{
  "type": "URL",
  "indicator": "https://ct.captcha-delivery.com/O",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ct.captcha-delivery.com/O",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4008574303,
      "indicator": "https://ct.captcha-delivery.com/O",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "6920c43c3772bb24f26f70cc",
          "name": "Xred_Malware \u2022 Dark Comet \u2022 Darkgate \u2022 Elex \u2022 Glassworm | AutoRun",
          "description": "Attack originates from government contractors/ quasi governmental entities. Criminal Defense and Government contracted Law firms commonly abuse these tactics. Targeting. Found in data of a target. Focused on (1) FILE HASH and (1)  IP address .[referenced] *XRed _Mal\n* EXE Infection | OTX  auto populated - Adversaries may be able to gain access to victim systems using a variety of techniques to evade detection and conceal their actions. and their intentions, as well as using other techniques, to avoid detection.",
          "modified": "2025-12-21T18:01:07.268000",
          "created": "2025-11-21T19:57:48.145000",
          "tags": [
            "dynamicloader",
            "write c",
            "write",
            "high",
            "yara rule",
            "myapp",
            "delphi",
            "worm",
            "win32",
            "error",
            "code",
            "malware",
            "defender",
            "medium",
            "binary file",
            "heavensgate",
            "bochs",
            "dynamic",
            "td td",
            "td tr",
            "united",
            "a td",
            "a domains",
            "dynamic dns",
            "static dns",
            "dd wrt",
            "twitter",
            "trojan",
            "trojandropper",
            "null",
            "enough",
            "simple",
            "click",
            "easy",
            "premium",
            "associated urls",
            "server response",
            "google safe",
            "results nov",
            "avast avg",
            "11.21.2025",
            "11.20.2025",
            "borland delphi",
            "pe32",
            "intel",
            "ms windows",
            "inno setup",
            "win32 exe",
            "pecompact",
            "delphi generic",
            "pe32 compiler",
            "dark comet",
            "dark gate",
            "glassworm",
            "md5 code",
            "data",
            "porkbun llc",
            "windows match",
            "getprocaddress",
            "peb idrdata",
            "match peb",
            "t1547",
            "t1059 t1112",
            "shared modules",
            "t1129",
            "boot",
            "logon autostart",
            "execu",
            "t1134 boot",
            "encoding",
            "capture e1113",
            "file attributes",
            "analysis ob0001",
            "b0001 software",
            "virtual machine",
            "detection b0009",
            "analysis ob0002",
            "ob0003 screen",
            "windows get",
            "check",
            "encode",
            "check internet",
            "wininet set",
            "clear file",
            "enumerate gui",
            "get hostname",
            "get keyboard",
            "set registry",
            "find",
            "capture",
            "url http",
            "consolefoundry",
            "console foundry",
            "foundry",
            "malware catalog tree",
            "autorun keys",
            "modification",
            "alexander karp",
            "peter theil",
            "christoper ahmann",
            "christopher pool",
            "mercedes",
            "apple",
            "palantir",
            "adversarial",
            "adversaries",
            "hostile",
            "quasi",
            "empty hash",
            "denver",
            "mal_xred_backdoor",
            "backdoor",
            "xred",
            "brian sabey",
            "first-send-petikvx",
            "stop",
            "glassworm",
            "elex",
            "darkgate",
            "dark-comet",
            "search",
            "entries",
            "show",
            "yara detections",
            "icmp traffic",
            "rtf file",
            "top source",
            "top destination",
            "format",
            "host",
            "copy",
            "next",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "access att",
            "font",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "sha256",
            "mitre att",
            "title",
            "meta",
            "hybrid",
            "local",
            "path",
            "strings",
            "body",
            "contact",
            "trace",
            "form",
            "bitcoin",
            "core",
            "jeffrey reimer",
            "exe infection",
            "cve",
            "porn"
          ],
          "references": [
            "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
            "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
            "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
            "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
            "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
            "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
            "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
            "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
            "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
            "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
            "Alerts: packer_unknown",
            "Malicious IP Contacted: 69.42.215.252",
            "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
            "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
            "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
            "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
            "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
            "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
            "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
            "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "http://freedns.afraid.org/images/apple.gif",
            "https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "https://www.mumuplayer.com/redirect/customerservice/_wig",
            "https://www.mumuplayer.com/redirect/customerservice/fB)y",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
            "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears",
            "http://consolefoundry.date/one/gate.php",
            "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Emotet-9850453",
              "display_name": "Win.Trojan.Emotet-9850453",
              "target": null
            },
            {
              "id": "Win.Trojan.BlackNetRAT-7838854-0",
              "display_name": "Win.Trojan.BlackNetRAT-7838854-0",
              "target": null
            },
            {
              "id": "Win.Dropper.Nanocore-10021490-0",
              "display_name": "Win.Dropper.Nanocore-10021490-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "Win.Packed.Remcos-10024510-0",
              "display_name": "Win.Packed.Remcos-10024510-0",
              "target": null
            },
            {
              "id": "Code Overlap",
              "display_name": "Code Overlap",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "PSW:Win32/VB.CU",
              "display_name": "PSW:Win32/VB.CU",
              "target": "/malware/PSW:Win32/VB.CU"
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1541",
              "name": "Foreground Persistence",
              "display_name": "T1541 - Foreground Persistence"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1592",
              "name": "Gather Victim Host Information",
              "display_name": "T1592 - Gather Victim Host Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 460,
            "FileHash-SHA1": 437,
            "FileHash-SHA256": 4483,
            "SSLCertFingerprint": 2,
            "URL": 6487,
            "hostname": 1772,
            "domain": 652,
            "CVE": 3,
            "email": 5
          },
          "indicator_count": 14301,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "118 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ff6bf46f5d8662048ca7a1",
          "name": "symcd.com \u2022 Netify.ai",
          "description": "Seen in multiple attacks including CrowdStrike\nincident that was truly a breach found and reported prior to outage. SYCMD..com\nis consistently removed / deleted from pulses.\n\nI have nothing to say. OTX will pulse this let\u2019s see if anything happens..\n#rootkit? #ai #netify #malware #running_webserver #ottowa #elf #agent #malware #known #network_icmp #nolookup_communication\nantivm_generic_disk #dead host\n#dumped_buffer\n#network_cnc_http\n#network_http\n#allocates_rwx\n#av_detect_china_key #m\n[ELF:Agent-VW\\ [Trj]]\nIDS Detections :\n*GoBrut Service Bruter CnC Activity \n*GoBrut Service Bruter CnC Checkin \n*Generic.Go.Bruteforcer CnC Beacon\neval String.fromCharCode String Which May Be #malicious\nYara Detections:\ncompromised_site_redirector_fromcharcode\nfromCharCode | Yara Detections:\nKnownMaliciousObfuscationPattern\n[External IP Address Lookup via api .ip138 .com]\n[Win.Malware.Softcnapp-6932830-0]\nMultiple malware attack.",
          "modified": "2025-11-26T12:00:39.551000",
          "created": "2025-10-27T12:56:20.090000",
          "tags": [
            "present may",
            "present jun",
            "name servers",
            "united",
            "status",
            "present aug",
            "present oct",
            "present jul",
            "present mar",
            "present nov",
            "date",
            "digicert",
            "whois",
            "forums",
            "symantec",
            "comcast",
            "levelblue",
            "open threat",
            "pulse",
            "urls",
            "as13335",
            "info",
            "server",
            "domain status",
            "registrar abuse",
            "registrar",
            "dnssec",
            "domain name",
            "us registrant",
            "email",
            "contact email",
            "host name",
            "handle",
            "rdap database",
            "iana registrar",
            "present sep",
            "canada unknown",
            "moved",
            "ip address",
            "search",
            "title",
            "encrypt",
            "ubuntu",
            "linux x8664",
            "gobrut service",
            "bruter cnc",
            "entries",
            "show",
            "activity",
            "stca",
            "unknown",
            "malware",
            "copy",
            "next",
            "team",
            "script urls",
            "a domains",
            "passive dns",
            "gmt server",
            "content type",
            "body",
            "meta",
            "for privacy",
            "creation date",
            "name redacted",
            "expiration date",
            "servers",
            "hostname add",
            "pulse pulses",
            "13371",
            "qq v",
            "process32nextw",
            "regopenkeyexw",
            "medium",
            "langchinese",
            "get na",
            "rticon",
            "security",
            "high",
            "win32",
            "write",
            "dynamicloader",
            "checks",
            "alerts",
            "bios",
            "dynamic",
            "total",
            "read",
            "delete",
            "name strings",
            "south korea"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia",
            "Canada",
            "Bulgaria",
            "Germany",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3301,
            "email": 9,
            "hostname": 1202,
            "FileHash-SHA256": 1967,
            "domain": 1885,
            "FileHash-MD5": 153,
            "FileHash-SHA1": 151,
            "CVE": 1,
            "SSLCertFingerprint": 82,
            "FilePath": 1
          },
          "indicator_count": 8752,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "143 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68aff672de7f1b65a97c00b1",
          "name": "WarzoneRAT impacts Social Media of users with compromised systems",
          "description": "Injection affects compromised user/s social media accounts including YouTube. Uploads to social media accounts from infected systems divert to adversary\u2019s alt YouTube media center labeled \u2018watch\u2019 instead of YouTube . Remote access observed. Threat actor has full access , cnc , devices, personal information, images, contacts, network, private information including all financial information. \n \nAlt / adversarial Pinterest, Tumblr, YouTube, Facebook, Twitter / X, Instagram , LinkedIn",
          "modified": "2025-09-27T05:00:09.125000",
          "created": "2025-08-28T06:25:54.794000",
          "tags": [
            "d10927",
            "mp41",
            "mp41 connection",
            "r connection",
            "ip address",
            "dynamicloader",
            "write c",
            "globalc",
            "medium",
            "high",
            "write",
            "dll read",
            "trojan",
            "delphi",
            "win32",
            "dialer",
            "tracking",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "spawns",
            "t1590 gather",
            "mitre att",
            "ck matrix",
            "null",
            "click",
            "title",
            "span",
            "meta",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "virgin islands",
            "united",
            "unknown ns",
            "a domains",
            "montserrat",
            "passive dns",
            "ipv4",
            "urls",
            "files",
            "hosting",
            "trojandropper",
            "location virgin",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "item",
            "has description",
            "unknown",
            "explorer",
            "error",
            "powershell",
            "yara rule",
            "windows",
            "t1055",
            "warzonerat",
            "avemaria",
            "virtool",
            "netwire",
            "malware",
            "hostile",
            "autoit",
            "defender",
            "date",
            "bq aug",
            "next associated",
            "ipv4 add",
            "resolved ips",
            "get http",
            "request",
            "win64",
            "khtml",
            "gecko",
            "resolutions",
            "number",
            "ja3s",
            "algorithm",
            "cnr12 cus",
            "cname",
            "accept",
            "port",
            "gmt ifnonematch",
            "screenshots no",
            "involved dns",
            "name response",
            "nxdomain",
            "tcp connections",
            "involved direct",
            "country name",
            "moved",
            "alone email",
            "body doctype",
            "gmt server",
            "content type",
            "service privacy",
            "cve"
          ],
          "references": [
            "http://remote.edikamin.com/",
            "http://flat.trafficadvance.net/AccessMySOL.IVRMobileEntra?D=10927&C=7&MP=41%7C",
            "http://deposito.hostance.net/dialer/",
            "Found in Alt YouTube = Titled  \u2018watch\u2019 | Infected System uploads to  YT",
            "Domains Contacted:Wealthy2019.com.strangled.net \u2022 wealth.warzonedns.com\t \u2022 wealthyme.ddns.net",
            "DYNAMIC_DNS Query to a *.strangled .net Domain\t192.168.122.91\t1.1.1.1 \u2022 DNS Query to DynDNS Domain *.ddns .net",
            "Observed DNS Query to a *.warzonedns .com domain - Likely Hostile\t192.168.122.91\t1.1.1.1",
            "simswap.in (possible Mirai or relationship to)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Diamin.F",
              "display_name": "Trojan:Win32/Diamin.F",
              "target": "/malware/Trojan:Win32/Diamin.F"
            },
            {
              "id": "Dialer",
              "display_name": "Dialer",
              "target": null
            },
            {
              "id": "Win32:CabMod\\ [Drp]",
              "display_name": "Win32:CabMod\\ [Drp]",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Hupigon.gen!A",
              "display_name": "TrojanDropper:Win32/Hupigon.gen!A",
              "target": "/malware/TrojanDropper:Win32/Hupigon.gen!A"
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/Keygen",
              "display_name": "ALF:HeraklezEval:PUA:Win32/Keygen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Startpage.AEA",
              "display_name": "Trojan:Win32/Startpage.AEA",
              "target": "/malware/Trojan:Win32/Startpage.AEA"
            },
            {
              "id": "Banload",
              "display_name": "Banload",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Banload.D",
              "display_name": "TrojanDownloader:Win32/Banload.D",
              "target": "/malware/TrojanDownloader:Win32/Banload.D"
            },
            {
              "id": "Win32:Evo-gen",
              "display_name": "Win32:Evo-gen",
              "target": null
            },
            {
              "id": "!#AddsCopy-ToStartup",
              "display_name": "!#AddsCopy-ToStartup",
              "target": null
            },
            {
              "id": "VirTool:Win32/AutInject.CZ!bit",
              "display_name": "VirTool:Win32/AutInject.CZ!bit",
              "target": "/malware/VirTool:Win32/AutInject.CZ!bit"
            },
            {
              "id": "Win.Trojan.Agent-316098",
              "display_name": "Win.Trojan.Agent-316098",
              "target": null
            },
            {
              "id": "virtool:Win32/Injector.gen!BQ",
              "display_name": "virtool:Win32/Injector.gen!BQ",
              "target": "/malware/virtool:Win32/Injector.gen!BQ"
            },
            {
              "id": "WarzoneRAT - S0670",
              "display_name": "WarzoneRAT - S0670",
              "target": null
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 34,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4194,
            "hostname": 1563,
            "FileHash-SHA256": 2494,
            "domain": 624,
            "FileHash-MD5": 274,
            "FileHash-SHA1": 226,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 9377,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "204 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6854d01e3a8bc3deabb0f2a5",
          "name": "show_user_auctions.php  uid=265889 allegro.pl",
          "description": "https://www.virustotal.com/gui/file/8b33f59bb8a1a16bc5cd762a71d9ea902c7a301da2009517bfb34b0694e17049/relationshttps://www.virustotal.com/gui/ip-address/5.134.210.65/relations\nhttps://www.virustotal.com/gui/url/0d7d3ffc146887baef5a536bd7c7aa32392c2293b212266af89f782fb1c55fbc/details\nhttps://www.virustotal.com/gui/file/85e128a2b18df434c7d09c9360359e74c30711172a9075369c9ca4681dd5d498/details",
          "modified": "2025-09-01T08:05:11.054000",
          "created": "2025-06-20T03:06:06.379000",
          "tags": [
            "vhash",
            "ssdeep",
            "chrome",
            "typ pliku",
            "wpis",
            "web open",
            "font format",
            "truetype",
            "rgba",
            "obraz svg",
            "scalable vector",
            "graphics",
            "function",
            "silent failure",
            "regexp",
            "gethostname",
            "date",
            "saves",
            "return",
            "cmsg",
            "iframe",
            "issafari",
            "null",
            "meta"
          ],
          "references": [
            "http://allegro.pl/show_user_auctions.php?uid=265889",
            "http://5.134.210.65",
            "5.134.210.65",
            "MD5  4234121dd739b4426ef27c2dc31661f2",
            "https://ct.captcha-delivery.com/c.js",
            "http://allegro.pl/uzytkownik/adam_f./sklep",
            "77d947c44255241fc5669daca69bd3906d70d03f0c07b0af8b89c0b2ae1351bc"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 23,
            "URL": 109,
            "domain": 17,
            "hostname": 16
          },
          "indicator_count": 170,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68596260a9ca6c4cc92ca068",
          "name": "Delete service | Affects Threat Research Platforms",
          "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
          "modified": "2025-08-20T04:13:22.641000",
          "created": "2025-06-23T14:19:12.328000",
          "tags": [
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "oc0006",
            "get http",
            "resolved ips",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ip address",
            "country name",
            "cname",
            "port",
            "accept",
            "gmt ifnonematch",
            "url data",
            "icmp",
            "mutexes nothing",
            "data",
            "datacrashpad",
            "edge",
            "created",
            "nothing",
            "html internet",
            "html document",
            "ascii text",
            "gtmkvjvztk dl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2401,
            "URL": 5856,
            "FileHash-SHA256": 3473,
            "domain": 2188,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 120,
            "CVE": 2
          },
          "indicator_count": 14163,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "676493c5607a603f1785a935",
          "name": "https://ginko.garden/pl/contact tel:+48 797 920 339  ip4 77.79.221.180   77.79.221.148",
          "description": "Pasywna replikacja DNS: \n77.79.221.180  \nSugerowany opis:\nPe\u0142ny tekst Ginko.Garden - Nowoczesne dekoracje i pergole metalowe - wedi dweud eu glass - metaloplastyka.\nSugerowane identyfikatory ATT&CK:\nOgr\u00f3d - Nowoczesne dekoracje z metalu do ogrodu - bi\u017cuteria ogrodowa i dekoracje szklane - pergole metalowe - metaloplastyka Meta Tagi s\u0142owa kluczowe Nowoczesne dekoracje z metalu do ogrodu - pergole metalowe - Ginko.\n77.79.221.148  \n46.41.159.227  \n46.41.159.177",
          "modified": "2025-07-28T11:51:42.400000",
          "created": "2024-12-19T21:44:37.537000",
          "tags": [
            "copyright",
            "customevent",
            "typeof e",
            "boomerang",
            "typeof t",
            "macintosh",
            "os x",
            "post",
            "typeof",
            "iframe",
            "date",
            "nazwa rekordu",
            "aaaaa",
            "na wniosek",
            "bezpieczestwo",
            "serwer",
            "przerwa",
            "informacja o",
            "prace",
            "nazwa",
            "hasze",
            "adresy url",
            "nazwa http",
            "configoverride",
            "continuity",
            "pageparam s",
            "iframedelay",
            "autoxhr",
            "historia",
            "nazwa https",
            "uytkownik",
            "zenbox",
            "komunikacja",
            "pliki",
            "rozmiar",
            "kb data",
            "wykrycia nie",
            "mitre",
            "ids nie",
            "sigmy nie",
            "submission",
            "sha256",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "unicode text",
            "utf8 text",
            "trid hypertext",
            "markup language"
          ],
          "references": [
            "https://s.go-mpulse.net/boomerang/XZ4AH-ABKPW-SQPBC-CYWES-BCG6V",
            "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
            "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1334,
            "hostname": 454,
            "domain": 346,
            "IPv6": 2,
            "IPv4": 36,
            "FileHash-SHA256": 1499,
            "FileHash-MD5": 92,
            "FileHash-SHA1": 74,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 3839,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "264 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6841039ff61dea1fcdcc53c1",
          "name": "Malicious WiFi Internet network | trojan.morstar/bundler",
          "description": "WiFi / Internet provider \nConcerning- targeting?\nhttp://www.dead-speak.com/PsychicMediums.htm | \nhttp://www.dead-speak.com/PsychicMediums.html |\nwww.dead-speak.com || https://pin.it/ | \nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian |\npin.it |",
          "modified": "2025-07-05T02:01:54.546000",
          "created": "2025-06-05T02:40:31.779000",
          "tags": [
            "win32 exe",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "get http",
            "post http",
            "dns resolutions",
            "resolved ips",
            "symantec time",
            "stamping",
            "from",
            "algorithm",
            "thumbprint",
            "thumbprint md5",
            "signer",
            "g2 issuer",
            "ca valid",
            "serial number",
            "time stamping",
            "g4 issuer",
            "g2 valid",
            "usage ff",
            "code signing",
            "issuer certum",
            "certum code",
            "signing ca",
            "trusted network",
            "e5 e5",
            "d4 portable",
            "sha256",
            "overlay",
            "defense evasion",
            "access ta0006",
            "command",
            "control ta0011",
            "catalog tree",
            "anti",
            "ob0001",
            "analysis ob0002",
            "control ob0004",
            "ob0007 impact",
            "ob0012 file",
            "system oc0001",
            "memory oc0002",
            "data oc0004"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "FileHash-MD5": 156,
            "FileHash-SHA1": 139,
            "FileHash-SHA256": 3313,
            "URL": 1223,
            "domain": 186,
            "hostname": 313
          },
          "indicator_count": 5332,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "288 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682fb4c264a51bf88115b6d2",
          "name": "allegro.pl/uzytkownik/adam_f.  vgt.pl , sanselo.pl, bipadorno.pl",
          "description": "https://www.virustotal.com/gui/file/db7d7637c8fa698616282e31b1541082751601b27a3e71ad18caf138451c346a/relations\nhttps://allegro.pl/uzytkownik/adam_f./ogrod-1532",
          "modified": "2025-06-22T07:00:28.087000",
          "created": "2025-05-22T23:35:30.122000",
          "tags": [
            "whasz"
          ],
          "references": [
            "https://allegro.pl/uzytkownik/adam_f./ogrod-1532",
            "https://allegro.pl/uzytkownik/adam_f.?srsltid=AfmBOoqX6vYV4qDgCzkkJhmipZLDrarI5MuggstojVsohtfiSM_s0jdd&dd_referrer=https://www.google.com/"
          ],
          "public": 1,
          "adversary": "fac1ec40eea5a4fc05f17e019328e287.wirus",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 163,
            "FileHash-SHA1": 162,
            "FileHash-SHA256": 1706,
            "domain": 596,
            "hostname": 1278,
            "URL": 6163
          },
          "indicator_count": 10068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "301 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "674afb83c67ff4443e9f953a",
          "name": "PolymodXT.exe",
          "description": "",
          "modified": "2025-05-14T21:18:19.590000",
          "created": "2024-11-30T11:48:19.052000",
          "tags": [
            "file",
            "flagi",
            "process sha256",
            "process disc",
            "pathway z",
            "identyfikator",
            "zawiera moliwo",
            "klucz",
            "zawiera",
            "wybierz",
            "nie mona",
            "przechowywanie",
            "haso",
            "obiekt",
            "cig uid",
            "zilla",
            "enumerate",
            "defender",
            "pragma",
            "security",
            "license v2",
            "ff ff",
            "fc e8",
            "f8 ff",
            "fc ff",
            "c9 c3",
            "e4 f8",
            "cc cc",
            "fc eb",
            "confuserex mod",
            "aspirecrypt",
            "detects",
            "reactor",
            "beds protector",
            "ps2exe",
            "bsjb",
            "boxedapp",
            "cyaxsharp",
            "cyaxpng",
            "smartassembly",
            "koivm",
            "confuserex",
            "obfuscator",
            "aspack",
            "titan",
            "enigma",
            "vmprotect",
            "strings",
            "rlpack",
            "antiem",
            "antisb",
            "themida",
            "loader",
            "sality",
            "dnguard",
            "windows nt",
            "gecko",
            "khtml",
            "msie",
            "wow64",
            "stealer",
            "win64",
            "error",
            "userprofile",
            "keylogger",
            "encrypt",
            "antivm",
            "span",
            "main",
            "grabber",
            "hello",
            "android",
            "dcrat",
            "win32",
            "kill",
            "revengerat",
            "sandbox",
            "pass",
            "chat",
            "first",
            "asyncrat",
            "crypto",
            "injector",
            "dropper",
            "infostealer",
            "lockfile",
            "worldwind",
            "stealerium",
            "toxiceye",
            "avemaria",
            "fast",
            "persistence",
            "trojan",
            "restart",
            "snakekeylogger",
            "snake",
            "accept",
            "cookie",
            "code",
            "killproc",
            "lazarus",
            "dearcry",
            "njrat",
            "cyrus",
            "powershell",
            "info",
            "body",
            "floodfix",
            "downloader",
            "ransomware",
            "core",
            "loki",
            "fpspy",
            "klogexe",
            "firebird",
            "patch",
            "explorer",
            "avkiller",
            "masslogger",
            "baldr",
            "modi rat",
            "helpme",
            "osno",
            "import",
            "keylog",
            "screencapture",
            "ransom",
            "crypted",
            "silent",
            "xorddos",
            "stormkitty",
            "ordinal",
            "locker",
            "hyperbro",
            "lamepyre",
            "parallaxrat",
            "null",
            "shurk steal",
            "arkeistealer",
            "strongpity",
            "desktop",
            "myagent",
            "bypass",
            "fatduke",
            "miniduke",
            "polyglotduke",
            "guildma",
            "spyeye",
            "corebot",
            "killmbr",
            "ooops",
            "lcpdot",
            "torisma",
            "codec",
            "prometheus",
            "spook",
            "crypt",
            "logger",
            "zegost",
            "poshkeylogger",
            "systembc",
            "hdlocker",
            "cryptolocker",
            "fivehands",
            "kitty",
            "goldmax",
            "rents",
            "maurigo",
            "done",
            "hidewindow",
            "bokbot",
            "bladabindi",
            "darktrack",
            "darksky",
            "alien",
            "karkoff",
            "inject",
            "windigo",
            "rest",
            "softcnapp",
            "elysiumstealer",
            "leivion",
            "banload",
            "ultrareach",
            "ultrasurf",
            "buterat",
            "tools",
            "beasty",
            "shut",
            "gravityrat",
            "fatalrat",
            "discord",
            "deadwood",
            "turian",
            "markirat",
            "mark",
            "klingonrat",
            "path",
            "reverserat",
            "grab",
            "meta",
            "voidcrypt",
            "darkvnc",
            "ryzerlo",
            "hiddentear",
            "boxcaon",
            "stream",
            "crimsonrat",
            "delfi",
            "infinity",
            "stealthworker",
            "gasket",
            "spoolss",
            "lu0bot",
            "target",
            "attack",
            "cobaltstrike",
            "bits",
            "chaos",
            "bitcoin",
            "wiper",
            "delphi",
            "slackbot",
            "neshta",
            "belarus",
            "apanas",
            "runner",
            "darkcomet",
            "macoute",
            "iframe",
            "vanillarat",
            "sectoprat",
            "melt",
            "tomiris",
            "apostle",
            "blackbyte",
            "kutaki",
            "override",
            "windealer",
            "mkdir",
            "brbbot",
            "config",
            "babylon rat",
            "spynet",
            "bazarloader",
            "clipper",
            "banker",
            "gh0st",
            "piratestealer",
            "witch",
            "killme",
            "vulturi",
            "tofsee",
            "slow",
            "owowa",
            "flagpro",
            "write",
            "dazzlespy",
            "decryptor",
            "bandit stealer",
            "bandit",
            "darkeye",
            "recordbreaker",
            "truebot",
            "svchost",
            "clipbanker",
            "service",
            "arrowrat",
            "ducktail",
            "confuser",
            "gobrat",
            "modiloader",
            "chilelocker",
            "noclose",
            "strelastealer",
            "comfoo",
            "babar",
            "blankgrabber",
            "solarmarker",
            "darkgate",
            "stub",
            "banned",
            "globeimposter",
            "rhysida",
            "janelarat",
            "kraken",
            "recon",
            "quiterat",
            "venomrat",
            "venom rat",
            "sapphirestealer",
            "ntospy",
            "raccoon",
            "shifu",
            "mediapi",
            "poolrat",
            "cicada3301",
            "remoteexec"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 528,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 414,
            "FileHash-SHA1": 410,
            "FileHash-SHA256": 1940,
            "URL": 171,
            "hostname": 56,
            "domain": 134,
            "YARA": 759,
            "email": 4
          },
          "indicator_count": 3888,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
        "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
        "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
        "http://allegro.pl/uzytkownik/adam_f./sklep",
        "http://freedns.afraid.org/images/apple.gif",
        "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
        "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
        "Found in Alt YouTube = Titled  \u2018watch\u2019 | Infected System uploads to  YT",
        "https://www.mumuplayer.com/redirect/customerservice/_wig",
        "http://consolefoundry.date/one/gate.php",
        "https://ct.captcha-delivery.com/c.js",
        "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
        "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
        "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
        "Alerts: packer_unknown",
        "5.134.210.65",
        "DYNAMIC_DNS Query to a *.strangled .net Domain\t192.168.122.91\t1.1.1.1 \u2022 DNS Query to DynDNS Domain *.ddns .net",
        "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
        "simswap.in (possible Mirai or relationship to)",
        "https://allegro.pl/uzytkownik/adam_f./ogrod-1532",
        "http://deposito.hostance.net/dialer/",
        "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
        "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354",
        "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
        "77d947c44255241fc5669daca69bd3906d70d03f0c07b0af8b89c0b2ae1351bc",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
        "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4",
        "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
        "https://allegro.pl/uzytkownik/adam_f.?srsltid=AfmBOoqX6vYV4qDgCzkkJhmipZLDrarI5MuggstojVsohtfiSM_s0jdd&dd_referrer=https://www.google.com/",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Malicious IP Contacted: 69.42.215.252",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://remote.edikamin.com/",
        "https://www.mumuplayer.com/redirect/customerservice/fB)y",
        "MD5  4234121dd739b4426ef27c2dc31661f2",
        "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Domains Contacted:Wealthy2019.com.strangled.net \u2022 wealth.warzonedns.com\t \u2022 wealthyme.ddns.net",
        "Observed DNS Query to a *.warzonedns .com domain - Likely Hostile\t192.168.122.91\t1.1.1.1",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
        "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
        "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
        "http://allegro.pl/show_user_auctions.php?uid=265889",
        "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
        "http://flat.trafficadvance.net/AccessMySOL.IVRMobileEntra?D=10927&C=7&MP=41%7C",
        "http://5.134.210.65",
        "https://s.go-mpulse.net/boomerang/XZ4AH-ABKPW-SQPBC-CYWES-BCG6V"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "fac1ec40eea5a4fc05f17e019328e287.wirus"
          ],
          "malware_families": [
            "Dialer",
            "Win.packed.remcos-10024510-0",
            "Trojandropper:win32/hupigon.gen!a",
            "Win.trojan.emotet-9850453",
            "Virtool:win32/injector.gen!bq",
            "Worm:win32/autorun!atmn",
            "Win.trojan.blacknetrat-7838854-0",
            "Other malware",
            "Trojan:win32/startpage.aea",
            "Warzonerat - s0670",
            "Banload",
            "Psw:win32/vb.cu",
            "Win.dropper.nanocore-10021490-0",
            "Win32:evo-gen",
            "Cve-2023-22518",
            "Win.trojan.agent-316098",
            "!#addscopy-tostartup",
            "Alf:heraklezeval:pua:win32/keygen",
            "Trojandownloader:win32/banload.d",
            "Code overlap",
            "Virtool:win32/autinject.cz!bit",
            "Trojan:win32/diamin.f",
            "Win32:cabmod\\ [drp]"
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media"
          ],
          "unique_indicators": 67443
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/captcha-delivery.com",
    "whois": "http://whois.domaintools.com/captcha-delivery.com",
    "domain": "captcha-delivery.com",
    "hostname": "ct.captcha-delivery.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "6920c43c3772bb24f26f70cc",
      "name": "Xred_Malware \u2022 Dark Comet \u2022 Darkgate \u2022 Elex \u2022 Glassworm | AutoRun",
      "description": "Attack originates from government contractors/ quasi governmental entities. Criminal Defense and Government contracted Law firms commonly abuse these tactics. Targeting. Found in data of a target. Focused on (1) FILE HASH and (1)  IP address .[referenced] *XRed _Mal\n* EXE Infection | OTX  auto populated - Adversaries may be able to gain access to victim systems using a variety of techniques to evade detection and conceal their actions. and their intentions, as well as using other techniques, to avoid detection.",
      "modified": "2025-12-21T18:01:07.268000",
      "created": "2025-11-21T19:57:48.145000",
      "tags": [
        "dynamicloader",
        "write c",
        "write",
        "high",
        "yara rule",
        "myapp",
        "delphi",
        "worm",
        "win32",
        "error",
        "code",
        "malware",
        "defender",
        "medium",
        "binary file",
        "heavensgate",
        "bochs",
        "dynamic",
        "td td",
        "td tr",
        "united",
        "a td",
        "a domains",
        "dynamic dns",
        "static dns",
        "dd wrt",
        "twitter",
        "trojan",
        "trojandropper",
        "null",
        "enough",
        "simple",
        "click",
        "easy",
        "premium",
        "associated urls",
        "server response",
        "google safe",
        "results nov",
        "avast avg",
        "11.21.2025",
        "11.20.2025",
        "borland delphi",
        "pe32",
        "intel",
        "ms windows",
        "inno setup",
        "win32 exe",
        "pecompact",
        "delphi generic",
        "pe32 compiler",
        "dark comet",
        "dark gate",
        "glassworm",
        "md5 code",
        "data",
        "porkbun llc",
        "windows match",
        "getprocaddress",
        "peb idrdata",
        "match peb",
        "t1547",
        "t1059 t1112",
        "shared modules",
        "t1129",
        "boot",
        "logon autostart",
        "execu",
        "t1134 boot",
        "encoding",
        "capture e1113",
        "file attributes",
        "analysis ob0001",
        "b0001 software",
        "virtual machine",
        "detection b0009",
        "analysis ob0002",
        "ob0003 screen",
        "windows get",
        "check",
        "encode",
        "check internet",
        "wininet set",
        "clear file",
        "enumerate gui",
        "get hostname",
        "get keyboard",
        "set registry",
        "find",
        "capture",
        "url http",
        "consolefoundry",
        "console foundry",
        "foundry",
        "malware catalog tree",
        "autorun keys",
        "modification",
        "alexander karp",
        "peter theil",
        "christoper ahmann",
        "christopher pool",
        "mercedes",
        "apple",
        "palantir",
        "adversarial",
        "adversaries",
        "hostile",
        "quasi",
        "empty hash",
        "denver",
        "mal_xred_backdoor",
        "backdoor",
        "xred",
        "brian sabey",
        "first-send-petikvx",
        "stop",
        "glassworm",
        "elex",
        "darkgate",
        "dark-comet",
        "search",
        "entries",
        "show",
        "yara detections",
        "icmp traffic",
        "rtf file",
        "top source",
        "top destination",
        "format",
        "host",
        "copy",
        "next",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "access att",
        "font",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "sha256",
        "mitre att",
        "title",
        "meta",
        "hybrid",
        "local",
        "path",
        "strings",
        "body",
        "contact",
        "trace",
        "form",
        "bitcoin",
        "core",
        "jeffrey reimer",
        "exe infection",
        "cve",
        "porn"
      ],
      "references": [
        "FILEHASH-SHA256 d0ce79b3e0f4798423871dd66c14172b1a0eac34131c1b92d210a7b5c31a8aa0",
        "Name 2025-11-19_b627882129bf281be5a3df318fff678b_dark-comet_darkgate_elex_glassworm_stop",
        "Antivirus Detection: Worm:Win32/AutoRun!atmn [Win.Trojan.Emotet relationship]",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara : Zeppelin_30 ,  compromised_site_redirector_fromcharcode ,",
        "Yara : BobSoft Mini Delphi -> BoB / BobSoft , Delphi",
        "Alerts : suspicious_iocontrol_codes process_creation_suspicious_location network_dyndns",
        "Alerts: multiple_useragents persistence_autorun binary_yara procmem_yara suricata_alert",
        "Alerts: antivm_bochs_keys antivm_generic_disk enumerates_physical_drives  antisandbox_sleep",
        "Alerts: physical_drive_access mouse_movement_detect dynamic_function_loading",
        "Alerts: http_request resumethread_remote_process antianalysis_tls_section network_httpn",
        "Alerts: packer_unknown",
        "Malicious IP Contacted: 69.42.215.252",
        "Abused Domains Contacted: xred.mooo.com freedns.afraid.org",
        "IP 69.42.215.252: http://nginx.com/ \u2022nginx.com\t\u2022 http://nginx.org/ \u2022 nginx.org \u2022 afraid.org \u2022 afraid.org",
        "IP 69.42.215.252: nginx.com\u2022 vb.cu \u2022 vb.il \u2022 yourdomain.com \u2022 yourdomain.com",
        "IP 69.42.215.252: theirname.yourdomain.com \u2022 www.freebsd.org freebsd.org \u2022 your.domain.com",
        "Windows Match api: GetProcAddress fs access  *access PEB Idr_data Match PEB access fs access",
        "consolefoundry.date \u2022 http://consolefoundry.date \u2022 http://consolefoundry",
        "Matches rule Wow6432Node CurrentVersion Autorun Keys Modification -  Credits (split) below",
        "by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "http://freedns.afraid.org/images/apple.gif",
        "https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "https://www.mumuplayer.com/redirect/customerservice/_wig",
        "https://www.mumuplayer.com/redirect/customerservice/fB)y",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ \u2022 http://www.anyxxxtube/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t| Truth",
        "https://www.semena.cz/exoticke-okrasne/78-plumerie-havajska-kvetina-semena-3-ks.html",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears",
        "http://consolefoundry.date/one/gate.php",
        "https://hybrid-analysis.com/sample/ba5890ad431b894b0dfd6c9d3f3d6cbd7fedae1bd5a51483f54b22ba0209e3b8/6920be8a548209db740dd354"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Emotet-9850453",
          "display_name": "Win.Trojan.Emotet-9850453",
          "target": null
        },
        {
          "id": "Win.Trojan.BlackNetRAT-7838854-0",
          "display_name": "Win.Trojan.BlackNetRAT-7838854-0",
          "target": null
        },
        {
          "id": "Win.Dropper.Nanocore-10021490-0",
          "display_name": "Win.Dropper.Nanocore-10021490-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "Win.Packed.Remcos-10024510-0",
          "display_name": "Win.Packed.Remcos-10024510-0",
          "target": null
        },
        {
          "id": "Code Overlap",
          "display_name": "Code Overlap",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "PSW:Win32/VB.CU",
          "display_name": "PSW:Win32/VB.CU",
          "target": "/malware/PSW:Win32/VB.CU"
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1541",
          "name": "Foreground Persistence",
          "display_name": "T1541 - Foreground Persistence"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1049",
          "name": "System Network Connections Discovery",
          "display_name": "T1049 - System Network Connections Discovery"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1592",
          "name": "Gather Victim Host Information",
          "display_name": "T1592 - Gather Victim Host Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 460,
        "FileHash-SHA1": 437,
        "FileHash-SHA256": 4483,
        "SSLCertFingerprint": 2,
        "URL": 6487,
        "hostname": 1772,
        "domain": 652,
        "CVE": 3,
        "email": 5
      },
      "indicator_count": 14301,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "118 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ff6bf46f5d8662048ca7a1",
      "name": "symcd.com \u2022 Netify.ai",
      "description": "Seen in multiple attacks including CrowdStrike\nincident that was truly a breach found and reported prior to outage. SYCMD..com\nis consistently removed / deleted from pulses.\n\nI have nothing to say. OTX will pulse this let\u2019s see if anything happens..\n#rootkit? #ai #netify #malware #running_webserver #ottowa #elf #agent #malware #known #network_icmp #nolookup_communication\nantivm_generic_disk #dead host\n#dumped_buffer\n#network_cnc_http\n#network_http\n#allocates_rwx\n#av_detect_china_key #m\n[ELF:Agent-VW\\ [Trj]]\nIDS Detections :\n*GoBrut Service Bruter CnC Activity \n*GoBrut Service Bruter CnC Checkin \n*Generic.Go.Bruteforcer CnC Beacon\neval String.fromCharCode String Which May Be #malicious\nYara Detections:\ncompromised_site_redirector_fromcharcode\nfromCharCode | Yara Detections:\nKnownMaliciousObfuscationPattern\n[External IP Address Lookup via api .ip138 .com]\n[Win.Malware.Softcnapp-6932830-0]\nMultiple malware attack.",
      "modified": "2025-11-26T12:00:39.551000",
      "created": "2025-10-27T12:56:20.090000",
      "tags": [
        "present may",
        "present jun",
        "name servers",
        "united",
        "status",
        "present aug",
        "present oct",
        "present jul",
        "present mar",
        "present nov",
        "date",
        "digicert",
        "whois",
        "forums",
        "symantec",
        "comcast",
        "levelblue",
        "open threat",
        "pulse",
        "urls",
        "as13335",
        "info",
        "server",
        "domain status",
        "registrar abuse",
        "registrar",
        "dnssec",
        "domain name",
        "us registrant",
        "email",
        "contact email",
        "host name",
        "handle",
        "rdap database",
        "iana registrar",
        "present sep",
        "canada unknown",
        "moved",
        "ip address",
        "search",
        "title",
        "encrypt",
        "ubuntu",
        "linux x8664",
        "gobrut service",
        "bruter cnc",
        "entries",
        "show",
        "activity",
        "stca",
        "unknown",
        "malware",
        "copy",
        "next",
        "team",
        "script urls",
        "a domains",
        "passive dns",
        "gmt server",
        "content type",
        "body",
        "meta",
        "for privacy",
        "creation date",
        "name redacted",
        "expiration date",
        "servers",
        "hostname add",
        "pulse pulses",
        "13371",
        "qq v",
        "process32nextw",
        "regopenkeyexw",
        "medium",
        "langchinese",
        "get na",
        "rticon",
        "security",
        "high",
        "win32",
        "write",
        "dynamicloader",
        "checks",
        "alerts",
        "bios",
        "dynamic",
        "total",
        "read",
        "delete",
        "name strings",
        "south korea"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia",
        "Canada",
        "Bulgaria",
        "Germany",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3301,
        "email": 9,
        "hostname": 1202,
        "FileHash-SHA256": 1967,
        "domain": 1885,
        "FileHash-MD5": 153,
        "FileHash-SHA1": 151,
        "CVE": 1,
        "SSLCertFingerprint": 82,
        "FilePath": 1
      },
      "indicator_count": 8752,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "143 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68aff672de7f1b65a97c00b1",
      "name": "WarzoneRAT impacts Social Media of users with compromised systems",
      "description": "Injection affects compromised user/s social media accounts including YouTube. Uploads to social media accounts from infected systems divert to adversary\u2019s alt YouTube media center labeled \u2018watch\u2019 instead of YouTube . Remote access observed. Threat actor has full access , cnc , devices, personal information, images, contacts, network, private information including all financial information. \n \nAlt / adversarial Pinterest, Tumblr, YouTube, Facebook, Twitter / X, Instagram , LinkedIn",
      "modified": "2025-09-27T05:00:09.125000",
      "created": "2025-08-28T06:25:54.794000",
      "tags": [
        "d10927",
        "mp41",
        "mp41 connection",
        "r connection",
        "ip address",
        "dynamicloader",
        "write c",
        "globalc",
        "medium",
        "high",
        "write",
        "dll read",
        "trojan",
        "delphi",
        "win32",
        "dialer",
        "tracking",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "spawns",
        "t1590 gather",
        "mitre att",
        "ck matrix",
        "null",
        "click",
        "title",
        "span",
        "meta",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "virgin islands",
        "united",
        "unknown ns",
        "a domains",
        "montserrat",
        "passive dns",
        "ipv4",
        "urls",
        "files",
        "hosting",
        "trojandropper",
        "location virgin",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "item",
        "has description",
        "unknown",
        "explorer",
        "error",
        "powershell",
        "yara rule",
        "windows",
        "t1055",
        "warzonerat",
        "avemaria",
        "virtool",
        "netwire",
        "malware",
        "hostile",
        "autoit",
        "defender",
        "date",
        "bq aug",
        "next associated",
        "ipv4 add",
        "resolved ips",
        "get http",
        "request",
        "win64",
        "khtml",
        "gecko",
        "resolutions",
        "number",
        "ja3s",
        "algorithm",
        "cnr12 cus",
        "cname",
        "accept",
        "port",
        "gmt ifnonematch",
        "screenshots no",
        "involved dns",
        "name response",
        "nxdomain",
        "tcp connections",
        "involved direct",
        "country name",
        "moved",
        "alone email",
        "body doctype",
        "gmt server",
        "content type",
        "service privacy",
        "cve"
      ],
      "references": [
        "http://remote.edikamin.com/",
        "http://flat.trafficadvance.net/AccessMySOL.IVRMobileEntra?D=10927&C=7&MP=41%7C",
        "http://deposito.hostance.net/dialer/",
        "Found in Alt YouTube = Titled  \u2018watch\u2019 | Infected System uploads to  YT",
        "Domains Contacted:Wealthy2019.com.strangled.net \u2022 wealth.warzonedns.com\t \u2022 wealthyme.ddns.net",
        "DYNAMIC_DNS Query to a *.strangled .net Domain\t192.168.122.91\t1.1.1.1 \u2022 DNS Query to DynDNS Domain *.ddns .net",
        "Observed DNS Query to a *.warzonedns .com domain - Likely Hostile\t192.168.122.91\t1.1.1.1",
        "simswap.in (possible Mirai or relationship to)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Diamin.F",
          "display_name": "Trojan:Win32/Diamin.F",
          "target": "/malware/Trojan:Win32/Diamin.F"
        },
        {
          "id": "Dialer",
          "display_name": "Dialer",
          "target": null
        },
        {
          "id": "Win32:CabMod\\ [Drp]",
          "display_name": "Win32:CabMod\\ [Drp]",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Hupigon.gen!A",
          "display_name": "TrojanDropper:Win32/Hupigon.gen!A",
          "target": "/malware/TrojanDropper:Win32/Hupigon.gen!A"
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/Keygen",
          "display_name": "ALF:HeraklezEval:PUA:Win32/Keygen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Startpage.AEA",
          "display_name": "Trojan:Win32/Startpage.AEA",
          "target": "/malware/Trojan:Win32/Startpage.AEA"
        },
        {
          "id": "Banload",
          "display_name": "Banload",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Banload.D",
          "display_name": "TrojanDownloader:Win32/Banload.D",
          "target": "/malware/TrojanDownloader:Win32/Banload.D"
        },
        {
          "id": "Win32:Evo-gen",
          "display_name": "Win32:Evo-gen",
          "target": null
        },
        {
          "id": "!#AddsCopy-ToStartup",
          "display_name": "!#AddsCopy-ToStartup",
          "target": null
        },
        {
          "id": "VirTool:Win32/AutInject.CZ!bit",
          "display_name": "VirTool:Win32/AutInject.CZ!bit",
          "target": "/malware/VirTool:Win32/AutInject.CZ!bit"
        },
        {
          "id": "Win.Trojan.Agent-316098",
          "display_name": "Win.Trojan.Agent-316098",
          "target": null
        },
        {
          "id": "virtool:Win32/Injector.gen!BQ",
          "display_name": "virtool:Win32/Injector.gen!BQ",
          "target": "/malware/virtool:Win32/Injector.gen!BQ"
        },
        {
          "id": "WarzoneRAT - S0670",
          "display_name": "WarzoneRAT - S0670",
          "target": null
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 34,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4194,
        "hostname": 1563,
        "FileHash-SHA256": 2494,
        "domain": 624,
        "FileHash-MD5": 274,
        "FileHash-SHA1": 226,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 9377,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "204 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6854d01e3a8bc3deabb0f2a5",
      "name": "show_user_auctions.php  uid=265889 allegro.pl",
      "description": "https://www.virustotal.com/gui/file/8b33f59bb8a1a16bc5cd762a71d9ea902c7a301da2009517bfb34b0694e17049/relationshttps://www.virustotal.com/gui/ip-address/5.134.210.65/relations\nhttps://www.virustotal.com/gui/url/0d7d3ffc146887baef5a536bd7c7aa32392c2293b212266af89f782fb1c55fbc/details\nhttps://www.virustotal.com/gui/file/85e128a2b18df434c7d09c9360359e74c30711172a9075369c9ca4681dd5d498/details",
      "modified": "2025-09-01T08:05:11.054000",
      "created": "2025-06-20T03:06:06.379000",
      "tags": [
        "vhash",
        "ssdeep",
        "chrome",
        "typ pliku",
        "wpis",
        "web open",
        "font format",
        "truetype",
        "rgba",
        "obraz svg",
        "scalable vector",
        "graphics",
        "function",
        "silent failure",
        "regexp",
        "gethostname",
        "date",
        "saves",
        "return",
        "cmsg",
        "iframe",
        "issafari",
        "null",
        "meta"
      ],
      "references": [
        "http://allegro.pl/show_user_auctions.php?uid=265889",
        "http://5.134.210.65",
        "5.134.210.65",
        "MD5  4234121dd739b4426ef27c2dc31661f2",
        "https://ct.captcha-delivery.com/c.js",
        "http://allegro.pl/uzytkownik/adam_f./sklep",
        "77d947c44255241fc5669daca69bd3906d70d03f0c07b0af8b89c0b2ae1351bc"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 23,
        "URL": 109,
        "domain": 17,
        "hostname": 16
      },
      "indicator_count": 170,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68596260a9ca6c4cc92ca068",
      "name": "Delete service | Affects Threat Research Platforms",
      "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
      "modified": "2025-08-20T04:13:22.641000",
      "created": "2025-06-23T14:19:12.328000",
      "tags": [
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "oc0006",
        "get http",
        "resolved ips",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ip address",
        "country name",
        "cname",
        "port",
        "accept",
        "gmt ifnonematch",
        "url data",
        "icmp",
        "mutexes nothing",
        "data",
        "datacrashpad",
        "edge",
        "created",
        "nothing",
        "html internet",
        "html document",
        "ascii text",
        "gtmkvjvztk dl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2401,
        "URL": 5856,
        "FileHash-SHA256": 3473,
        "domain": 2188,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 120,
        "CVE": 2
      },
      "indicator_count": 14163,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "676493c5607a603f1785a935",
      "name": "https://ginko.garden/pl/contact tel:+48 797 920 339  ip4 77.79.221.180   77.79.221.148",
      "description": "Pasywna replikacja DNS: \n77.79.221.180  \nSugerowany opis:\nPe\u0142ny tekst Ginko.Garden - Nowoczesne dekoracje i pergole metalowe - wedi dweud eu glass - metaloplastyka.\nSugerowane identyfikatory ATT&CK:\nOgr\u00f3d - Nowoczesne dekoracje z metalu do ogrodu - bi\u017cuteria ogrodowa i dekoracje szklane - pergole metalowe - metaloplastyka Meta Tagi s\u0142owa kluczowe Nowoczesne dekoracje z metalu do ogrodu - pergole metalowe - Ginko.\n77.79.221.148  \n46.41.159.227  \n46.41.159.177",
      "modified": "2025-07-28T11:51:42.400000",
      "created": "2024-12-19T21:44:37.537000",
      "tags": [
        "copyright",
        "customevent",
        "typeof e",
        "boomerang",
        "typeof t",
        "macintosh",
        "os x",
        "post",
        "typeof",
        "iframe",
        "date",
        "nazwa rekordu",
        "aaaaa",
        "na wniosek",
        "bezpieczestwo",
        "serwer",
        "przerwa",
        "informacja o",
        "prace",
        "nazwa",
        "hasze",
        "adresy url",
        "nazwa http",
        "configoverride",
        "continuity",
        "pageparam s",
        "iframedelay",
        "autoxhr",
        "historia",
        "nazwa https",
        "uytkownik",
        "zenbox",
        "komunikacja",
        "pliki",
        "rozmiar",
        "kb data",
        "wykrycia nie",
        "mitre",
        "ids nie",
        "sigmy nie",
        "submission",
        "sha256",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "unicode text",
        "utf8 text",
        "trid hypertext",
        "markup language"
      ],
      "references": [
        "https://s.go-mpulse.net/boomerang/XZ4AH-ABKPW-SQPBC-CYWES-BCG6V",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1334,
        "hostname": 454,
        "domain": 346,
        "IPv6": 2,
        "IPv4": 36,
        "FileHash-SHA256": 1499,
        "FileHash-MD5": 92,
        "FileHash-SHA1": 74,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 3839,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "264 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6841039ff61dea1fcdcc53c1",
      "name": "Malicious WiFi Internet network | trojan.morstar/bundler",
      "description": "WiFi / Internet provider \nConcerning- targeting?\nhttp://www.dead-speak.com/PsychicMediums.htm | \nhttp://www.dead-speak.com/PsychicMediums.html |\nwww.dead-speak.com || https://pin.it/ | \nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian |\npin.it |",
      "modified": "2025-07-05T02:01:54.546000",
      "created": "2025-06-05T02:40:31.779000",
      "tags": [
        "win32 exe",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "get http",
        "post http",
        "dns resolutions",
        "resolved ips",
        "symantec time",
        "stamping",
        "from",
        "algorithm",
        "thumbprint",
        "thumbprint md5",
        "signer",
        "g2 issuer",
        "ca valid",
        "serial number",
        "time stamping",
        "g4 issuer",
        "g2 valid",
        "usage ff",
        "code signing",
        "issuer certum",
        "certum code",
        "signing ca",
        "trusted network",
        "e5 e5",
        "d4 portable",
        "sha256",
        "overlay",
        "defense evasion",
        "access ta0006",
        "command",
        "control ta0011",
        "catalog tree",
        "anti",
        "ob0001",
        "analysis ob0002",
        "control ob0004",
        "ob0007 impact",
        "ob0012 file",
        "system oc0001",
        "memory oc0002",
        "data oc0004"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "FileHash-MD5": 156,
        "FileHash-SHA1": 139,
        "FileHash-SHA256": 3313,
        "URL": 1223,
        "domain": 186,
        "hostname": 313
      },
      "indicator_count": 5332,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "288 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "682fb4c264a51bf88115b6d2",
      "name": "allegro.pl/uzytkownik/adam_f.  vgt.pl , sanselo.pl, bipadorno.pl",
      "description": "https://www.virustotal.com/gui/file/db7d7637c8fa698616282e31b1541082751601b27a3e71ad18caf138451c346a/relations\nhttps://allegro.pl/uzytkownik/adam_f./ogrod-1532",
      "modified": "2025-06-22T07:00:28.087000",
      "created": "2025-05-22T23:35:30.122000",
      "tags": [
        "whasz"
      ],
      "references": [
        "https://allegro.pl/uzytkownik/adam_f./ogrod-1532",
        "https://allegro.pl/uzytkownik/adam_f.?srsltid=AfmBOoqX6vYV4qDgCzkkJhmipZLDrarI5MuggstojVsohtfiSM_s0jdd&dd_referrer=https://www.google.com/"
      ],
      "public": 1,
      "adversary": "fac1ec40eea5a4fc05f17e019328e287.wirus",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 163,
        "FileHash-SHA1": 162,
        "FileHash-SHA256": 1706,
        "domain": 596,
        "hostname": 1278,
        "URL": 6163
      },
      "indicator_count": 10068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "301 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "674afb83c67ff4443e9f953a",
      "name": "PolymodXT.exe",
      "description": "",
      "modified": "2025-05-14T21:18:19.590000",
      "created": "2024-11-30T11:48:19.052000",
      "tags": [
        "file",
        "flagi",
        "process sha256",
        "process disc",
        "pathway z",
        "identyfikator",
        "zawiera moliwo",
        "klucz",
        "zawiera",
        "wybierz",
        "nie mona",
        "przechowywanie",
        "haso",
        "obiekt",
        "cig uid",
        "zilla",
        "enumerate",
        "defender",
        "pragma",
        "security",
        "license v2",
        "ff ff",
        "fc e8",
        "f8 ff",
        "fc ff",
        "c9 c3",
        "e4 f8",
        "cc cc",
        "fc eb",
        "confuserex mod",
        "aspirecrypt",
        "detects",
        "reactor",
        "beds protector",
        "ps2exe",
        "bsjb",
        "boxedapp",
        "cyaxsharp",
        "cyaxpng",
        "smartassembly",
        "koivm",
        "confuserex",
        "obfuscator",
        "aspack",
        "titan",
        "enigma",
        "vmprotect",
        "strings",
        "rlpack",
        "antiem",
        "antisb",
        "themida",
        "loader",
        "sality",
        "dnguard",
        "windows nt",
        "gecko",
        "khtml",
        "msie",
        "wow64",
        "stealer",
        "win64",
        "error",
        "userprofile",
        "keylogger",
        "encrypt",
        "antivm",
        "span",
        "main",
        "grabber",
        "hello",
        "android",
        "dcrat",
        "win32",
        "kill",
        "revengerat",
        "sandbox",
        "pass",
        "chat",
        "first",
        "asyncrat",
        "crypto",
        "injector",
        "dropper",
        "infostealer",
        "lockfile",
        "worldwind",
        "stealerium",
        "toxiceye",
        "avemaria",
        "fast",
        "persistence",
        "trojan",
        "restart",
        "snakekeylogger",
        "snake",
        "accept",
        "cookie",
        "code",
        "killproc",
        "lazarus",
        "dearcry",
        "njrat",
        "cyrus",
        "powershell",
        "info",
        "body",
        "floodfix",
        "downloader",
        "ransomware",
        "core",
        "loki",
        "fpspy",
        "klogexe",
        "firebird",
        "patch",
        "explorer",
        "avkiller",
        "masslogger",
        "baldr",
        "modi rat",
        "helpme",
        "osno",
        "import",
        "keylog",
        "screencapture",
        "ransom",
        "crypted",
        "silent",
        "xorddos",
        "stormkitty",
        "ordinal",
        "locker",
        "hyperbro",
        "lamepyre",
        "parallaxrat",
        "null",
        "shurk steal",
        "arkeistealer",
        "strongpity",
        "desktop",
        "myagent",
        "bypass",
        "fatduke",
        "miniduke",
        "polyglotduke",
        "guildma",
        "spyeye",
        "corebot",
        "killmbr",
        "ooops",
        "lcpdot",
        "torisma",
        "codec",
        "prometheus",
        "spook",
        "crypt",
        "logger",
        "zegost",
        "poshkeylogger",
        "systembc",
        "hdlocker",
        "cryptolocker",
        "fivehands",
        "kitty",
        "goldmax",
        "rents",
        "maurigo",
        "done",
        "hidewindow",
        "bokbot",
        "bladabindi",
        "darktrack",
        "darksky",
        "alien",
        "karkoff",
        "inject",
        "windigo",
        "rest",
        "softcnapp",
        "elysiumstealer",
        "leivion",
        "banload",
        "ultrareach",
        "ultrasurf",
        "buterat",
        "tools",
        "beasty",
        "shut",
        "gravityrat",
        "fatalrat",
        "discord",
        "deadwood",
        "turian",
        "markirat",
        "mark",
        "klingonrat",
        "path",
        "reverserat",
        "grab",
        "meta",
        "voidcrypt",
        "darkvnc",
        "ryzerlo",
        "hiddentear",
        "boxcaon",
        "stream",
        "crimsonrat",
        "delfi",
        "infinity",
        "stealthworker",
        "gasket",
        "spoolss",
        "lu0bot",
        "target",
        "attack",
        "cobaltstrike",
        "bits",
        "chaos",
        "bitcoin",
        "wiper",
        "delphi",
        "slackbot",
        "neshta",
        "belarus",
        "apanas",
        "runner",
        "darkcomet",
        "macoute",
        "iframe",
        "vanillarat",
        "sectoprat",
        "melt",
        "tomiris",
        "apostle",
        "blackbyte",
        "kutaki",
        "override",
        "windealer",
        "mkdir",
        "brbbot",
        "config",
        "babylon rat",
        "spynet",
        "bazarloader",
        "clipper",
        "banker",
        "gh0st",
        "piratestealer",
        "witch",
        "killme",
        "vulturi",
        "tofsee",
        "slow",
        "owowa",
        "flagpro",
        "write",
        "dazzlespy",
        "decryptor",
        "bandit stealer",
        "bandit",
        "darkeye",
        "recordbreaker",
        "truebot",
        "svchost",
        "clipbanker",
        "service",
        "arrowrat",
        "ducktail",
        "confuser",
        "gobrat",
        "modiloader",
        "chilelocker",
        "noclose",
        "strelastealer",
        "comfoo",
        "babar",
        "blankgrabber",
        "solarmarker",
        "darkgate",
        "stub",
        "banned",
        "globeimposter",
        "rhysida",
        "janelarat",
        "kraken",
        "recon",
        "quiterat",
        "venomrat",
        "venom rat",
        "sapphirestealer",
        "ntospy",
        "raccoon",
        "shifu",
        "mediapi",
        "poolrat",
        "cicada3301",
        "remoteexec"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 528,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 414,
        "FileHash-SHA1": 410,
        "FileHash-SHA256": 1940,
        "URL": 171,
        "hostname": 56,
        "domain": 134,
        "YARA": 759,
        "email": 4
      },
      "indicator_count": 3888,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ct.captcha-delivery.com/O",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ct.captcha-delivery.com/O",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776597378.8105328
}