{ "type": "URL", "indicator": "https://crl4.digicert.cn", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://crl4.digicert.cn", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3758846061, "indicator": "https://crl4.digicert.cn", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 20, "pulses": [ { "id": "6570a91b1702fdce6c496a1e", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-12-06T17:02:19.096000", "created": "2023-12-06T17:02:19.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a857cae685fce7f5231e", "name": "Phishing - bam-cell.cell.nr-data.net", "description": "", "modified": "2023-12-06T16:59:03.209000", "created": "2023-12-06T16:59:03.209000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2052, "hostname": 1185, "domain": 460, "URL": 4294, "FileHash-MD5": 10, "FileHash-SHA1": 11 }, "indicator_count": 8013, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a79534c615a8f10f3380", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-12-06T16:55:49.669000", "created": "2023-12-06T16:55:49.669000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2383, "hostname": 1027, "domain": 418, "URL": 2673, "FileHash-MD5": 99, "FileHash-SHA1": 98 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a69b0f11713d9e4d0153", "name": "note.html", "description": "", "modified": "2023-12-06T16:51:39.617000", "created": "2023-12-06T16:51:39.617000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67da62bb520508659a5", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:09.511000", "created": "2023-12-06T16:51:09.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67567202b93ee502ff7", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:00.527000", "created": "2023-12-06T16:51:00.527000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a66d9992e6957b2d1415", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:53.855000", "created": "2023-12-06T16:50:53.855000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a667be1f5233855ae115", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:47.344000", "created": "2023-12-06T16:50:47.344000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a647bca43f24b4a05a97", "name": "note.html", "description": "", "modified": "2023-12-06T16:50:15.239000", "created": "2023-12-06T16:50:15.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f155cf81da97fd82bba62", "name": "Phishing - bam-cell.cell.nr-data.net", "description": "", "modified": "2023-11-09T05:05:01.692000", "created": "2023-10-30T02:30:52.720000", "tags": [ "whois record", "contacted", "ssl certificate", "parent", "historical ssl", "communicating", "siblings", "execution", "resolutions", "collections", "malicious", "generic malware", "hybridanalysis", "fri jan", "mon jan", "date filename", "blacklist fri", "install league", "legends", "fri dec", "sun jan", "allusersprofile", "osuser", "dns requests", "process list", "gamesmetadata", "cisco umbrella", "site", "mon jul", "online thu", "safe site", "malware", "cname", "record type", "ttl value", "algorithm", "full name", "data", "v3 serial", "number", "cus cndigicert", "tls rsa", "sha256", "ca1 odigicert", "inc validity", "relic" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6524f2a85b4dd064922b8c7a", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4294, "FileHash-MD5": 10, "FileHash-SHA1": 11, "FileHash-SHA256": 2052, "domain": 460, "hostname": 1185, "CVE": 1 }, "indicator_count": 8013, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "892 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6524f2a85b4dd064922b8c7a", "name": "Phishing - bam-cell.cell.nr-data.net", "description": "Phishing\nAPT's\nAnonymization\nProxy: FireHOL\ncloud collector-newrelic\nG0032 - Lazarus Group 03/2023\nAS23467 New Relic", "modified": "2023-11-09T05:05:01.692000", "created": "2023-10-10T06:43:52.526000", "tags": [ "whois record", "contacted", "ssl certificate", "parent", "historical ssl", "communicating", "siblings", "execution", "resolutions", "collections", "malicious", "generic malware", "hybridanalysis", "fri jan", "mon jan", "date filename", "blacklist fri", "install league", "legends", "fri dec", "sun jan", "allusersprofile", "osuser", "dns requests", "process list", "gamesmetadata", "cisco umbrella", "site", "mon jul", "online thu", "safe site", "malware", "cname", "record type", "ttl value", "algorithm", "full name", "data", "v3 serial", "number", "cus cndigicert", "tls rsa", "sha256", "ca1 odigicert", "inc validity", "relic" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4294, "FileHash-MD5": 10, "FileHash-SHA1": 11, "FileHash-SHA256": 2052, "domain": 460, "hostname": 1185, "CVE": 1 }, "indicator_count": 8013, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "892 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1344cd54f3a86745a617", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-30T02:21:56.497000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6519c4b76612eda702942ad6", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6519c4b76612eda702942ad6", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "Info Stealer\nET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 789", "modified": "2023-10-31T16:03:29.760000", "created": "2023-10-01T19:12:55.573000", "tags": [ "ssl certificate", "contacted", "whois record", "execution", "bundled", "resolutions", "referrer", "communicating", "network", "historical ssl", "malware", "twitter", "hacktool", "june" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 99, "FileHash-SHA1": 98, "FileHash-SHA256": 2383, "URL": 2673, "domain": 418, "hostname": 1027 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "901 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a60be1d9162d87c5e93", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:09:04.704000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "905 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5d65c4b99d76421b48", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:09:01.502000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "905 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5622544406ab139161", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:53.825000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "905 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5300c7fbb0ebe0aad3", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:51.070000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "905 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6510efe0ef29f9f05b4a7dbc", "name": "note.html", "description": "Malicious", "modified": "2023-10-24T17:02:05.352000", "created": "2023-09-25T02:26:40.583000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "652a97aa526adfee6ea546d1", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-10-24T17:02:05.352000", "created": "2023-10-14T13:29:14.460000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6510efe0ef29f9f05b4a7dbc", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "651349097e0dee296da611fc", "name": "note.html", "description": "", "modified": "2023-10-24T17:02:05.352000", "created": "2023-09-26T21:11:37.530000", "tags": [ "ssl certificate", "whois record", "resolutions", "communicating", "referrer", "apple", "historical ssl", "subdomains", "contacted", "hacktool", "united", "et info", "flag", "bad traffic", "date", "tls handshake", "failure", "misc activity", "external ip", "server", "blacklist", "unknown malware", "threatfox", "ssdeep", "file type", "html internet", "magic html", "ascii text", "trid hypertext", "markup language", "file size", "submission", "analysis", "rules not", "not found", "mitre", "info ids", "found sigma", "found", "files not", "found network", "ja3 mitre", "ta0007 command", "Pattern match: \"bootstrap@4.4.1\"", "Pattern match: \"popper.js@1.16.0\"", "100.0% (.HTML) HyperText Markup Language", "Attempts to identify its external IP address", "0x2b3861", "0x1f264c", "0x1e9f6a", "0x45b62b", "0xac498a", "0x574ac1", "0x4919e6window", "uint8array", "0x4919e6", "html file", "url https", "file name", "tag summary", "mitre1 iocs8", "images embedded", "codes comments0", "category value", "url http", "toolbar", "evasive" ], "references": [ "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "Other online research", "Analysis" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ThreatFox", "display_name": "ThreatFox", "target": null }, { "id": "HEUR:Trojan.BAT", "display_name": "HEUR:Trojan.BAT", "target": null }, { "id": "Vdehu.A", "display_name": "Vdehu.A", "target": null }, { "id": "Trojan.JS.ObfJS", "display_name": "Trojan.JS.ObfJS", "target": null }, { "id": "Dropper.Dapato", "display_name": "Dropper.Dapato", "target": null } ], "attack_ids": [ { "id": "TA0007", "name": "Discovery", "display_name": "TA0007 - Discovery" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "6510efe0ef29f9f05b4a7dbc", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1422, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29, "domain": 481, "hostname": 909, "CVE": 2 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "SHA256 92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1", "Web Tools", "https://www.hybrid-analysis.com/sample/92a5be2893743435b79e94aa64a74233a2240fd790ca948e1cb046da5b4072f1/651057d67b30f0a0990f71ee", "Other online research", "Analysis" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Trojan/banker.androidos.bzd", "Dropper.dapato", "Vdehu.a", "Trojan.js.obfjs", "Heur:trojan.bat", "Threatfox" ], "industries": [], "unique_indicators": 27902 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/digicert.cn", "whois": "http://whois.domaintools.com/digicert.cn", "domain": "digicert.cn", "hostname": "crl4.digicert.cn" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 20, "pulses": [ { "id": "6570a91b1702fdce6c496a1e", "name": "note.html [Pulse by OctoSeek]", "description": "", "modified": "2023-12-06T17:02:19.096000", "created": "2023-12-06T17:02:19.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a857cae685fce7f5231e", "name": "Phishing - bam-cell.cell.nr-data.net", "description": "", "modified": "2023-12-06T16:59:03.209000", "created": "2023-12-06T16:59:03.209000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2052, "hostname": 1185, "domain": 460, "URL": 4294, "FileHash-MD5": 10, "FileHash-SHA1": 11 }, "indicator_count": 8013, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a79534c615a8f10f3380", "name": "Qakbot | Info Stealer | Sourced: Part-RU", "description": "", "modified": "2023-12-06T16:55:49.669000", "created": "2023-12-06T16:55:49.669000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2383, "hostname": 1027, "domain": 418, "URL": 2673, "FileHash-MD5": 99, "FileHash-SHA1": 98 }, "indicator_count": 6698, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a69b0f11713d9e4d0153", "name": "note.html", "description": "", "modified": "2023-12-06T16:51:39.617000", "created": "2023-12-06T16:51:39.617000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67da62bb520508659a5", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:09.511000", "created": "2023-12-06T16:51:09.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67567202b93ee502ff7", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:00.527000", "created": "2023-12-06T16:51:00.527000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a66d9992e6957b2d1415", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:53.855000", "created": "2023-12-06T16:50:53.855000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a667be1f5233855ae115", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:47.344000", "created": "2023-12-06T16:50:47.344000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a647bca43f24b4a05a97", "name": "note.html", "description": "", "modified": "2023-12-06T16:50:15.239000", "created": "2023-12-06T16:50:15.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 909, "CVE": 2, "FileHash-SHA256": 1422, "domain": 481, "URL": 2694, "FileHash-MD5": 31, "FileHash-SHA1": 29 }, "indicator_count": 5568, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f155cf81da97fd82bba62", "name": "Phishing - bam-cell.cell.nr-data.net", "description": "", "modified": "2023-11-09T05:05:01.692000", "created": "2023-10-30T02:30:52.720000", "tags": [ "whois record", "contacted", "ssl certificate", "parent", "historical ssl", "communicating", "siblings", "execution", "resolutions", "collections", "malicious", "generic malware", "hybridanalysis", "fri jan", "mon jan", "date filename", "blacklist fri", "install league", "legends", "fri dec", "sun jan", "allusersprofile", "osuser", "dns requests", "process list", "gamesmetadata", "cisco umbrella", "site", "mon jul", "online thu", "safe site", "malware", "cname", "record type", "ttl value", "algorithm", "full name", "data", "v3 serial", "number", "cus cndigicert", "tls rsa", "sha256", "ca1 odigicert", "inc validity", "relic" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6524f2a85b4dd064922b8c7a", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4294, "FileHash-MD5": 10, "FileHash-SHA1": 11, "FileHash-SHA256": 2052, "domain": 460, "hostname": 1185, "CVE": 1 }, "indicator_count": 8013, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "892 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://crl4.digicert.cn", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://crl4.digicert.cn", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776616156.881739 }