%2B95j7wn8%2FdET4YQdhduJj0x3M%2BM5oon%2FgzuHLI70rvQ", "https://vtbehaviour.commondatastorage.googleapis.com/7ee979e976acf8f47699717010a1a0259a991b62d6690571d8b68dd16b294b2b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246777&Signature=yNFSBGy%2Bm8tg5Sl9XzqsISl5kfgoB4%2Fnf%2FJn6WTRwmAZFUp51dt85ONZCzDMwEPqIoiUXlYybE4s09saW5RxfASOPh2spHs6dyCMsXnDPX%2Bk97XShYdomVvaBJsmRZDzDF1inptzQCRTtdDSe9IeE0ZE0Sr7AlXrkR1sVf151d4nyK3gdcwxaojAALetWrh%2Fx%2BjcpJYEo7D5hlba1zTfWJ57CQVjWvixx1vFyzw%2B8s59JIuuvTK25JI2", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246967&Signature=Ir5y9DGvGgNLFUDY8U6XR53N35ujwlwfUYKT1GK9MfB1XTAtJk8qVigh7fO1EPVnJQP%2BkVNsUCkx1JjW9L03u0PfThYXwIBYbjulP7glaB%2BqBIqGVjsKq%2BlOwN0MLlSG408dZWbdUekl6p8wKR8L4Y1wXpN5UU%2F6gKv2dm9WFA9aHsBZd3K33gYAJ0cjsJEz%2BY4WITcbYvW0eJDyk7JGmMa1c4VaL6Wqud26xKwdeyOExz3D472vYkEAROfQ" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 636 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/knak.io", "whois": "http://whois.domaintools.com/knak.io", "domain": "knak.io", "hostname": "client-data.knak.io" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "69df607b31f6ed471c32d4e3", "name": "CAPE Sandbox- Very Evasive and Aggressive 'bot?'.......", "description": "A full report on the Microsoft Office malware, published on 3 February 2026, has been published online by the University of California, Los Angeles, and the National Security Agency (NSA) in New York.> This is malicious.", "modified": "2026-05-15T09:06:22.083000", "created": "2026-04-15T09:55:07.649000", "tags": [ "settings", "first counter", "default", "toolspanose", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "mbisslshort", "accept", "bridge", "info", "date", "light", "agent", "shutdown", "root", "performs dns", "extra info", "attack network", "info dropped", "info processes", "zenbox verdict", "guest system", "ultimate file", "info file", "ascii text", "malicious", "next", "mitre attack", "network info", "processes extra", "overview", "overview zenbox", "verdict", "unknown" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246714&Signature=jA8ZNQzdLZfCMA%2BeZdzBjB3xA0B7xKtgmBMmVGhpCsbkEU53LPuuNVLyugFpe7diOUDoR55j7HbDl9qcOHkMPamkpv3i44NiD46yJbU4LSQkaP1qPkrF0YTWKn4PkEnuUYIAEr6z6J76c33VYseiQzUFAb%2F2EmiSrP2P0B%2BTV3lvRclFr%2FAxEVTCCZcmWffeMujO3jhC9czl3rYy9DQH1v23x4tcX0%2BcVcRjvTPUjfACcx8trhtm", "https://vtbehaviour.commondatastorage.googleapis.com/7ee979e976acf8f47699717010a1a0259a991b62d6690571d8b68dd16b294b2b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246777&Signature=yNFSBGy%2Bm8tg5Sl9XzqsISl5kfgoB4%2Fnf%2FJn6WTRwmAZFUp51dt85ONZCzDMwEPqIoiUXlYybE4s09saW5RxfASOPh2spHs6dyCMsXnDPX%2Bk97XShYdomVvaBJsmRZDzDF1inptzQCRTtdDSe9IeE0ZE0Sr7AlXrkR1sVf151d4nyK3gdcwxaojAALetWrh%2Fx%2BjcpJYEo7D5hlba1zTfWJ57CQVjWvixx1vFyzw%2B8s59JIuuvTK25JI2", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246967&Signature=Ir5y9DGvGgNLFUDY8U6XR53N35ujwlwfUYKT1GK9MfB1XTAtJk8qVigh7fO1EPVnJQP%2BkVNsUCkx1JjW9L03u0PfThYXwIBYbjulP7glaB%2BqBIqGVjsKq%2BlOwN0MLlSG408dZWbdUekl6p8wKR8L4Y1wXpN5UU%2F6gKv2dm9WFA9aHsBZd3K33gYAJ0cjsJEz%2BY4WITcbYvW0eJDyk7JGmMa1c4VaL6Wqud26xKwdeyOExz3D472vYkEAROfQ", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246921&Signature=X1jzLW3418s%2FQ18Krko%2B307kskS6d2hv1BEZN918A03%2BgNR7LtEHC48e5%2F3mRCz0n3H1wrLvbc3pB9GFSEcPI1iYWIN2YZa8TRUv8pk%2BTsrfc0GlUPG1JwElP67v80tNQVAvFXYkI00vaXUyTEIAWltRkZnJCH1iOD%2BnGOcmzDsQ28fJBY6ZXAoee8pz1CL%2B95j7wn8%2FdET4YQdhduJj0x3M%2BM5oon%2FgzuHLI70rvQ" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 254, "FileHash-SHA1": 43, "FileHash-SHA256": 49, "URL": 84, "hostname": 119, "email": 1, "domain": 12 }, "indicator_count": 562, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69df607ced5dad90593b17cb", "name": "CAPE Sandbox- Very Evasive and Aggressive 'bot?'.......", "description": "A full report on the Microsoft Office malware, published on 3 February 2026, has been published online by the University of California, Los Angeles, and the National Security Agency (NSA) in New York.> This is malicious.", "modified": "2026-05-15T09:06:22.083000", "created": "2026-04-15T09:55:08.935000", "tags": [ "settings", "first counter", "default", "toolspanose", "mwdb", "bazaar", "sha3384", "ssdeep", "file size", "mbisslshort", "accept", "bridge", "info", "date", "light", "agent", "shutdown", "root", "performs dns", "extra info", "attack network", "info dropped", "info processes", "zenbox verdict", "guest system", "ultimate file", "info file", "ascii text", "malicious", "next", "mitre attack", "network info", "processes extra", "overview", "overview zenbox", "verdict", "unknown" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246714&Signature=jA8ZNQzdLZfCMA%2BeZdzBjB3xA0B7xKtgmBMmVGhpCsbkEU53LPuuNVLyugFpe7diOUDoR55j7HbDl9qcOHkMPamkpv3i44NiD46yJbU4LSQkaP1qPkrF0YTWKn4PkEnuUYIAEr6z6J76c33VYseiQzUFAb%2F2EmiSrP2P0B%2BTV3lvRclFr%2FAxEVTCCZcmWffeMujO3jhC9czl3rYy9DQH1v23x4tcX0%2BcVcRjvTPUjfACcx8trhtm", "https://vtbehaviour.commondatastorage.googleapis.com/7ee979e976acf8f47699717010a1a0259a991b62d6690571d8b68dd16b294b2b_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246777&Signature=yNFSBGy%2Bm8tg5Sl9XzqsISl5kfgoB4%2Fnf%2FJn6WTRwmAZFUp51dt85ONZCzDMwEPqIoiUXlYybE4s09saW5RxfASOPh2spHs6dyCMsXnDPX%2Bk97XShYdomVvaBJsmRZDzDF1inptzQCRTtdDSe9IeE0ZE0Sr7AlXrkR1sVf151d4nyK3gdcwxaojAALetWrh%2Fx%2BjcpJYEo7D5hlba1zTfWJ57CQVjWvixx1vFyzw%2B8s59JIuuvTK25JI2", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246967&Signature=Ir5y9DGvGgNLFUDY8U6XR53N35ujwlwfUYKT1GK9MfB1XTAtJk8qVigh7fO1EPVnJQP%2BkVNsUCkx1JjW9L03u0PfThYXwIBYbjulP7glaB%2BqBIqGVjsKq%2BlOwN0MLlSG408dZWbdUekl6p8wKR8L4Y1wXpN5UU%2F6gKv2dm9WFA9aHsBZd3K33gYAJ0cjsJEz%2BY4WITcbYvW0eJDyk7JGmMa1c4VaL6Wqud26xKwdeyOExz3D472vYkEAROfQ", "https://vtbehaviour.commondatastorage.googleapis.com/930fd5e980c675c0eeb55d1c3c4b462dae4e9add472228ef9d9d3941d8603c48_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776246921&Signature=X1jzLW3418s%2FQ18Krko%2B307kskS6d2hv1BEZN918A03%2BgNR7LtEHC48e5%2F3mRCz0n3H1wrLvbc3pB9GFSEcPI1iYWIN2YZa8TRUv8pk%2BTsrfc0GlUPG1JwElP67v80tNQVAvFXYkI00vaXUyTEIAWltRkZnJCH1iOD%2BnGOcmzDsQ28fJBY6ZXAoee8pz1CL%2B95j7wn8%2FdET4YQdhduJj0x3M%2BM5oon%2FgzuHLI70rvQ" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 254, "FileHash-SHA1": 43, "FileHash-SHA256": 49, "URL": 84, "hostname": 119, "email": 1, "domain": 11 }, "indicator_count": 561, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://client-data.knak.io/pr=", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://client-data.knak.io/pr=", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780345588.6899116 }