{
  "type": "URL",
  "indicator": "https://cpc.syndication.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cpc.syndication.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2854497859,
      "indicator": "https://cpc.syndication.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "65ea56ae1992b02a25aa5c51",
          "name": "TrojanSpy:Win32/Nivdort | Affected OTX accounts | Yotta  Network",
          "description": "Part II -Some users OTX accounts connected to the following | Unexpected revelation | A group of hackers masquerading as attorneys, government officials, advocates, fake nsa, security professional, help desk, etc. I don't know the association with otx.alienvault. Unauthorized logins OTX users. accounts. Deleted and modified pulses, etc. Needs further research for me to fully understand.",
          "modified": "2024-04-06T23:03:19.046000",
          "created": "2024-03-08T00:07:10.521000",
          "tags": [
            "methodpost",
            "threat",
            "iocs",
            "urls http",
            "samples",
            "cnc",
            "phishing",
            "ransom",
            "emotet",
            "fraud services",
            "command _and_control",
            "trojan",
            "scanning host",
            "active threat",
            "malicious",
            "date hash",
            "avast avg",
            "susp",
            "win32",
            "paste",
            "hostnames",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "headers date",
            "connection",
            "first",
            "utc submissions",
            "submitters",
            "computer",
            "company limited",
            "gandi sas",
            "ovh sas",
            "export",
            "summary iocs",
            "graph community",
            "limited",
            "yotta network",
            "gvb gelimed",
            "kb microsoft",
            "indonesia",
            "kyriazhs1975",
            "vj79",
            "bc https",
            "rexxfield",
            "brian sabey",
            "as21342",
            "united",
            "passive dns",
            "unknown",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "urls",
            "msie",
            "chrome",
            "creation date",
            "search",
            "dnssec",
            "entries",
            "body",
            "date",
            "as63949 linode",
            "mtb feb",
            "checkin m1",
            "gmt content",
            "type",
            "encrypt",
            "trojan",
            "artro",
            "moved",
            "pulse pulses",
            "yotta data",
            "yotta",
            "private limited",
            "india",
            "limited yotta",
            "number",
            "as140641",
            "network",
            "facebook",
            "info",
            "cisco umbrella",
            "site",
            "alexa top",
            "site top",
            "million",
            "safe site",
            "million alexa",
            "site safe",
            "cobalt strike",
            "malicious url",
            "blacknet rat",
            "union",
            "vidar",
            "malware",
            "stealer",
            "bank",
            "alexa",
            "deepscan",
            "phishing",
            "team",
            "super",
            "blacknet",
            "babar",
            "detection list",
            "blacklist http",
            "sample",
            "submission",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "kb body",
            "path",
            "as396982 google",
            "bq mar",
            "win32cve mar",
            "exploit",
            "virtool",
            "status",
            "name servers",
            "emails",
            "servers",
            "next",
            "files",
            "as44273 host",
            "germany unknown",
            "expiration date",
            "showing",
            "win32upatre mar",
            "milehighmedia",
            "ids detections",
            "possible fake",
            "av checkin",
            "initial checkin",
            "checkin",
            "utah data",
            "center",
            "june",
            "data center",
            "responsible",
            "nsa utah",
            "march",
            "closeup view",
            "july",
            "view",
            "february",
            "prism",
            "cascade",
            "darpa",
            "twitter",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "nxdomain",
            "whitelisted",
            "domain",
            "as54113",
            "msil",
            "cryp",
            "files show",
            "entries related",
            "domains",
            "as15169 google",
            "gmt cache",
            "sameorigin",
            "trojandropper",
            "asnone united",
            "title error",
            "porkbun",
            "mtb mar",
            "trojanspy",
            "installer",
            "loader",
            "hijacker",
            "targeting",
            "as30456",
            "sec ch",
            "for privacy",
            "ch ua",
            "hash avast",
            "avg clamav",
            "msdefender mar",
            "lowfi",
            "dns replication",
            "ip detections",
            "country",
            "contacted",
            "graph",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "file size",
            "open threat",
            "learn",
            "html info",
            "exchange meta",
            "tags twitter",
            "alienvault",
            "script tags",
            "iframe tags",
            "google tag",
            "manager anchor",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "google",
            "amazon ec2",
            "email",
            "city",
            "server",
            "amazon data",
            "amazon",
            "code",
            "form",
            "po box",
            "tech",
            "show",
            "description ype",
            "collections",
            "partru",
            "execution",
            "fake host"
          ],
          "references": [
            "Part II -Some users OTX accounts connected to the following | Unexpected revelation |",
            "Title Salzburg Airport | Public Operations Display Portal  | http://quantum.emsbk.com/",
            "go.sabey.com | sabey.com | smear.cloud | w1.voyeurweb.com | Never stops...",
            "https://www.milehighmedia.com/legal/2257",
            "http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
            "http://schoolcare.dyndns.org/soap/ISCKeyUpdater",
            "http://callenjoy.net/index.php | watchhers.net | emails.redvue.com | nexus.devnautiluscloud.net | http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
            "http://45.159.189.105/bot/regex | http://46.109.184.5/search.htm | http://acycseiiqsau.org/ | emsbk.innocraft.cloud  | jenkins.devnautiluscloud.net |",
            "hostmaster.hostmaster.hostmaster.cartography.midst.co.uk | message.htm.com | quantum.emsbk.com http://cms.static.hw.famedownload.com/famedigital/m/",
            "http://cms.static.hw.famedownload.com/famedigital/m/1b6j9enlerq8k4g8/header-big8.jpg",
            "CnC IP's: 104.200.21.37 | 106.14.226.91 | 192.187.111.221 | 198.58.118.167 | 208.100.26.245 |  34.174.78.212",
            "Cookies AWSALB h0mLG52+gDNUdBHb468xx6EZCua7FVRvlZWH7URKSKV27WSs637El46CBcw8RmPBxIAT2jqmmByDbnMIsYobUWhWbNadYFsxVQk/gVDcDfdixV/5aQn0VRon9gXO",
            "https://nsa.gov1.info/utah-data-center",
            "https://softwaremill.com/grpc-vs-rest/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Arab Emirates"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort.CW",
              "display_name": "TrojanSpy:Win32/Nivdort.CW",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
            },
            {
              "id": "AndroidOverlayMalware - MOB-S0012",
              "display_name": "AndroidOverlayMalware - MOB-S0012",
              "target": null
            },
            {
              "id": "#Lowfi:LUA:AutoItV3CraftedOverlay",
              "display_name": "#Lowfi:LUA:AutoItV3CraftedOverlay",
              "target": null
            },
            {
              "id": "Crypt3.BWVY",
              "display_name": "Crypt3.BWVY",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Babar",
              "display_name": "Babar",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector.gen!BQ",
              "display_name": "VirTool:Win32/Injector.gen!BQ",
              "target": "/malware/VirTool:Win32/Injector.gen!BQ"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Dropper.Generic_r.EC",
              "display_name": "Dropper.Generic_r.EC",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/Zbot",
              "display_name": "ALF:Trojan:Win32/Zbot",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1605",
              "name": "Command-Line Interface",
              "display_name": "T1605 - Command-Line Interface"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1583.004",
              "name": "Server",
              "display_name": "T1583.004 - Server"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            }
          ],
          "industries": [
            "Civil Society",
            "Telecommunications",
            "Technology",
            "Financial"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 59,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6765,
            "FileHash-MD5": 688,
            "FileHash-SHA1": 422,
            "FileHash-SHA256": 3169,
            "domain": 2171,
            "hostname": 1714,
            "email": 11,
            "CVE": 2,
            "CIDR": 2
          },
          "indicator_count": 14944,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "742 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eadaae65b9123721198d08",
          "name": "Nivdort | Affected OTX accounts | Yotta Network (Cloned OTX user)",
          "description": "",
          "modified": "2024-04-06T23:03:19.046000",
          "created": "2024-03-08T09:30:22.295000",
          "tags": [
            "methodpost",
            "threat",
            "iocs",
            "urls http",
            "samples",
            "cnc",
            "phishing",
            "ransom",
            "emotet",
            "fraud services",
            "command _and_control",
            "trojan",
            "scanning host",
            "active threat",
            "malicious",
            "date hash",
            "avast avg",
            "susp",
            "win32",
            "paste",
            "hostnames",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "headers date",
            "connection",
            "first",
            "utc submissions",
            "submitters",
            "computer",
            "company limited",
            "gandi sas",
            "ovh sas",
            "export",
            "summary iocs",
            "graph community",
            "limited",
            "yotta network",
            "gvb gelimed",
            "kb microsoft",
            "indonesia",
            "kyriazhs1975",
            "vj79",
            "bc https",
            "rexxfield",
            "brian sabey",
            "as21342",
            "united",
            "passive dns",
            "unknown",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "urls",
            "msie",
            "chrome",
            "creation date",
            "search",
            "dnssec",
            "entries",
            "body",
            "date",
            "as63949 linode",
            "mtb feb",
            "checkin m1",
            "gmt content",
            "type",
            "encrypt",
            "trojan",
            "artro",
            "moved",
            "pulse pulses",
            "yotta data",
            "yotta",
            "private limited",
            "india",
            "limited yotta",
            "number",
            "as140641",
            "network",
            "facebook",
            "info",
            "cisco umbrella",
            "site",
            "alexa top",
            "site top",
            "million",
            "safe site",
            "million alexa",
            "site safe",
            "cobalt strike",
            "malicious url",
            "blacknet rat",
            "union",
            "vidar",
            "malware",
            "stealer",
            "bank",
            "alexa",
            "deepscan",
            "phishing",
            "team",
            "super",
            "blacknet",
            "babar",
            "detection list",
            "blacklist http",
            "sample",
            "submission",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "kb body",
            "path",
            "as396982 google",
            "bq mar",
            "win32cve mar",
            "exploit",
            "virtool",
            "status",
            "name servers",
            "emails",
            "servers",
            "next",
            "files",
            "as44273 host",
            "germany unknown",
            "expiration date",
            "showing",
            "win32upatre mar",
            "milehighmedia",
            "ids detections",
            "possible fake",
            "av checkin",
            "initial checkin",
            "checkin",
            "utah data",
            "center",
            "june",
            "data center",
            "responsible",
            "nsa utah",
            "march",
            "closeup view",
            "july",
            "view",
            "february",
            "prism",
            "cascade",
            "darpa",
            "twitter",
            "as20940",
            "aaaa",
            "as16625 akamai",
            "nxdomain",
            "whitelisted",
            "domain",
            "as54113",
            "msil",
            "cryp",
            "files show",
            "entries related",
            "domains",
            "as15169 google",
            "gmt cache",
            "sameorigin",
            "trojandropper",
            "asnone united",
            "title error",
            "porkbun",
            "mtb mar",
            "trojanspy",
            "installer",
            "loader",
            "hijacker",
            "targeting",
            "as30456",
            "sec ch",
            "for privacy",
            "ch ua",
            "hash avast",
            "avg clamav",
            "msdefender mar",
            "lowfi",
            "dns replication",
            "ip detections",
            "country",
            "contacted",
            "graph",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "file size",
            "open threat",
            "learn",
            "html info",
            "exchange meta",
            "tags twitter",
            "alienvault",
            "script tags",
            "iframe tags",
            "google tag",
            "manager anchor",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "google",
            "amazon ec2",
            "email",
            "city",
            "server",
            "amazon data",
            "amazon",
            "code",
            "form",
            "po box",
            "tech",
            "show",
            "description ype",
            "collections",
            "partru",
            "execution",
            "fake host"
          ],
          "references": [
            "Part II -Some users OTX accounts connected to the following | Unexpected revelation |",
            "Title Salzburg Airport | Public Operations Display Portal  | http://quantum.emsbk.com/",
            "go.sabey.com | sabey.com | smear.cloud | w1.voyeurweb.com | Never stops...",
            "https://www.milehighmedia.com/legal/2257",
            "http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
            "http://schoolcare.dyndns.org/soap/ISCKeyUpdater",
            "http://callenjoy.net/index.php | watchhers.net | emails.redvue.com | nexus.devnautiluscloud.net | http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
            "http://45.159.189.105/bot/regex | http://46.109.184.5/search.htm | http://acycseiiqsau.org/ | emsbk.innocraft.cloud  | jenkins.devnautiluscloud.net |",
            "hostmaster.hostmaster.hostmaster.cartography.midst.co.uk | message.htm.com | quantum.emsbk.com http://cms.static.hw.famedownload.com/famedigital/m/",
            "http://cms.static.hw.famedownload.com/famedigital/m/1b6j9enlerq8k4g8/header-big8.jpg",
            "CnC IP's: 104.200.21.37 | 106.14.226.91 | 192.187.111.221 | 198.58.118.167 | 208.100.26.245 |  34.174.78.212",
            "Cookies AWSALB h0mLG52+gDNUdBHb468xx6EZCua7FVRvlZWH7URKSKV27WSs637El46CBcw8RmPBxIAT2jqmmByDbnMIsYobUWhWbNadYFsxVQk/gVDcDfdixV/5aQn0VRon9gXO",
            "https://nsa.gov1.info/utah-data-center",
            "https://softwaremill.com/grpc-vs-rest/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Arab Emirates"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy:Win32/Nivdort.CW",
              "display_name": "TrojanSpy:Win32/Nivdort.CW",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
            },
            {
              "id": "AndroidOverlayMalware - MOB-S0012",
              "display_name": "AndroidOverlayMalware - MOB-S0012",
              "target": null
            },
            {
              "id": "#Lowfi:LUA:AutoItV3CraftedOverlay",
              "display_name": "#Lowfi:LUA:AutoItV3CraftedOverlay",
              "target": null
            },
            {
              "id": "Crypt3.BWVY",
              "display_name": "Crypt3.BWVY",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "Babar",
              "display_name": "Babar",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector.gen!BQ",
              "display_name": "VirTool:Win32/Injector.gen!BQ",
              "target": "/malware/VirTool:Win32/Injector.gen!BQ"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Dropper.Generic_r.EC",
              "display_name": "Dropper.Generic_r.EC",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/Zbot",
              "display_name": "ALF:Trojan:Win32/Zbot",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1605",
              "name": "Command-Line Interface",
              "display_name": "T1605 - Command-Line Interface"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1583.004",
              "name": "Server",
              "display_name": "T1583.004 - Server"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            }
          ],
          "industries": [
            "Civil Society",
            "Telecommunications",
            "Technology",
            "Financial"
          ],
          "TLP": "white",
          "cloned_from": "65ea56ae1992b02a25aa5c51",
          "export_count": 63,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6765,
            "FileHash-MD5": 688,
            "FileHash-SHA1": 422,
            "FileHash-SHA256": 3169,
            "domain": 2171,
            "hostname": 1714,
            "email": 11,
            "CVE": 2,
            "CIDR": 2
          },
          "indicator_count": 14944,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "742 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e576b3cbdf2f86a32acc",
          "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
          "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
          "modified": "2024-02-16T13:04:46.804000",
          "created": "2024-01-17T14:34:30.204000",
          "tags": [
            "whois record",
            "historical ssl",
            "ssl certificate",
            "april",
            "referrer",
            "threat roundup",
            "communicating",
            "whois",
            "rwi dtools",
            "jekyll",
            "metro",
            "skynet",
            "identity theft",
            "parking crew",
            "whois whois",
            "resolutions",
            "october",
            "august",
            "march",
            "june",
            "attack",
            "goldfinder",
            "sibot",
            "hacktool",
            "remote attack",
            "social engineering",
            "read c",
            "get autoit",
            "search",
            "regsetvalueexa",
            "show",
            "entries",
            "regdword",
            "intel",
            "ms windows",
            "showing",
            "autoit",
            "write",
            "worm",
            "copy",
            "unknown",
            "win32",
            "persistence",
            "execution",
            "malware",
            "autorun",
            "redacted for",
            "for privacy",
            "name servers",
            "date",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "encrypt",
            "next",
            "sabey",
            "no expiration",
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "iocs",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "malware beacon",
            "useragent",
            "http request",
            "hostile",
            "autoit windows",
            "automation tool",
            "forbidden",
            "algorithm",
            "full name",
            "v3 serial",
            "number",
            "issuer",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "info",
            "first",
            "detections type",
            "name",
            "javascript",
            "pdf community",
            "office open",
            "xml spreadsheet",
            "text",
            "siblings",
            "process32nextw",
            "fjlsedauv",
            "writeconsolea",
            "medium",
            "discovery",
            "high",
            "module load",
            "t1129",
            "united",
            "as63949 linode",
            "mtb jan",
            "passive dns",
            "backdoor",
            "mtb dec",
            "open",
            "body",
            "artro",
            "creation date",
            "servers",
            "urls",
            "record value",
            "expiration date",
            "vt graph",
            "parent referrer",
            "apple private",
            "data collection",
            "hidden privacy",
            "malicious",
            "verified",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "tucows",
            "amazonaes",
            "china telecom",
            "group",
            "cloudflarenet",
            "akamaias",
            "pty ltd",
            "argon data",
            "communication",
            "limited",
            "digitaloceanasn",
            "twitter",
            "dropbox",
            "domainsite",
            "alibaba cloud",
            "computing",
            "beijing",
            "service",
            "ip address",
            "latest",
            "virustotal",
            "unclejohn",
            "us autonomous",
            "system46606",
            "unified layer",
            "urls latest",
            "contacted",
            "historical",
            "subdomains",
            "gootloader",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "binary",
            "sameorigin",
            "scammer",
            "spammer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "GoldFinder",
              "display_name": "GoldFinder",
              "target": null
            },
            {
              "id": "Sibot - S0589",
              "display_name": "Sibot - S0589",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "target": null
            },
            {
              "id": "W32/Expiro.fam",
              "display_name": "W32/Expiro.fam",
              "target": null
            },
            {
              "id": "Kimsuky",
              "display_name": "Kimsuky",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1460",
              "name": "Biometric Spoofing",
              "display_name": "T1460 - Biometric Spoofing"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            }
          ],
          "industries": [
            "Healthcare",
            "Insurance",
            "Finance",
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 515,
            "FileHash-SHA1": 504,
            "FileHash-SHA256": 3557,
            "URL": 5450,
            "domain": 1842,
            "hostname": 2221,
            "CVE": 2,
            "email": 6
          },
          "indicator_count": 14097,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "793 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659331580cd1571f730b8de2",
          "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
          "description": "",
          "modified": "2024-01-31T14:03:30.344000",
          "created": "2024-01-01T21:40:40.242000",
          "tags": [
            "maxads0",
            "kld1063",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls http",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "march",
            "communicating",
            "copy",
            "january",
            "collections",
            "execution",
            "malware",
            "startpage",
            "malicious",
            "ransomware",
            "agent tesla",
            "attack",
            "android",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "windir",
            "path",
            "programfiles",
            "pe32",
            "ms windows",
            "getprocaddress",
            "file type",
            "mitre att",
            "ck id",
            "show technique",
            "win64",
            "date",
            "open",
            "hybrid",
            "cookie",
            "tracking",
            "apple",
            "spyware",
            "malware",
            "tablet",
            "superwebbysearch",
            "hallrender",
            "pegasus",
            "briansabey",
            "aig",
            "abuse",
            "tulach"
          ],
          "references": [
            "findbetterresults.com",
            "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
            "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
            "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
            "www2.megawebfind.com                [command_and_control]",
            "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2368,
            "FileHash-SHA256": 4539,
            "hostname": 2892,
            "URL": 9741,
            "FileHash-MD5": 836,
            "FileHash-SHA1": 461,
            "CVE": 1
          },
          "indicator_count": 20838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659331589faf01b909c1802d",
          "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
          "description": "",
          "modified": "2024-01-31T14:03:30.344000",
          "created": "2024-01-01T21:40:40.413000",
          "tags": [
            "maxads0",
            "kld1063",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls http",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "march",
            "communicating",
            "copy",
            "january",
            "collections",
            "execution",
            "malware",
            "startpage",
            "malicious",
            "ransomware",
            "agent tesla",
            "attack",
            "android",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "windir",
            "path",
            "programfiles",
            "pe32",
            "ms windows",
            "getprocaddress",
            "file type",
            "mitre att",
            "ck id",
            "show technique",
            "win64",
            "date",
            "open",
            "hybrid",
            "cookie",
            "tracking",
            "apple",
            "spyware",
            "malware",
            "tablet",
            "superwebbysearch",
            "hallrender",
            "pegasus",
            "briansabey",
            "aig",
            "abuse",
            "tulach"
          ],
          "references": [
            "findbetterresults.com",
            "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
            "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
            "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
            "www2.megawebfind.com                [command_and_control]",
            "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2368,
            "FileHash-SHA256": 4539,
            "hostname": 2892,
            "URL": 9741,
            "FileHash-MD5": 836,
            "FileHash-SHA1": 461,
            "CVE": 1
          },
          "indicator_count": 20838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657090132deb7fd89b09d555",
          "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns",
          "description": "",
          "modified": "2023-12-06T15:15:31.177000",
          "created": "2023-12-06T15:15:31.177000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 825,
            "domain": 308,
            "URL": 2036,
            "FileHash-SHA256": 2141
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707dbbb0493c03ba107643",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "",
          "modified": "2023-12-06T13:57:15.377000",
          "created": "2023-12-06T13:57:15.377000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1933,
            "domain": 1302,
            "hostname": 805,
            "URL": 3593,
            "FileHash-MD5": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62c035df9d1c1df8ca3fcaea",
          "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns",
          "description": "",
          "modified": "2022-08-01T00:01:42.977000",
          "created": "2022-07-02T12:11:11.592000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 825,
            "FileHash-SHA256": 2141,
            "domain": 308,
            "URL": 2036
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 396,
          "modified_text": "1357 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "61f9b4b2c6c645e9839112b2",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
          "modified": "2022-03-04T00:00:56.902000",
          "created": "2022-02-01T22:31:14.017000",
          "tags": [
            "irst seen",
            "date",
            "file sha256",
            "network related",
            "malicious",
            "found"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3593,
            "FileHash-SHA256": 1933,
            "hostname": 805,
            "domain": 1302,
            "FileHash-MD5": 1,
            "CVE": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 397,
          "modified_text": "1507 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "go.sabey.com | sabey.com | smear.cloud | w1.voyeurweb.com | Never stops...",
        "hostmaster.hostmaster.hostmaster.cartography.midst.co.uk | message.htm.com | quantum.emsbk.com http://cms.static.hw.famedownload.com/famedigital/m/",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "http://callenjoy.net/index.php | watchhers.net | emails.redvue.com | nexus.devnautiluscloud.net | http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "http://schoolcare.dyndns.org/soap/ISCKeyUpdater",
        "Part II -Some users OTX accounts connected to the following | Unexpected revelation |",
        "http://cms.static.hw.famedownload.com/famedigital/m/1b6j9enlerq8k4g8/header-big8.jpg",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto",
        "http://45.159.189.105/bot/regex | http://46.109.184.5/search.htm | http://acycseiiqsau.org/ | emsbk.innocraft.cloud  | jenkins.devnautiluscloud.net |",
        "Title Salzburg Airport | Public Operations Display Portal  | http://quantum.emsbk.com/",
        "CnC IP's: 104.200.21.37 | 106.14.226.91 | 192.187.111.221 | 198.58.118.167 | 208.100.26.245 |  34.174.78.212",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "www2.megawebfind.com                [command_and_control]",
        "https://nsa.gov1.info/utah-data-center",
        "Cookies AWSALB h0mLG52+gDNUdBHb468xx6EZCua7FVRvlZWH7URKSKV27WSs637El46CBcw8RmPBxIAT2jqmmByDbnMIsYobUWhWbNadYFsxVQk/gVDcDfdixV/5aQn0VRon9gXO",
        "findbetterresults.com",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "https://www.milehighmedia.com/legal/2257",
        "http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "https://softwaremill.com/grpc-vs-rest/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Goldfinder",
            "Blacknet",
            "Alf:heraklezeval:trojan:win32/ymacco.aa47",
            "#lowfi:lua:autoitv3craftedoverlay",
            "Win32:malware-gen",
            "Skynet",
            "#virtool:win32/obfuscator.adb",
            "Downloader.cerber/js!1.a59c (classic)",
            "Virtool:win32/injector.gen!bq",
            "Worm:win32/mofksys.rnd!mtb",
            "Trojanspy:win32/nivdort.cw",
            "Androidoverlaymalware - mob-s0012",
            "Sibot - s0589",
            "Malware",
            "Alf:trojan:win32/zbot",
            "Crypt3.bwvy",
            "Dropper.generic_r.ec",
            "Verified",
            "Babar",
            "W32/expiro.fam",
            "Artro",
            "Trojan:win32/floxif.e",
            "Ransomware",
            "Agent tesla",
            "Trojanspy",
            "Kimsuky",
            "Hacktool"
          ],
          "industries": [
            "Financial",
            "Insurance",
            "Telecommunications",
            "Healthcare",
            "Government",
            "Finance",
            "Civil society",
            "Technology"
          ],
          "unique_indicators": 62381
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/syndication.com",
    "whois": "http://whois.domaintools.com/syndication.com",
    "domain": "syndication.com",
    "hostname": "cpc.syndication.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "65ea56ae1992b02a25aa5c51",
      "name": "TrojanSpy:Win32/Nivdort | Affected OTX accounts | Yotta  Network",
      "description": "Part II -Some users OTX accounts connected to the following | Unexpected revelation | A group of hackers masquerading as attorneys, government officials, advocates, fake nsa, security professional, help desk, etc. I don't know the association with otx.alienvault. Unauthorized logins OTX users. accounts. Deleted and modified pulses, etc. Needs further research for me to fully understand.",
      "modified": "2024-04-06T23:03:19.046000",
      "created": "2024-03-08T00:07:10.521000",
      "tags": [
        "methodpost",
        "threat",
        "iocs",
        "urls http",
        "samples",
        "cnc",
        "phishing",
        "ransom",
        "emotet",
        "fraud services",
        "command _and_control",
        "trojan",
        "scanning host",
        "active threat",
        "malicious",
        "date hash",
        "avast avg",
        "susp",
        "win32",
        "paste",
        "hostnames",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "headers date",
        "connection",
        "first",
        "utc submissions",
        "submitters",
        "computer",
        "company limited",
        "gandi sas",
        "ovh sas",
        "export",
        "summary iocs",
        "graph community",
        "limited",
        "yotta network",
        "gvb gelimed",
        "kb microsoft",
        "indonesia",
        "kyriazhs1975",
        "vj79",
        "bc https",
        "rexxfield",
        "brian sabey",
        "as21342",
        "united",
        "passive dns",
        "unknown",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "urls",
        "msie",
        "chrome",
        "creation date",
        "search",
        "dnssec",
        "entries",
        "body",
        "date",
        "as63949 linode",
        "mtb feb",
        "checkin m1",
        "gmt content",
        "type",
        "encrypt",
        "trojan",
        "artro",
        "moved",
        "pulse pulses",
        "yotta data",
        "yotta",
        "private limited",
        "india",
        "limited yotta",
        "number",
        "as140641",
        "network",
        "facebook",
        "info",
        "cisco umbrella",
        "site",
        "alexa top",
        "site top",
        "million",
        "safe site",
        "million alexa",
        "site safe",
        "cobalt strike",
        "malicious url",
        "blacknet rat",
        "union",
        "vidar",
        "malware",
        "stealer",
        "bank",
        "alexa",
        "deepscan",
        "phishing",
        "team",
        "super",
        "blacknet",
        "babar",
        "detection list",
        "blacklist http",
        "sample",
        "submission",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "kb body",
        "path",
        "as396982 google",
        "bq mar",
        "win32cve mar",
        "exploit",
        "virtool",
        "status",
        "name servers",
        "emails",
        "servers",
        "next",
        "files",
        "as44273 host",
        "germany unknown",
        "expiration date",
        "showing",
        "win32upatre mar",
        "milehighmedia",
        "ids detections",
        "possible fake",
        "av checkin",
        "initial checkin",
        "checkin",
        "utah data",
        "center",
        "june",
        "data center",
        "responsible",
        "nsa utah",
        "march",
        "closeup view",
        "july",
        "view",
        "february",
        "prism",
        "cascade",
        "darpa",
        "twitter",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "nxdomain",
        "whitelisted",
        "domain",
        "as54113",
        "msil",
        "cryp",
        "files show",
        "entries related",
        "domains",
        "as15169 google",
        "gmt cache",
        "sameorigin",
        "trojandropper",
        "asnone united",
        "title error",
        "porkbun",
        "mtb mar",
        "trojanspy",
        "installer",
        "loader",
        "hijacker",
        "targeting",
        "as30456",
        "sec ch",
        "for privacy",
        "ch ua",
        "hash avast",
        "avg clamav",
        "msdefender mar",
        "lowfi",
        "dns replication",
        "ip detections",
        "country",
        "contacted",
        "graph",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "file size",
        "open threat",
        "learn",
        "html info",
        "exchange meta",
        "tags twitter",
        "alienvault",
        "script tags",
        "iframe tags",
        "google tag",
        "manager anchor",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "google",
        "amazon ec2",
        "email",
        "city",
        "server",
        "amazon data",
        "amazon",
        "code",
        "form",
        "po box",
        "tech",
        "show",
        "description ype",
        "collections",
        "partru",
        "execution",
        "fake host"
      ],
      "references": [
        "Part II -Some users OTX accounts connected to the following | Unexpected revelation |",
        "Title Salzburg Airport | Public Operations Display Portal  | http://quantum.emsbk.com/",
        "go.sabey.com | sabey.com | smear.cloud | w1.voyeurweb.com | Never stops...",
        "https://www.milehighmedia.com/legal/2257",
        "http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "http://schoolcare.dyndns.org/soap/ISCKeyUpdater",
        "http://callenjoy.net/index.php | watchhers.net | emails.redvue.com | nexus.devnautiluscloud.net | http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "http://45.159.189.105/bot/regex | http://46.109.184.5/search.htm | http://acycseiiqsau.org/ | emsbk.innocraft.cloud  | jenkins.devnautiluscloud.net |",
        "hostmaster.hostmaster.hostmaster.cartography.midst.co.uk | message.htm.com | quantum.emsbk.com http://cms.static.hw.famedownload.com/famedigital/m/",
        "http://cms.static.hw.famedownload.com/famedigital/m/1b6j9enlerq8k4g8/header-big8.jpg",
        "CnC IP's: 104.200.21.37 | 106.14.226.91 | 192.187.111.221 | 198.58.118.167 | 208.100.26.245 |  34.174.78.212",
        "Cookies AWSALB h0mLG52+gDNUdBHb468xx6EZCua7FVRvlZWH7URKSKV27WSs637El46CBcw8RmPBxIAT2jqmmByDbnMIsYobUWhWbNadYFsxVQk/gVDcDfdixV/5aQn0VRon9gXO",
        "https://nsa.gov1.info/utah-data-center",
        "https://softwaremill.com/grpc-vs-rest/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Arab Emirates"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort.CW",
          "display_name": "TrojanSpy:Win32/Nivdort.CW",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
        },
        {
          "id": "AndroidOverlayMalware - MOB-S0012",
          "display_name": "AndroidOverlayMalware - MOB-S0012",
          "target": null
        },
        {
          "id": "#Lowfi:LUA:AutoItV3CraftedOverlay",
          "display_name": "#Lowfi:LUA:AutoItV3CraftedOverlay",
          "target": null
        },
        {
          "id": "Crypt3.BWVY",
          "display_name": "Crypt3.BWVY",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Babar",
          "display_name": "Babar",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector.gen!BQ",
          "display_name": "VirTool:Win32/Injector.gen!BQ",
          "target": "/malware/VirTool:Win32/Injector.gen!BQ"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Dropper.Generic_r.EC",
          "display_name": "Dropper.Generic_r.EC",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/Zbot",
          "display_name": "ALF:Trojan:Win32/Zbot",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1605",
          "name": "Command-Line Interface",
          "display_name": "T1605 - Command-Line Interface"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1583.004",
          "name": "Server",
          "display_name": "T1583.004 - Server"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        }
      ],
      "industries": [
        "Civil Society",
        "Telecommunications",
        "Technology",
        "Financial"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 59,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6765,
        "FileHash-MD5": 688,
        "FileHash-SHA1": 422,
        "FileHash-SHA256": 3169,
        "domain": 2171,
        "hostname": 1714,
        "email": 11,
        "CVE": 2,
        "CIDR": 2
      },
      "indicator_count": 14944,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "742 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65eadaae65b9123721198d08",
      "name": "Nivdort | Affected OTX accounts | Yotta Network (Cloned OTX user)",
      "description": "",
      "modified": "2024-04-06T23:03:19.046000",
      "created": "2024-03-08T09:30:22.295000",
      "tags": [
        "methodpost",
        "threat",
        "iocs",
        "urls http",
        "samples",
        "cnc",
        "phishing",
        "ransom",
        "emotet",
        "fraud services",
        "command _and_control",
        "trojan",
        "scanning host",
        "active threat",
        "malicious",
        "date hash",
        "avast avg",
        "susp",
        "win32",
        "paste",
        "hostnames",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "headers date",
        "connection",
        "first",
        "utc submissions",
        "submitters",
        "computer",
        "company limited",
        "gandi sas",
        "ovh sas",
        "export",
        "summary iocs",
        "graph community",
        "limited",
        "yotta network",
        "gvb gelimed",
        "kb microsoft",
        "indonesia",
        "kyriazhs1975",
        "vj79",
        "bc https",
        "rexxfield",
        "brian sabey",
        "as21342",
        "united",
        "passive dns",
        "unknown",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "urls",
        "msie",
        "chrome",
        "creation date",
        "search",
        "dnssec",
        "entries",
        "body",
        "date",
        "as63949 linode",
        "mtb feb",
        "checkin m1",
        "gmt content",
        "type",
        "encrypt",
        "trojan",
        "artro",
        "moved",
        "pulse pulses",
        "yotta data",
        "yotta",
        "private limited",
        "india",
        "limited yotta",
        "number",
        "as140641",
        "network",
        "facebook",
        "info",
        "cisco umbrella",
        "site",
        "alexa top",
        "site top",
        "million",
        "safe site",
        "million alexa",
        "site safe",
        "cobalt strike",
        "malicious url",
        "blacknet rat",
        "union",
        "vidar",
        "malware",
        "stealer",
        "bank",
        "alexa",
        "deepscan",
        "phishing",
        "team",
        "super",
        "blacknet",
        "babar",
        "detection list",
        "blacklist http",
        "sample",
        "submission",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "kb body",
        "path",
        "as396982 google",
        "bq mar",
        "win32cve mar",
        "exploit",
        "virtool",
        "status",
        "name servers",
        "emails",
        "servers",
        "next",
        "files",
        "as44273 host",
        "germany unknown",
        "expiration date",
        "showing",
        "win32upatre mar",
        "milehighmedia",
        "ids detections",
        "possible fake",
        "av checkin",
        "initial checkin",
        "checkin",
        "utah data",
        "center",
        "june",
        "data center",
        "responsible",
        "nsa utah",
        "march",
        "closeup view",
        "july",
        "view",
        "february",
        "prism",
        "cascade",
        "darpa",
        "twitter",
        "as20940",
        "aaaa",
        "as16625 akamai",
        "nxdomain",
        "whitelisted",
        "domain",
        "as54113",
        "msil",
        "cryp",
        "files show",
        "entries related",
        "domains",
        "as15169 google",
        "gmt cache",
        "sameorigin",
        "trojandropper",
        "asnone united",
        "title error",
        "porkbun",
        "mtb mar",
        "trojanspy",
        "installer",
        "loader",
        "hijacker",
        "targeting",
        "as30456",
        "sec ch",
        "for privacy",
        "ch ua",
        "hash avast",
        "avg clamav",
        "msdefender mar",
        "lowfi",
        "dns replication",
        "ip detections",
        "country",
        "contacted",
        "graph",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "file size",
        "open threat",
        "learn",
        "html info",
        "exchange meta",
        "tags twitter",
        "alienvault",
        "script tags",
        "iframe tags",
        "google tag",
        "manager anchor",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "google",
        "amazon ec2",
        "email",
        "city",
        "server",
        "amazon data",
        "amazon",
        "code",
        "form",
        "po box",
        "tech",
        "show",
        "description ype",
        "collections",
        "partru",
        "execution",
        "fake host"
      ],
      "references": [
        "Part II -Some users OTX accounts connected to the following | Unexpected revelation |",
        "Title Salzburg Airport | Public Operations Display Portal  | http://quantum.emsbk.com/",
        "go.sabey.com | sabey.com | smear.cloud | w1.voyeurweb.com | Never stops...",
        "https://www.milehighmedia.com/legal/2257",
        "http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "http://schoolcare.dyndns.org/soap/ISCKeyUpdater",
        "http://callenjoy.net/index.php | watchhers.net | emails.redvue.com | nexus.devnautiluscloud.net | http://finishstrong.net/index.php?email=google_romania2000@yahoo.com&method=post&len",
        "http://45.159.189.105/bot/regex | http://46.109.184.5/search.htm | http://acycseiiqsau.org/ | emsbk.innocraft.cloud  | jenkins.devnautiluscloud.net |",
        "hostmaster.hostmaster.hostmaster.cartography.midst.co.uk | message.htm.com | quantum.emsbk.com http://cms.static.hw.famedownload.com/famedigital/m/",
        "http://cms.static.hw.famedownload.com/famedigital/m/1b6j9enlerq8k4g8/header-big8.jpg",
        "CnC IP's: 104.200.21.37 | 106.14.226.91 | 192.187.111.221 | 198.58.118.167 | 208.100.26.245 |  34.174.78.212",
        "Cookies AWSALB h0mLG52+gDNUdBHb468xx6EZCua7FVRvlZWH7URKSKV27WSs637El46CBcw8RmPBxIAT2jqmmByDbnMIsYobUWhWbNadYFsxVQk/gVDcDfdixV/5aQn0VRon9gXO",
        "https://nsa.gov1.info/utah-data-center",
        "https://softwaremill.com/grpc-vs-rest/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Arab Emirates"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy:Win32/Nivdort.CW",
          "display_name": "TrojanSpy:Win32/Nivdort.CW",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
        },
        {
          "id": "AndroidOverlayMalware - MOB-S0012",
          "display_name": "AndroidOverlayMalware - MOB-S0012",
          "target": null
        },
        {
          "id": "#Lowfi:LUA:AutoItV3CraftedOverlay",
          "display_name": "#Lowfi:LUA:AutoItV3CraftedOverlay",
          "target": null
        },
        {
          "id": "Crypt3.BWVY",
          "display_name": "Crypt3.BWVY",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "Babar",
          "display_name": "Babar",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector.gen!BQ",
          "display_name": "VirTool:Win32/Injector.gen!BQ",
          "target": "/malware/VirTool:Win32/Injector.gen!BQ"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Dropper.Generic_r.EC",
          "display_name": "Dropper.Generic_r.EC",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/Zbot",
          "display_name": "ALF:Trojan:Win32/Zbot",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1605",
          "name": "Command-Line Interface",
          "display_name": "T1605 - Command-Line Interface"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1583.004",
          "name": "Server",
          "display_name": "T1583.004 - Server"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        }
      ],
      "industries": [
        "Civil Society",
        "Telecommunications",
        "Technology",
        "Financial"
      ],
      "TLP": "white",
      "cloned_from": "65ea56ae1992b02a25aa5c51",
      "export_count": 63,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6765,
        "FileHash-MD5": 688,
        "FileHash-SHA1": 422,
        "FileHash-SHA256": 3169,
        "domain": 2171,
        "hostname": 1714,
        "email": 11,
        "CVE": 2,
        "CIDR": 2
      },
      "indicator_count": 14944,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "742 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e576b3cbdf2f86a32acc",
      "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
      "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
      "modified": "2024-02-16T13:04:46.804000",
      "created": "2024-01-17T14:34:30.204000",
      "tags": [
        "whois record",
        "historical ssl",
        "ssl certificate",
        "april",
        "referrer",
        "threat roundup",
        "communicating",
        "whois",
        "rwi dtools",
        "jekyll",
        "metro",
        "skynet",
        "identity theft",
        "parking crew",
        "whois whois",
        "resolutions",
        "october",
        "august",
        "march",
        "june",
        "attack",
        "goldfinder",
        "sibot",
        "hacktool",
        "remote attack",
        "social engineering",
        "read c",
        "get autoit",
        "search",
        "regsetvalueexa",
        "show",
        "entries",
        "regdword",
        "intel",
        "ms windows",
        "showing",
        "autoit",
        "write",
        "worm",
        "copy",
        "unknown",
        "win32",
        "persistence",
        "execution",
        "malware",
        "autorun",
        "redacted for",
        "for privacy",
        "name servers",
        "date",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "pulse submit",
        "url analysis",
        "encrypt",
        "next",
        "sabey",
        "no expiration",
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "iocs",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "malware beacon",
        "useragent",
        "http request",
        "hostile",
        "autoit windows",
        "automation tool",
        "forbidden",
        "algorithm",
        "full name",
        "v3 serial",
        "number",
        "issuer",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "info",
        "first",
        "detections type",
        "name",
        "javascript",
        "pdf community",
        "office open",
        "xml spreadsheet",
        "text",
        "siblings",
        "process32nextw",
        "fjlsedauv",
        "writeconsolea",
        "medium",
        "discovery",
        "high",
        "module load",
        "t1129",
        "united",
        "as63949 linode",
        "mtb jan",
        "passive dns",
        "backdoor",
        "mtb dec",
        "open",
        "body",
        "artro",
        "creation date",
        "servers",
        "urls",
        "record value",
        "expiration date",
        "vt graph",
        "parent referrer",
        "apple private",
        "data collection",
        "hidden privacy",
        "malicious",
        "verified",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "tucows",
        "amazonaes",
        "china telecom",
        "group",
        "cloudflarenet",
        "akamaias",
        "pty ltd",
        "argon data",
        "communication",
        "limited",
        "digitaloceanasn",
        "twitter",
        "dropbox",
        "domainsite",
        "alibaba cloud",
        "computing",
        "beijing",
        "service",
        "ip address",
        "latest",
        "virustotal",
        "unclejohn",
        "us autonomous",
        "system46606",
        "unified layer",
        "urls latest",
        "contacted",
        "historical",
        "subdomains",
        "gootloader",
        "http response",
        "final url",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "binary",
        "sameorigin",
        "scammer",
        "spammer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        },
        {
          "id": "GoldFinder",
          "display_name": "GoldFinder",
          "target": null
        },
        {
          "id": "Sibot - S0589",
          "display_name": "Sibot - S0589",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Verified",
          "display_name": "Verified",
          "target": null
        },
        {
          "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "target": null
        },
        {
          "id": "W32/Expiro.fam",
          "display_name": "W32/Expiro.fam",
          "target": null
        },
        {
          "id": "Kimsuky",
          "display_name": "Kimsuky",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1460",
          "name": "Biometric Spoofing",
          "display_name": "T1460 - Biometric Spoofing"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        }
      ],
      "industries": [
        "Healthcare",
        "Insurance",
        "Finance",
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 515,
        "FileHash-SHA1": 504,
        "FileHash-SHA256": 3557,
        "URL": 5450,
        "domain": 1842,
        "hostname": 2221,
        "CVE": 2,
        "email": 6
      },
      "indicator_count": 14097,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "793 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659331580cd1571f730b8de2",
      "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
      "description": "",
      "modified": "2024-01-31T14:03:30.344000",
      "created": "2024-01-01T21:40:40.242000",
      "tags": [
        "maxads0",
        "kld1063",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls http",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "march",
        "communicating",
        "copy",
        "january",
        "collections",
        "execution",
        "malware",
        "startpage",
        "malicious",
        "ransomware",
        "agent tesla",
        "attack",
        "android",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "windir",
        "path",
        "programfiles",
        "pe32",
        "ms windows",
        "getprocaddress",
        "file type",
        "mitre att",
        "ck id",
        "show technique",
        "win64",
        "date",
        "open",
        "hybrid",
        "cookie",
        "tracking",
        "apple",
        "spyware",
        "malware",
        "tablet",
        "superwebbysearch",
        "hallrender",
        "pegasus",
        "briansabey",
        "aig",
        "abuse",
        "tulach"
      ],
      "references": [
        "findbetterresults.com",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "www2.megawebfind.com                [command_and_control]",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2368,
        "FileHash-SHA256": 4539,
        "hostname": 2892,
        "URL": 9741,
        "FileHash-MD5": 836,
        "FileHash-SHA1": 461,
        "CVE": 1
      },
      "indicator_count": 20838,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659331589faf01b909c1802d",
      "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
      "description": "",
      "modified": "2024-01-31T14:03:30.344000",
      "created": "2024-01-01T21:40:40.413000",
      "tags": [
        "maxads0",
        "kld1063",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls http",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "march",
        "communicating",
        "copy",
        "january",
        "collections",
        "execution",
        "malware",
        "startpage",
        "malicious",
        "ransomware",
        "agent tesla",
        "attack",
        "android",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "windir",
        "path",
        "programfiles",
        "pe32",
        "ms windows",
        "getprocaddress",
        "file type",
        "mitre att",
        "ck id",
        "show technique",
        "win64",
        "date",
        "open",
        "hybrid",
        "cookie",
        "tracking",
        "apple",
        "spyware",
        "malware",
        "tablet",
        "superwebbysearch",
        "hallrender",
        "pegasus",
        "briansabey",
        "aig",
        "abuse",
        "tulach"
      ],
      "references": [
        "findbetterresults.com",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "www2.megawebfind.com                [command_and_control]",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2368,
        "FileHash-SHA256": 4539,
        "hostname": 2892,
        "URL": 9741,
        "FileHash-MD5": 836,
        "FileHash-SHA1": 461,
        "CVE": 1
      },
      "indicator_count": 20838,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657090132deb7fd89b09d555",
      "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns",
      "description": "",
      "modified": "2023-12-06T15:15:31.177000",
      "created": "2023-12-06T15:15:31.177000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 825,
        "domain": 308,
        "URL": 2036,
        "FileHash-SHA256": 2141
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707dbbb0493c03ba107643",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "",
      "modified": "2023-12-06T13:57:15.377000",
      "created": "2023-12-06T13:57:15.377000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1933,
        "domain": 1302,
        "hostname": 805,
        "URL": 3593,
        "FileHash-MD5": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62c035df9d1c1df8ca3fcaea",
      "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns",
      "description": "",
      "modified": "2022-08-01T00:01:42.977000",
      "created": "2022-07-02T12:11:11.592000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 825,
        "FileHash-SHA256": 2141,
        "domain": 308,
        "URL": 2036
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 396,
      "modified_text": "1357 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "61f9b4b2c6c645e9839112b2",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
      "modified": "2022-03-04T00:00:56.902000",
      "created": "2022-02-01T22:31:14.017000",
      "tags": [
        "irst seen",
        "date",
        "file sha256",
        "network related",
        "malicious",
        "found"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3593,
        "FileHash-SHA256": 1933,
        "hostname": 805,
        "domain": 1302,
        "FileHash-MD5": 1,
        "CVE": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 397,
      "modified_text": "1507 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cpc.syndication.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cpc.syndication.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630373.4091747
}