{
  "type": "URL",
  "indicator": "https://code.alvaro.mowplayer.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://code.alvaro.mowplayer.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098308000,
      "indicator": "https://code.alvaro.mowplayer.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69ded8198b25581a09b90824",
          "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
          "description": "",
          "modified": "2026-04-15T00:13:13.981000",
          "created": "2026-04-15T00:13:13.981000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "4 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69db05f833d3d6d2231fb201",
          "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
          "description": "",
          "modified": "2026-04-12T02:39:52.993000",
          "created": "2026-04-12T02:39:52.993000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dab27a0493e0e80a0f35cd",
          "name": "SearchSuite \u2022 Healthcare Administration",
          "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
          "modified": "2026-04-11T20:43:38.695000",
          "created": "2026-04-11T20:43:38.695000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68abf66e97031d0ff0c04fed",
          "name": "Packed sentient.industries links to a targets business website",
          "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
          "modified": "2025-09-24T04:04:05.604000",
          "created": "2025-08-25T05:36:46.327000",
          "tags": [
            "moved",
            "body",
            "x cache",
            "cloudfront x",
            "cph50 c2",
            "certificate",
            "record value",
            "title",
            "h1 center",
            "server",
            "redacted for",
            "servers",
            "name redacted",
            "for privacy",
            "name servers",
            "org data",
            "privacy city",
            "privacy country",
            "ca creation",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "asn as57033",
            "less whois",
            "registrar",
            "tucows domains",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl ecc",
            "domain secure",
            "site ca",
            "validity",
            "subject public",
            "extraction",
            "data upload",
            "extra data",
            "include review",
            "find",
            "failed",
            "typ no",
            "ms windows",
            "intel",
            "pe32",
            "united",
            "search",
            "as16509",
            "from win32bios",
            "show",
            "high",
            "medium",
            "delphi",
            "copy",
            "write",
            "launcher",
            "next",
            "present aug",
            "present jul",
            "lowfi",
            "win32",
            "a div",
            "div div",
            "learn xml",
            "babylon",
            "win64",
            "trojan",
            "colors",
            "python",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "et info",
            "tls handshake",
            "bad traffic",
            "failure",
            "date",
            "august",
            "hybrid",
            "general",
            "path",
            "starfield",
            "click",
            "strings",
            "se bethseda",
            "n bethseda",
            "n data",
            "error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results aug",
            "read c",
            "tlsv1",
            "port",
            "destination",
            "module load",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "cname",
            "aaaa",
            "creation date",
            "showing",
            "domain",
            "dga domains",
            "palantirfoundry",
            "foundry",
            "status",
            "unknown ns",
            "g2 tls",
            "rsa sha256",
            "italy unknown",
            "mtb may",
            "trojandropper",
            "invalid url",
            "next associated",
            "ddos",
            "body html",
            "hacktool",
            "ipv4",
            "url analysis",
            "ukraine",
            "encrypt",
            "rl add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present jun",
            "entries",
            "title error",
            "all ipv4",
            "reverse dns",
            "yara detections",
            "top source",
            "top destination",
            "source source",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "canada unknown",
            "content type",
            "javascript src",
            "script script",
            "x powered",
            "ipv4 add",
            "pulse submit",
            "submit url",
            "analysis",
            "url add",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "unknown aaaa",
            "ascii text",
            "user agent",
            "powershell",
            "agent",
            "czechia unknown",
            "domain add",
            "dynamicloader",
            "hostname add",
            "pentagon",
            "defense"
          ],
          "references": [
            "sentient.industries affects independent artists. Affects several others.",
            "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
            "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
            "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
            "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
            "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
            "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
            "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
            "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
            "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
            "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
            "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
            "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
            "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
            "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
            "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
            "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
            "https://link.monetizer101.com/widget/code/dailystaruk.js",
            "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
            "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
            "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
            "(Can't access file- Malware infection files)",
            "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
            "constellation.pcfrpegaservice.net (Pegasus related? idk)",
            "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
            "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
            "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
            "Remotewd.com devices",
            "If you find anything interesting please research it."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "nUFS_inno",
              "display_name": "nUFS_inno",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious",
              "target": null
            },
            {
              "id": "ALF:JASYP:PUA:Win32/Bibado",
              "display_name": "ALF:JASYP:PUA:Win32/Bibado",
              "target": null
            },
            {
              "id": "Trojan:Win32/Toga",
              "display_name": "Trojan:Win32/Toga",
              "target": "/malware/Trojan:Win32/Toga"
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Custom Malware",
              "display_name": "Custom Malware",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "Win32:Downloader-GJK\\ [Trj]",
              "display_name": "Win32:Downloader-GJK\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.109205-1",
              "display_name": "Win.Downloader.109205-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-149",
              "display_name": "Win.Trojan.Jorik-149",
              "target": null
            },
            {
              "id": "#LowFiDetectsVmWare",
              "display_name": "#LowFiDetectsVmWare",
              "target": null
            },
            {
              "id": "Win.Trojan.Jorik-130",
              "display_name": "Win.Trojan.Jorik-130",
              "target": null
            },
            {
              "id": "Win.Trojan.Fakecodecs-119",
              "display_name": "Win.Trojan.Fakecodecs-119",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Bulz-9860169-0",
              "display_name": "Win.Trojan.Bulz-9860169-0",
              "target": null
            },
            {
              "id": "Win.Malware.Midie-6847892-0",
              "display_name": "Win.Malware.Midie-6847892-0",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop.V!MTB",
              "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
              "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Win.Packed.Razy-9785185-0",
              "display_name": "Win.Packed.Razy-9785185-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "PWS",
              "display_name": "PWS",
              "target": null
            },
            {
              "id": "DDOS:Win32/Stormser.A",
              "display_name": "DDOS:Win32/Stormser.A",
              "target": "/malware/DDOS:Win32/Stormser.A"
            },
            {
              "id": "ALF:HSTR:DotNET",
              "display_name": "ALF:HSTR:DotNET",
              "target": null
            },
            {
              "id": "DotNET",
              "display_name": "DotNET",
              "target": null
            },
            {
              "id": "Script Exploit",
              "display_name": "Script Exploit",
              "target": null
            },
            {
              "id": "HackTool:Win32/AutoKMS",
              "display_name": "HackTool:Win32/AutoKMS",
              "target": "/malware/HackTool:Win32/AutoKMS"
            },
            {
              "id": "Xanfpezes.A",
              "display_name": "Xanfpezes.A",
              "target": null
            },
            {
              "id": "Trojan:Win32/Gandcrab",
              "display_name": "Trojan:Win32/Gandcrab",
              "target": "/malware/Trojan:Win32/Gandcrab"
            },
            {
              "id": "Win.Trojan.Generic-9862772-0",
              "display_name": "Win.Trojan.Generic-9862772-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBL!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
            },
            {
              "id": "Win32/Nemucod",
              "display_name": "Win32/Nemucod",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
              "target": null
            },
            {
              "id": "Trojan:Win32/Blihan.A",
              "display_name": "Trojan:Win32/Blihan.A",
              "target": "/malware/Trojan:Win32/Blihan.A"
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "Win.Malware.Kolab-9885903-0",
              "display_name": "Win.Malware.Kolab-9885903-0",
              "target": null
            },
            {
              "id": "Win.Malware (30)",
              "display_name": "Win.Malware (30)",
              "target": null
            },
            {
              "id": "Ransom",
              "display_name": "Ransom",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
              "target": null
            },
            {
              "id": "E5",
              "display_name": "E5",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003.008",
              "name": "/etc/passwd and /etc/shadow",
              "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 6232,
            "URL": 24908,
            "hostname": 7993,
            "FileHash-SHA256": 11128,
            "email": 6,
            "FileHash-MD5": 1054,
            "FileHash-SHA1": 932,
            "SSLCertFingerprint": 14,
            "CIDR": 3,
            "CVE": 3
          },
          "indicator_count": 52273,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "207 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d74d0266b4805d1dfa9d2",
          "name": "Top Tier Spyware | There\u2019s a reason billionaires retreated to their  bunkers. This is terrible.",
          "description": "Nothing seems real.",
          "modified": "2025-08-19T22:03:32.365000",
          "created": "2025-07-20T22:59:28.332000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 1062,
            "domain": 1521,
            "hostname": 3005,
            "URL": 11045
          },
          "indicator_count": 16639,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "BearShare Install File Version 12.0.0.135802",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "http://console.applemarketingtools.com/",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Remotewd.com devices",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "Yara Detections: Tofsee",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "account-apple.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "http://cab.applemarketingtools.com",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "ids-apple.com \u2022 itunes.org",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "If you find anything interesting please research it.",
        "euw-serp-dev-testing19.duck.ai",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "xn--cloud-4sa.com",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "Musiclab, LLC",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "africa.konnect.com",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "sentient.industries affects independent artists. Affects several others."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Pws",
            "Ddos:win32/stormser.a",
            "Win.malware.kolab-9885903-0",
            "E5",
            "Trojan:win32/toga",
            "#lowfidetectsvmware",
            "Trojandownloader:win32/cutwail",
            "Win32.application.bearshare.a",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "Win.packed.razy-9785185-0",
            "#lowfi:hstr:msil/malicious.decryption",
            "Win.trojan.generic-9862772-0",
            "Trojan:win32/zombie.a",
            "#lowfi:hstr:msil/malicious",
            "#lowfienabledtcontinueafterunpacking",
            "Hacktool:win32/autokms",
            "Trojan:win32/blihan.a",
            "Cve-2023-22518",
            "Win.downloader.109205-1",
            "Win32/searchsuite",
            "Win32/nemucod",
            "Win.malware.midie-6847892-0",
            "Backdoor:win32/tofsee.t",
            "Trojandropper:win32/muldrop",
            "Win.malware (30)",
            "Win.trojan.bulz-9860169-0",
            "Trojandropper:win32/muldrop.v!mtb",
            "Trojan:win32/zbot.sibl!mtb",
            "Alf:jasyp:pua:win32/bibado",
            "Custom malware",
            "Alf:heraklezeval:trojandownloader:html/adodb!rfn",
            "Alf:hstr:dotnet",
            "Win.packed.bandook-9882274-1",
            "Xanfpezes.a",
            "Exploit:win32/cve-2017-0147",
            "Win.trojan.jorik-149",
            "Win.trojan.jorik-130",
            "Win.trojan.fakecodecs-119",
            "Script exploit",
            "Win32:downloader-gjk\\ [trj]",
            "Win.trojan.tofsee-7102058-0",
            "Dotnet",
            "Ransom",
            "Trojan:win32/glupteba.mt!mtb",
            "Nufs_inno",
            "Mydoom",
            "Trojan:win32/gandcrab"
          ],
          "industries": [
            "Government",
            "Technology",
            "Healthcare"
          ],
          "unique_indicators": 84848
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mowplayer.com",
    "whois": "http://whois.domaintools.com/mowplayer.com",
    "domain": "mowplayer.com",
    "hostname": "code.alvaro.mowplayer.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69ded8198b25581a09b90824",
      "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
      "description": "",
      "modified": "2026-04-15T00:13:13.981000",
      "created": "2026-04-15T00:13:13.981000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "4 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69db05f833d3d6d2231fb201",
      "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
      "description": "",
      "modified": "2026-04-12T02:39:52.993000",
      "created": "2026-04-12T02:39:52.993000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dab27a0493e0e80a0f35cd",
      "name": "SearchSuite \u2022 Healthcare Administration",
      "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
      "modified": "2026-04-11T20:43:38.695000",
      "created": "2026-04-11T20:43:38.695000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68abf66e97031d0ff0c04fed",
      "name": "Packed sentient.industries links to a targets business website",
      "description": "Very malicious link found in a targets business.\nPacked. Needs to be categorized.\n(FoundryPalantir rich?) Tracking, hacking, and serious espionage.\nAvailable public Information: \nSENTIENT INDUSTRIES\nsentient.industries\nSentient industries provides design and engineering services, from prototyping to small-batch manufacturing, empowering clients to overcome complex challenges. |\nMore about sentient\nMission sentient accelerates mission critical technology for\u2026\nSENTIENT INDUSTRIES\nAccelerating mission-critical tech for disaster response, defense ...\nContact Now\nAustin, tx 78758. United States. EMAIL us. info@sentient \n\nWorse than it looks. Spying on a several threat researchers.",
      "modified": "2025-09-24T04:04:05.604000",
      "created": "2025-08-25T05:36:46.327000",
      "tags": [
        "moved",
        "body",
        "x cache",
        "cloudfront x",
        "cph50 c2",
        "certificate",
        "record value",
        "title",
        "h1 center",
        "server",
        "redacted for",
        "servers",
        "name redacted",
        "for privacy",
        "name servers",
        "org data",
        "privacy city",
        "privacy country",
        "ca creation",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "asn as57033",
        "less whois",
        "registrar",
        "tucows domains",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl ecc",
        "domain secure",
        "site ca",
        "validity",
        "subject public",
        "extraction",
        "data upload",
        "extra data",
        "include review",
        "find",
        "failed",
        "typ no",
        "ms windows",
        "intel",
        "pe32",
        "united",
        "search",
        "as16509",
        "from win32bios",
        "show",
        "high",
        "medium",
        "delphi",
        "copy",
        "write",
        "launcher",
        "next",
        "present aug",
        "present jul",
        "lowfi",
        "win32",
        "a div",
        "div div",
        "learn xml",
        "babylon",
        "win64",
        "trojan",
        "colors",
        "python",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "et info",
        "tls handshake",
        "bad traffic",
        "failure",
        "date",
        "august",
        "hybrid",
        "general",
        "path",
        "starfield",
        "click",
        "strings",
        "se bethseda",
        "n bethseda",
        "n data",
        "error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results aug",
        "read c",
        "tlsv1",
        "port",
        "destination",
        "module load",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "cname",
        "aaaa",
        "creation date",
        "showing",
        "domain",
        "dga domains",
        "palantirfoundry",
        "foundry",
        "status",
        "unknown ns",
        "g2 tls",
        "rsa sha256",
        "italy unknown",
        "mtb may",
        "trojandropper",
        "invalid url",
        "next associated",
        "ddos",
        "body html",
        "hacktool",
        "ipv4",
        "url analysis",
        "ukraine",
        "encrypt",
        "rl add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present jun",
        "entries",
        "title error",
        "all ipv4",
        "reverse dns",
        "yara detections",
        "top source",
        "top destination",
        "source source",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "canada unknown",
        "content type",
        "javascript src",
        "script script",
        "x powered",
        "ipv4 add",
        "pulse submit",
        "submit url",
        "analysis",
        "url add",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "unknown aaaa",
        "ascii text",
        "user agent",
        "powershell",
        "agent",
        "czechia unknown",
        "domain add",
        "dynamicloader",
        "hostname add",
        "pentagon",
        "defense"
      ],
      "references": [
        "sentient.industries affects independent artists. Affects several others.",
        "Bethseda Map - Yara Detections Delphi ,  InnoSetupInstaller",
        "Bethseda Map - High Priority Alerts: ransomware_file_moves ransomware_appends_extensions",
        "Bethseda Map - High Priority Alerts: dumped_buffer2 antisandbox_mouse_hook",
        "Bethseda Map - High Priority Alerts: modifies_certificates ransomware_dropped_files",
        "Bethseda Map - High Priority Alerts: ransomware_mass_file_delete antivm_firmware",
        "Bethseda Map - High Priority Alerts:  antiemu_wine banker_zeus_p2p",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers",
        "prod.foundry.tylertechai.com \u2022 qa.foundry.tylertechai.com \u2022 staging.foundry.tylertechai.com \u2022",
        "talos-staging.palantirfoundry.com \u2022 tylertechai.com \u2022 Palantir Technologies Inc.\u2022 palantirfoundry.com",
        "Affects : Kailula4 , scnrscnr, SongCulture, Tsara Brashears & associated, ScrnrScrnr , dorkingbeauty",
        "Interesting widgets:  https://myid.canon/prd/1.1.30/canonid-assets/gcid-widget.html",
        "http://link.monetizer101.com/widget/custom-2.0.2/templates/1",
        "https://widget-i18n.tiktokv.com.ttdns2.com/ \u2022  https://stella.demand-iq.com/widget",
        "widget-va.tiktokv.com.ttdns2.com \u2022 http://widget-i18n.tiktokv.com.ttdns2.com/",
        "http://link.monetizer101.com/widget/custom-2.0.3/js/load.min.js \u2022",
        "https://link.monetizer101.com/widget/code/595.js \u2022 https://link.monetizer101.com/widget/code/1343.js",
        "https://link.monetizer101.com/widget/code/1511.js \u2022 https://link.monetizer101.com/widget/code/mirror.js",
        "https://link.monetizer101.com/widget/code/dailystaruk.js",
        "https://download.mobiledit.com/drivers/setup_cdd_apple_1_0_10_0.exe",
        "https://forensic.manuals.mobiledit.com/MM/how-to-install-correct-apple-drivers (ASP.NET)",
        "Interesting Strings:  https://pro-api.coinmarketcap.com/v2/cryptocurrency/quotes/historical",
        "(Can't access file- Malware infection files)",
        "Potential reparations: Spyware ,  Trojan ,  Pegasus ,  DNS ,  Graphite ,  Paragon ,   NSO Group ,  Endgame , Cloudfront",
        "constellation.pcfrpegaservice.net (Pegasus related? idk)",
        "On behalf of pcfrpegaservice.net owner Name Servers\tNS-1477.AWSDNS-56.ORG Org\tIdentity Protection Service",
        "TrojanWin32Scoreem - CodeOverlap [616fc7047d6216f7a604fa90f2f2dd0ad5b12f1153137e43858d3421ba964ea4]",
        "I have to breakdown this enormous post over time. I\u2019m going to repost a potential hackers similar post",
        "Remotewd.com devices",
        "If you find anything interesting please research it."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "nUFS_inno",
          "display_name": "nUFS_inno",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious",
          "target": null
        },
        {
          "id": "ALF:JASYP:PUA:Win32/Bibado",
          "display_name": "ALF:JASYP:PUA:Win32/Bibado",
          "target": null
        },
        {
          "id": "Trojan:Win32/Toga",
          "display_name": "Trojan:Win32/Toga",
          "target": "/malware/Trojan:Win32/Toga"
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Custom Malware",
          "display_name": "Custom Malware",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "Win32:Downloader-GJK\\ [Trj]",
          "display_name": "Win32:Downloader-GJK\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.109205-1",
          "display_name": "Win.Downloader.109205-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-149",
          "display_name": "Win.Trojan.Jorik-149",
          "target": null
        },
        {
          "id": "#LowFiDetectsVmWare",
          "display_name": "#LowFiDetectsVmWare",
          "target": null
        },
        {
          "id": "Win.Trojan.Jorik-130",
          "display_name": "Win.Trojan.Jorik-130",
          "target": null
        },
        {
          "id": "Win.Trojan.Fakecodecs-119",
          "display_name": "Win.Trojan.Fakecodecs-119",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Bulz-9860169-0",
          "display_name": "Win.Trojan.Bulz-9860169-0",
          "target": null
        },
        {
          "id": "Win.Malware.Midie-6847892-0",
          "display_name": "Win.Malware.Midie-6847892-0",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop.V!MTB",
          "display_name": "TrojanDropper:Win32/Muldrop.V!MTB",
          "target": "/malware/TrojanDropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Win.Packed.Razy-9785185-0",
          "display_name": "Win.Packed.Razy-9785185-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "PWS",
          "display_name": "PWS",
          "target": null
        },
        {
          "id": "DDOS:Win32/Stormser.A",
          "display_name": "DDOS:Win32/Stormser.A",
          "target": "/malware/DDOS:Win32/Stormser.A"
        },
        {
          "id": "ALF:HSTR:DotNET",
          "display_name": "ALF:HSTR:DotNET",
          "target": null
        },
        {
          "id": "DotNET",
          "display_name": "DotNET",
          "target": null
        },
        {
          "id": "Script Exploit",
          "display_name": "Script Exploit",
          "target": null
        },
        {
          "id": "HackTool:Win32/AutoKMS",
          "display_name": "HackTool:Win32/AutoKMS",
          "target": "/malware/HackTool:Win32/AutoKMS"
        },
        {
          "id": "Xanfpezes.A",
          "display_name": "Xanfpezes.A",
          "target": null
        },
        {
          "id": "Trojan:Win32/Gandcrab",
          "display_name": "Trojan:Win32/Gandcrab",
          "target": "/malware/Trojan:Win32/Gandcrab"
        },
        {
          "id": "Win.Trojan.Generic-9862772-0",
          "display_name": "Win.Trojan.Generic-9862772-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBL!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBL!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBL!MTB"
        },
        {
          "id": "Win32/Nemucod",
          "display_name": "Win32/Nemucod",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "display_name": "ALF:HeraklezEval:TrojanDownloader:HTML/Adodb!rfn",
          "target": null
        },
        {
          "id": "Trojan:Win32/Blihan.A",
          "display_name": "Trojan:Win32/Blihan.A",
          "target": "/malware/Trojan:Win32/Blihan.A"
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "Win.Malware.Kolab-9885903-0",
          "display_name": "Win.Malware.Kolab-9885903-0",
          "target": null
        },
        {
          "id": "Win.Malware (30)",
          "display_name": "Win.Malware (30)",
          "target": null
        },
        {
          "id": "Ransom",
          "display_name": "Ransom",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "display_name": "#Lowfi:HSTR:MSIL/Malicious.Decryption",
          "target": null
        },
        {
          "id": "E5",
          "display_name": "E5",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003.008",
          "name": "/etc/passwd and /etc/shadow",
          "display_name": "T1003.008 - /etc/passwd and /etc/shadow"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 6232,
        "URL": 24908,
        "hostname": 7993,
        "FileHash-SHA256": 11128,
        "email": 6,
        "FileHash-MD5": 1054,
        "FileHash-SHA1": 932,
        "SSLCertFingerprint": 14,
        "CIDR": 3,
        "CVE": 3
      },
      "indicator_count": 52273,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "207 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d74d0266b4805d1dfa9d2",
      "name": "Top Tier Spyware | There\u2019s a reason billionaires retreated to their  bunkers. This is terrible.",
      "description": "Nothing seems real.",
      "modified": "2025-08-19T22:03:32.365000",
      "created": "2025-07-20T22:59:28.332000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 1062,
        "domain": 1521,
        "hostname": 3005,
        "URL": 11045
      },
      "indicator_count": 16639,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://code.alvaro.mowplayer.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://code.alvaro.mowplayer.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638610.6701565
}