{
  "type": "URL",
  "indicator": "https://cv.braun.dev",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cv.braun.dev",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3753529044,
      "indicator": "https://cv.braun.dev",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6976d69ecbc0497f97e28618",
          "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
          "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
          "modified": "2026-02-25T02:03:02.441000",
          "created": "2026-01-26T02:51:10.502000",
          "tags": [
            "united",
            "error",
            "port",
            "destination",
            "host",
            "tlsv1",
            "intel",
            "ms windows",
            "worm",
            "delphi",
            "write",
            "malware",
            "suspicious",
            "autorun",
            "bloat",
            "checkin",
            "google",
            "drive",
            "cape",
            "lowfi",
            "hookwowlow dec",
            "passive dns",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "twitter",
            "trojandropper",
            "virtool",
            "win32",
            "susp",
            "hookwowlow",
            "injection",
            "please",
            "x msedge",
            "ipv4 add",
            "urls",
            "dynamicloader",
            "windows",
            "professional",
            "delete c",
            "tls issuing",
            "x005x00xc0",
            "xc0xc0",
            "xc0nxc0tx00jx00",
            "stwa",
            "lredmond",
            "explorer",
            "powershell",
            "accept",
            "corporation10",
            "trojan",
            "pegasus",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present sep",
            "present aug",
            "redacted for",
            "ip address",
            "search",
            "unknown cname",
            "memcommit",
            "default",
            "sectigo limited",
            "read c",
            "gb st",
            "inprocserver32",
            "sectigo public",
            "defender",
            "next",
            "present jan",
            "spain",
            "domain add",
            "files",
            "asn as15169",
            "flag",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "ck techniques",
            "mitre att",
            "ck matrix",
            "starfield",
            "hybrid",
            "general",
            "path",
            "strings",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "exclude sugges",
            "stop data",
            "levelblue",
            "open threat",
            "url https",
            "none google",
            "url http",
            "no expiration",
            "iocs",
            "domain",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "ocs to",
            "exclude",
            "suggesteu",
            "find s",
            "snow",
            "aitypes",
            "suspicious_redirect",
            "url_encoding",
            "present dec",
            "unknown aaaa",
            "present oct",
            "record value",
            "body",
            "encrypt",
            "access att",
            "link initial",
            "ascii text",
            "pattern match",
            "sha256",
            "show technique",
            "iframe",
            "local",
            "united states",
            "brian sabey",
            "christopher p. ahmann",
            "black rock",
            "td td",
            "td tr",
            "a td",
            "dynamic dns",
            "meta name",
            "strong",
            "static dns",
            "date",
            "null",
            "enough",
            "hosts",
            "fast"
          ],
          "references": [
            "Sprouts Farmers Market",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
            "Pegasus | A targets devices are obviously infiltrated",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
            "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
            "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
            "Alerts: cape_detected_threat https_ urls",
            "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
            "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
            "Domains Contacted: drive.usercontent.google.com",
            "ConventionEngine_Anomaly_MultiPDB_Double",
            "https://jviwczq.zc-apple.com/",
            "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
            "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
            "Malware Hosting: 13.107.226.70",
            "Scanning Host: 13.107.246.70",
            "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
            "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
            "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
            "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
            "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
            "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
            "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
            "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
            "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
            "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
            "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
            "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
            "sprouts@em.sprouts.com?",
            "http://blackrock.work.gd/",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "supplierportal.gov2x.com",
            "http://wonporn.com/top/Pakistani_Sucking",
            "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
            "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
            "supply.qld.gov.au",
            "okta-dev.gov2x.com",
            "verify.gov.tl",
            "api.optimizer.insitemaxdev.gov2x.com",
            "iot.insitemaxdev.gov2x.com",
            "https://kb.drakesoftware.com/Site/Browse/15183/State",
            "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
            "freedns.afraid.org",
            "https://hello.riskxchange.co/api/mailings/unsubscribe",
            "Sabey , Ahmann, Quasi Government, Government"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Emotet-9850453-0",
              "display_name": "Win.Trojan.Emotet-9850453-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "#LowFI:HookwowLow",
              "display_name": "#LowFI:HookwowLow",
              "target": null
            },
            {
              "id": "Win.Trojan.CobaltStrike-9044898-1",
              "display_name": "Win.Trojan.CobaltStrike-9044898-1",
              "target": null
            },
            {
              "id": "Win.Trojan.VBGeneric-6735875-0",
              "display_name": "Win.Trojan.VBGeneric-6735875-0",
              "target": null
            },
            {
              "id": "SLF:Win64/CobPipe.A",
              "display_name": "SLF:Win64/CobPipe.A",
              "target": "/malware/SLF:Win64/CobPipe.A"
            },
            {
              "id": "ALF:Program:Win32/Webcompanion",
              "display_name": "ALF:Program:Win32/Webcompanion",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "ALF:Trojan:Win32/Anorocuriv.A",
              "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
              "target": null
            },
            {
              "id": "Sf:ShellCode-AU\\ [Trj]",
              "display_name": "Sf:ShellCode-AU\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Pushdo-15",
              "display_name": "Win.Trojan.Pushdo-15",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail.BS",
              "display_name": "TrojanDownloader:Win32/Cutwail.BS",
              "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
            },
            {
              "id": "Win32:Trojano-CHF\\ [Trj]",
              "display_name": "Win32:Trojano-CHF\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.3867-1",
              "display_name": "Win.Downloader.3867-1",
              "target": null
            },
            {
              "id": "Win32:Evo-gen\\ [Susp]",
              "display_name": "Win32:Evo-gen\\ [Susp]",
              "target": null
            },
            {
              "id": "Virtool:Win32/CeeInject.gen!AH",
              "display_name": "Virtool:Win32/CeeInject.gen!AH",
              "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1003.003",
              "name": "NTDS",
              "display_name": "T1003.003 - NTDS"
            },
            {
              "id": "T1055.008",
              "name": "Ptrace System Calls",
              "display_name": "T1055.008 - Ptrace System Calls"
            },
            {
              "id": "T1001.003",
              "name": "Protocol Impersonation",
              "display_name": "T1001.003 - Protocol Impersonation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1564.005",
              "name": "Hidden File System",
              "display_name": "T1564.005 - Hidden File System"
            }
          ],
          "industries": [
            "Retail",
            "Government",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12640,
            "hostname": 4429,
            "email": 7,
            "domain": 1250,
            "FileHash-SHA256": 1633,
            "FileHash-MD5": 278,
            "FileHash-SHA1": 343,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 20597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "53 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6976d6a601f06adcd1ed22fc",
          "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
          "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
          "modified": "2026-02-25T02:03:02.441000",
          "created": "2026-01-26T02:51:18.022000",
          "tags": [
            "united",
            "error",
            "port",
            "destination",
            "host",
            "tlsv1",
            "intel",
            "ms windows",
            "worm",
            "delphi",
            "write",
            "malware",
            "suspicious",
            "autorun",
            "bloat",
            "checkin",
            "google",
            "drive",
            "cape",
            "lowfi",
            "hookwowlow dec",
            "passive dns",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "twitter",
            "trojandropper",
            "virtool",
            "win32",
            "susp",
            "hookwowlow",
            "injection",
            "please",
            "x msedge",
            "ipv4 add",
            "urls",
            "dynamicloader",
            "windows",
            "professional",
            "delete c",
            "tls issuing",
            "x005x00xc0",
            "xc0xc0",
            "xc0nxc0tx00jx00",
            "stwa",
            "lredmond",
            "explorer",
            "powershell",
            "accept",
            "corporation10",
            "trojan",
            "pegasus",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present sep",
            "present aug",
            "redacted for",
            "ip address",
            "search",
            "unknown cname",
            "memcommit",
            "default",
            "sectigo limited",
            "read c",
            "gb st",
            "inprocserver32",
            "sectigo public",
            "defender",
            "next",
            "present jan",
            "spain",
            "domain add",
            "files",
            "asn as15169",
            "flag",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "ck techniques",
            "mitre att",
            "ck matrix",
            "starfield",
            "hybrid",
            "general",
            "path",
            "strings",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "exclude sugges",
            "stop data",
            "levelblue",
            "open threat",
            "url https",
            "none google",
            "url http",
            "no expiration",
            "iocs",
            "domain",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "ocs to",
            "exclude",
            "suggesteu",
            "find s",
            "snow",
            "aitypes",
            "suspicious_redirect",
            "url_encoding",
            "present dec",
            "unknown aaaa",
            "present oct",
            "record value",
            "body",
            "encrypt",
            "access att",
            "link initial",
            "ascii text",
            "pattern match",
            "sha256",
            "show technique",
            "iframe",
            "local",
            "united states",
            "brian sabey",
            "christopher p. ahmann",
            "black rock",
            "td td",
            "td tr",
            "a td",
            "dynamic dns",
            "meta name",
            "strong",
            "static dns",
            "date",
            "null",
            "enough",
            "hosts",
            "fast"
          ],
          "references": [
            "Sprouts Farmers Market",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
            "Pegasus | A targets devices are obviously infiltrated",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
            "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
            "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
            "Alerts: cape_detected_threat https_ urls",
            "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
            "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
            "Domains Contacted: drive.usercontent.google.com",
            "ConventionEngine_Anomaly_MultiPDB_Double",
            "https://jviwczq.zc-apple.com/",
            "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
            "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
            "Malware Hosting: 13.107.226.70",
            "Scanning Host: 13.107.246.70",
            "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
            "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
            "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
            "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
            "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
            "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
            "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
            "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
            "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
            "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
            "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
            "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
            "sprouts@em.sprouts.com?",
            "http://blackrock.work.gd/",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "supplierportal.gov2x.com",
            "http://wonporn.com/top/Pakistani_Sucking",
            "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
            "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
            "supply.qld.gov.au",
            "okta-dev.gov2x.com",
            "verify.gov.tl",
            "api.optimizer.insitemaxdev.gov2x.com",
            "iot.insitemaxdev.gov2x.com",
            "https://kb.drakesoftware.com/Site/Browse/15183/State",
            "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
            "freedns.afraid.org",
            "https://hello.riskxchange.co/api/mailings/unsubscribe",
            "Sabey , Ahmann, Quasi Government, Government"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Emotet-9850453-0",
              "display_name": "Win.Trojan.Emotet-9850453-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "#LowFI:HookwowLow",
              "display_name": "#LowFI:HookwowLow",
              "target": null
            },
            {
              "id": "Win.Trojan.CobaltStrike-9044898-1",
              "display_name": "Win.Trojan.CobaltStrike-9044898-1",
              "target": null
            },
            {
              "id": "Win.Trojan.VBGeneric-6735875-0",
              "display_name": "Win.Trojan.VBGeneric-6735875-0",
              "target": null
            },
            {
              "id": "SLF:Win64/CobPipe.A",
              "display_name": "SLF:Win64/CobPipe.A",
              "target": "/malware/SLF:Win64/CobPipe.A"
            },
            {
              "id": "ALF:Program:Win32/Webcompanion",
              "display_name": "ALF:Program:Win32/Webcompanion",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "ALF:Trojan:Win32/Anorocuriv.A",
              "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
              "target": null
            },
            {
              "id": "Sf:ShellCode-AU\\ [Trj]",
              "display_name": "Sf:ShellCode-AU\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Pushdo-15",
              "display_name": "Win.Trojan.Pushdo-15",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail.BS",
              "display_name": "TrojanDownloader:Win32/Cutwail.BS",
              "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
            },
            {
              "id": "Win32:Trojano-CHF\\ [Trj]",
              "display_name": "Win32:Trojano-CHF\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.3867-1",
              "display_name": "Win.Downloader.3867-1",
              "target": null
            },
            {
              "id": "Win32:Evo-gen\\ [Susp]",
              "display_name": "Win32:Evo-gen\\ [Susp]",
              "target": null
            },
            {
              "id": "Virtool:Win32/CeeInject.gen!AH",
              "display_name": "Virtool:Win32/CeeInject.gen!AH",
              "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1003.003",
              "name": "NTDS",
              "display_name": "T1003.003 - NTDS"
            },
            {
              "id": "T1055.008",
              "name": "Ptrace System Calls",
              "display_name": "T1055.008 - Ptrace System Calls"
            },
            {
              "id": "T1001.003",
              "name": "Protocol Impersonation",
              "display_name": "T1001.003 - Protocol Impersonation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1564.005",
              "name": "Hidden File System",
              "display_name": "T1564.005 - Hidden File System"
            }
          ],
          "industries": [
            "Retail",
            "Government",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12640,
            "hostname": 4429,
            "email": 7,
            "domain": 1250,
            "FileHash-SHA256": 1633,
            "FileHash-MD5": 278,
            "FileHash-SHA1": 343,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 20597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "53 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6976d6afd744c55bd596ed6e",
          "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
          "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
          "modified": "2026-02-25T02:03:02.441000",
          "created": "2026-01-26T02:51:27.248000",
          "tags": [
            "united",
            "error",
            "port",
            "destination",
            "host",
            "tlsv1",
            "intel",
            "ms windows",
            "worm",
            "delphi",
            "write",
            "malware",
            "suspicious",
            "autorun",
            "bloat",
            "checkin",
            "google",
            "drive",
            "cape",
            "lowfi",
            "hookwowlow dec",
            "passive dns",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "twitter",
            "trojandropper",
            "virtool",
            "win32",
            "susp",
            "hookwowlow",
            "injection",
            "please",
            "x msedge",
            "ipv4 add",
            "urls",
            "dynamicloader",
            "windows",
            "professional",
            "delete c",
            "tls issuing",
            "x005x00xc0",
            "xc0xc0",
            "xc0nxc0tx00jx00",
            "stwa",
            "lredmond",
            "explorer",
            "powershell",
            "accept",
            "corporation10",
            "trojan",
            "pegasus",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "present sep",
            "present aug",
            "redacted for",
            "ip address",
            "search",
            "unknown cname",
            "memcommit",
            "default",
            "sectigo limited",
            "read c",
            "gb st",
            "inprocserver32",
            "sectigo public",
            "defender",
            "next",
            "present jan",
            "spain",
            "domain add",
            "files",
            "asn as15169",
            "flag",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "ck techniques",
            "mitre att",
            "ck matrix",
            "starfield",
            "hybrid",
            "general",
            "path",
            "strings",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "exclude sugges",
            "stop data",
            "levelblue",
            "open threat",
            "url https",
            "none google",
            "url http",
            "no expiration",
            "iocs",
            "domain",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "ocs to",
            "exclude",
            "suggesteu",
            "find s",
            "snow",
            "aitypes",
            "suspicious_redirect",
            "url_encoding",
            "present dec",
            "unknown aaaa",
            "present oct",
            "record value",
            "body",
            "encrypt",
            "access att",
            "link initial",
            "ascii text",
            "pattern match",
            "sha256",
            "show technique",
            "iframe",
            "local",
            "united states",
            "brian sabey",
            "christopher p. ahmann",
            "black rock",
            "td td",
            "td tr",
            "a td",
            "dynamic dns",
            "meta name",
            "strong",
            "static dns",
            "date",
            "null",
            "enough",
            "hosts",
            "fast"
          ],
          "references": [
            "Sprouts Farmers Market",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
            "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
            "Pegasus | A targets devices are obviously infiltrated",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
            "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
            "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
            "Alerts: cape_detected_threat https_ urls",
            "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
            "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
            "Domains Contacted: drive.usercontent.google.com",
            "ConventionEngine_Anomaly_MultiPDB_Double",
            "https://jviwczq.zc-apple.com/",
            "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
            "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
            "Malware Hosting: 13.107.226.70",
            "Scanning Host: 13.107.246.70",
            "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
            "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
            "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
            "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
            "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
            "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
            "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
            "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
            "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
            "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
            "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
            "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
            "sprouts@em.sprouts.com?",
            "http://blackrock.work.gd/",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
            "blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
            "supplierportal.gov2x.com",
            "http://wonporn.com/top/Pakistani_Sucking",
            "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
            "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
            "supply.qld.gov.au",
            "okta-dev.gov2x.com",
            "verify.gov.tl",
            "api.optimizer.insitemaxdev.gov2x.com",
            "iot.insitemaxdev.gov2x.com",
            "https://kb.drakesoftware.com/Site/Browse/15183/State",
            "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
            "freedns.afraid.org",
            "https://hello.riskxchange.co/api/mailings/unsubscribe",
            "Sabey , Ahmann, Quasi Government, Government"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Emotet-9850453-0",
              "display_name": "Win.Trojan.Emotet-9850453-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "#LowFI:HookwowLow",
              "display_name": "#LowFI:HookwowLow",
              "target": null
            },
            {
              "id": "Win.Trojan.CobaltStrike-9044898-1",
              "display_name": "Win.Trojan.CobaltStrike-9044898-1",
              "target": null
            },
            {
              "id": "Win.Trojan.VBGeneric-6735875-0",
              "display_name": "Win.Trojan.VBGeneric-6735875-0",
              "target": null
            },
            {
              "id": "SLF:Win64/CobPipe.A",
              "display_name": "SLF:Win64/CobPipe.A",
              "target": "/malware/SLF:Win64/CobPipe.A"
            },
            {
              "id": "ALF:Program:Win32/Webcompanion",
              "display_name": "ALF:Program:Win32/Webcompanion",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "ALF:Trojan:Win32/Anorocuriv.A",
              "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
              "target": null
            },
            {
              "id": "Sf:ShellCode-AU\\ [Trj]",
              "display_name": "Sf:ShellCode-AU\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Pushdo-15",
              "display_name": "Win.Trojan.Pushdo-15",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail.BS",
              "display_name": "TrojanDownloader:Win32/Cutwail.BS",
              "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
            },
            {
              "id": "Win32:Trojano-CHF\\ [Trj]",
              "display_name": "Win32:Trojano-CHF\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Downloader.3867-1",
              "display_name": "Win.Downloader.3867-1",
              "target": null
            },
            {
              "id": "Win32:Evo-gen\\ [Susp]",
              "display_name": "Win32:Evo-gen\\ [Susp]",
              "target": null
            },
            {
              "id": "Virtool:Win32/CeeInject.gen!AH",
              "display_name": "Virtool:Win32/CeeInject.gen!AH",
              "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1003.003",
              "name": "NTDS",
              "display_name": "T1003.003 - NTDS"
            },
            {
              "id": "T1055.008",
              "name": "Ptrace System Calls",
              "display_name": "T1055.008 - Ptrace System Calls"
            },
            {
              "id": "T1001.003",
              "name": "Protocol Impersonation",
              "display_name": "T1001.003 - Protocol Impersonation"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1564.005",
              "name": "Hidden File System",
              "display_name": "T1564.005 - Hidden File System"
            }
          ],
          "industries": [
            "Retail",
            "Government",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12640,
            "hostname": 4429,
            "email": 7,
            "domain": 1250,
            "FileHash-SHA256": 1633,
            "FileHash-MD5": 278,
            "FileHash-SHA1": 343,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 20597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "53 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
        "sprouts@em.sprouts.com?",
        "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
        "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
        "okta-dev.gov2x.com",
        "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
        "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
        "Alerts: cape_detected_threat https_ urls",
        "https://jviwczq.zc-apple.com/",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
        "Sprouts Farmers Market",
        "WebTools",
        "Domains Contacted: drive.usercontent.google.com",
        "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
        "Scanning Host: 13.107.246.70",
        "iot.insitemaxdev.gov2x.com",
        "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
        "http://wonporn.com/top/Pakistani_Sucking",
        "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
        "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
        "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
        "ConventionEngine_Anomaly_MultiPDB_Double",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
        "Online Research",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
        "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
        "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
        "Sabey , Ahmann, Quasi Government, Government",
        "supplierportal.gov2x.com",
        "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
        "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
        "http://blackrock.work.gd/",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
        "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
        "https://hello.riskxchange.co/api/mailings/unsubscribe",
        "blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "Malware Hosting: 13.107.226.70",
        "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
        "Data Analysis",
        "Pegasus | A targets devices are obviously infiltrated",
        "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "https://kb.drakesoftware.com/Site/Browse/15183/State",
        "api.optimizer.insitemaxdev.gov2x.com",
        "supply.qld.gov.au",
        "verify.gov.tl",
        "freedns.afraid.org",
        "Alienvault OTX",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojandownloader:win32/cutwail.bs",
            "Virtool:win32/ceeinject.gen!ah",
            "Backdoor:msil/quasarrat",
            "Sf:shellcode-au\\ [trj]",
            "Win.trojan.pushdo-15",
            "Worm:win32/autorun!atmn",
            "Alf:trojan:win32/anorocuriv.a",
            "Backdoor:msil/asyncrat",
            "Alf:program:win32/webcompanion",
            "Win.downloader.3867-1",
            "Win.trojan.emotet-9850453-0",
            "Pegasus",
            "Win32:trojano-chf\\ [trj]",
            "Win.trojan.cobaltstrike-9044898-1",
            "Win32:evo-gen\\ [susp]",
            "Worm:win32/mofksys.rnd!mtb",
            "#lowfi:hookwowlow",
            "Slf:win64/cobpipe.a",
            "Win.trojan.vbgeneric-6735875-0"
          ],
          "industries": [
            "Hacking",
            "Media",
            "Government",
            "Retail",
            "Technology",
            "Social media"
          ],
          "unique_indicators": 44061
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/braun.dev",
    "whois": "http://whois.domaintools.com/braun.dev",
    "domain": "braun.dev",
    "hostname": "cv.braun.dev"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6976d69ecbc0497f97e28618",
      "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
      "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
      "modified": "2026-02-25T02:03:02.441000",
      "created": "2026-01-26T02:51:10.502000",
      "tags": [
        "united",
        "error",
        "port",
        "destination",
        "host",
        "tlsv1",
        "intel",
        "ms windows",
        "worm",
        "delphi",
        "write",
        "malware",
        "suspicious",
        "autorun",
        "bloat",
        "checkin",
        "google",
        "drive",
        "cape",
        "lowfi",
        "hookwowlow dec",
        "passive dns",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "twitter",
        "trojandropper",
        "virtool",
        "win32",
        "susp",
        "hookwowlow",
        "injection",
        "please",
        "x msedge",
        "ipv4 add",
        "urls",
        "dynamicloader",
        "windows",
        "professional",
        "delete c",
        "tls issuing",
        "x005x00xc0",
        "xc0xc0",
        "xc0nxc0tx00jx00",
        "stwa",
        "lredmond",
        "explorer",
        "powershell",
        "accept",
        "corporation10",
        "trojan",
        "pegasus",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present sep",
        "present aug",
        "redacted for",
        "ip address",
        "search",
        "unknown cname",
        "memcommit",
        "default",
        "sectigo limited",
        "read c",
        "gb st",
        "inprocserver32",
        "sectigo public",
        "defender",
        "next",
        "present jan",
        "spain",
        "domain add",
        "files",
        "asn as15169",
        "flag",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "ck techniques",
        "mitre att",
        "ck matrix",
        "starfield",
        "hybrid",
        "general",
        "path",
        "strings",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "exclude sugges",
        "stop data",
        "levelblue",
        "open threat",
        "url https",
        "none google",
        "url http",
        "no expiration",
        "iocs",
        "domain",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "ocs to",
        "exclude",
        "suggesteu",
        "find s",
        "snow",
        "aitypes",
        "suspicious_redirect",
        "url_encoding",
        "present dec",
        "unknown aaaa",
        "present oct",
        "record value",
        "body",
        "encrypt",
        "access att",
        "link initial",
        "ascii text",
        "pattern match",
        "sha256",
        "show technique",
        "iframe",
        "local",
        "united states",
        "brian sabey",
        "christopher p. ahmann",
        "black rock",
        "td td",
        "td tr",
        "a td",
        "dynamic dns",
        "meta name",
        "strong",
        "static dns",
        "date",
        "null",
        "enough",
        "hosts",
        "fast"
      ],
      "references": [
        "Sprouts Farmers Market",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
        "Pegasus | A targets devices are obviously infiltrated",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
        "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
        "Alerts: cape_detected_threat https_ urls",
        "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
        "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
        "Domains Contacted: drive.usercontent.google.com",
        "ConventionEngine_Anomaly_MultiPDB_Double",
        "https://jviwczq.zc-apple.com/",
        "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
        "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
        "Malware Hosting: 13.107.226.70",
        "Scanning Host: 13.107.246.70",
        "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
        "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
        "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
        "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
        "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
        "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
        "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
        "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
        "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
        "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
        "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
        "sprouts@em.sprouts.com?",
        "http://blackrock.work.gd/",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "supplierportal.gov2x.com",
        "http://wonporn.com/top/Pakistani_Sucking",
        "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
        "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
        "supply.qld.gov.au",
        "okta-dev.gov2x.com",
        "verify.gov.tl",
        "api.optimizer.insitemaxdev.gov2x.com",
        "iot.insitemaxdev.gov2x.com",
        "https://kb.drakesoftware.com/Site/Browse/15183/State",
        "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
        "freedns.afraid.org",
        "https://hello.riskxchange.co/api/mailings/unsubscribe",
        "Sabey , Ahmann, Quasi Government, Government"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Emotet-9850453-0",
          "display_name": "Win.Trojan.Emotet-9850453-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "#LowFI:HookwowLow",
          "display_name": "#LowFI:HookwowLow",
          "target": null
        },
        {
          "id": "Win.Trojan.CobaltStrike-9044898-1",
          "display_name": "Win.Trojan.CobaltStrike-9044898-1",
          "target": null
        },
        {
          "id": "Win.Trojan.VBGeneric-6735875-0",
          "display_name": "Win.Trojan.VBGeneric-6735875-0",
          "target": null
        },
        {
          "id": "SLF:Win64/CobPipe.A",
          "display_name": "SLF:Win64/CobPipe.A",
          "target": "/malware/SLF:Win64/CobPipe.A"
        },
        {
          "id": "ALF:Program:Win32/Webcompanion",
          "display_name": "ALF:Program:Win32/Webcompanion",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "ALF:Trojan:Win32/Anorocuriv.A",
          "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
          "target": null
        },
        {
          "id": "Sf:ShellCode-AU\\ [Trj]",
          "display_name": "Sf:ShellCode-AU\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Pushdo-15",
          "display_name": "Win.Trojan.Pushdo-15",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail.BS",
          "display_name": "TrojanDownloader:Win32/Cutwail.BS",
          "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
        },
        {
          "id": "Win32:Trojano-CHF\\ [Trj]",
          "display_name": "Win32:Trojano-CHF\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.3867-1",
          "display_name": "Win.Downloader.3867-1",
          "target": null
        },
        {
          "id": "Win32:Evo-gen\\ [Susp]",
          "display_name": "Win32:Evo-gen\\ [Susp]",
          "target": null
        },
        {
          "id": "Virtool:Win32/CeeInject.gen!AH",
          "display_name": "Virtool:Win32/CeeInject.gen!AH",
          "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1003.003",
          "name": "NTDS",
          "display_name": "T1003.003 - NTDS"
        },
        {
          "id": "T1055.008",
          "name": "Ptrace System Calls",
          "display_name": "T1055.008 - Ptrace System Calls"
        },
        {
          "id": "T1001.003",
          "name": "Protocol Impersonation",
          "display_name": "T1001.003 - Protocol Impersonation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1564.005",
          "name": "Hidden File System",
          "display_name": "T1564.005 - Hidden File System"
        }
      ],
      "industries": [
        "Retail",
        "Government",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12640,
        "hostname": 4429,
        "email": 7,
        "domain": 1250,
        "FileHash-SHA256": 1633,
        "FileHash-MD5": 278,
        "FileHash-SHA1": 343,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 20597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "53 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6976d6a601f06adcd1ed22fc",
      "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
      "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
      "modified": "2026-02-25T02:03:02.441000",
      "created": "2026-01-26T02:51:18.022000",
      "tags": [
        "united",
        "error",
        "port",
        "destination",
        "host",
        "tlsv1",
        "intel",
        "ms windows",
        "worm",
        "delphi",
        "write",
        "malware",
        "suspicious",
        "autorun",
        "bloat",
        "checkin",
        "google",
        "drive",
        "cape",
        "lowfi",
        "hookwowlow dec",
        "passive dns",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "twitter",
        "trojandropper",
        "virtool",
        "win32",
        "susp",
        "hookwowlow",
        "injection",
        "please",
        "x msedge",
        "ipv4 add",
        "urls",
        "dynamicloader",
        "windows",
        "professional",
        "delete c",
        "tls issuing",
        "x005x00xc0",
        "xc0xc0",
        "xc0nxc0tx00jx00",
        "stwa",
        "lredmond",
        "explorer",
        "powershell",
        "accept",
        "corporation10",
        "trojan",
        "pegasus",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present sep",
        "present aug",
        "redacted for",
        "ip address",
        "search",
        "unknown cname",
        "memcommit",
        "default",
        "sectigo limited",
        "read c",
        "gb st",
        "inprocserver32",
        "sectigo public",
        "defender",
        "next",
        "present jan",
        "spain",
        "domain add",
        "files",
        "asn as15169",
        "flag",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "ck techniques",
        "mitre att",
        "ck matrix",
        "starfield",
        "hybrid",
        "general",
        "path",
        "strings",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "exclude sugges",
        "stop data",
        "levelblue",
        "open threat",
        "url https",
        "none google",
        "url http",
        "no expiration",
        "iocs",
        "domain",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "ocs to",
        "exclude",
        "suggesteu",
        "find s",
        "snow",
        "aitypes",
        "suspicious_redirect",
        "url_encoding",
        "present dec",
        "unknown aaaa",
        "present oct",
        "record value",
        "body",
        "encrypt",
        "access att",
        "link initial",
        "ascii text",
        "pattern match",
        "sha256",
        "show technique",
        "iframe",
        "local",
        "united states",
        "brian sabey",
        "christopher p. ahmann",
        "black rock",
        "td td",
        "td tr",
        "a td",
        "dynamic dns",
        "meta name",
        "strong",
        "static dns",
        "date",
        "null",
        "enough",
        "hosts",
        "fast"
      ],
      "references": [
        "Sprouts Farmers Market",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
        "Pegasus | A targets devices are obviously infiltrated",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
        "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
        "Alerts: cape_detected_threat https_ urls",
        "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
        "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
        "Domains Contacted: drive.usercontent.google.com",
        "ConventionEngine_Anomaly_MultiPDB_Double",
        "https://jviwczq.zc-apple.com/",
        "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
        "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
        "Malware Hosting: 13.107.226.70",
        "Scanning Host: 13.107.246.70",
        "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
        "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
        "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
        "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
        "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
        "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
        "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
        "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
        "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
        "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
        "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
        "sprouts@em.sprouts.com?",
        "http://blackrock.work.gd/",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "supplierportal.gov2x.com",
        "http://wonporn.com/top/Pakistani_Sucking",
        "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
        "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
        "supply.qld.gov.au",
        "okta-dev.gov2x.com",
        "verify.gov.tl",
        "api.optimizer.insitemaxdev.gov2x.com",
        "iot.insitemaxdev.gov2x.com",
        "https://kb.drakesoftware.com/Site/Browse/15183/State",
        "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
        "freedns.afraid.org",
        "https://hello.riskxchange.co/api/mailings/unsubscribe",
        "Sabey , Ahmann, Quasi Government, Government"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Emotet-9850453-0",
          "display_name": "Win.Trojan.Emotet-9850453-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "#LowFI:HookwowLow",
          "display_name": "#LowFI:HookwowLow",
          "target": null
        },
        {
          "id": "Win.Trojan.CobaltStrike-9044898-1",
          "display_name": "Win.Trojan.CobaltStrike-9044898-1",
          "target": null
        },
        {
          "id": "Win.Trojan.VBGeneric-6735875-0",
          "display_name": "Win.Trojan.VBGeneric-6735875-0",
          "target": null
        },
        {
          "id": "SLF:Win64/CobPipe.A",
          "display_name": "SLF:Win64/CobPipe.A",
          "target": "/malware/SLF:Win64/CobPipe.A"
        },
        {
          "id": "ALF:Program:Win32/Webcompanion",
          "display_name": "ALF:Program:Win32/Webcompanion",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "ALF:Trojan:Win32/Anorocuriv.A",
          "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
          "target": null
        },
        {
          "id": "Sf:ShellCode-AU\\ [Trj]",
          "display_name": "Sf:ShellCode-AU\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Pushdo-15",
          "display_name": "Win.Trojan.Pushdo-15",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail.BS",
          "display_name": "TrojanDownloader:Win32/Cutwail.BS",
          "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
        },
        {
          "id": "Win32:Trojano-CHF\\ [Trj]",
          "display_name": "Win32:Trojano-CHF\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.3867-1",
          "display_name": "Win.Downloader.3867-1",
          "target": null
        },
        {
          "id": "Win32:Evo-gen\\ [Susp]",
          "display_name": "Win32:Evo-gen\\ [Susp]",
          "target": null
        },
        {
          "id": "Virtool:Win32/CeeInject.gen!AH",
          "display_name": "Virtool:Win32/CeeInject.gen!AH",
          "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1003.003",
          "name": "NTDS",
          "display_name": "T1003.003 - NTDS"
        },
        {
          "id": "T1055.008",
          "name": "Ptrace System Calls",
          "display_name": "T1055.008 - Ptrace System Calls"
        },
        {
          "id": "T1001.003",
          "name": "Protocol Impersonation",
          "display_name": "T1001.003 - Protocol Impersonation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1564.005",
          "name": "Hidden File System",
          "display_name": "T1564.005 - Hidden File System"
        }
      ],
      "industries": [
        "Retail",
        "Government",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12640,
        "hostname": 4429,
        "email": 7,
        "domain": 1250,
        "FileHash-SHA256": 1633,
        "FileHash-MD5": 278,
        "FileHash-SHA1": 343,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 20597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "53 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6976d6afd744c55bd596ed6e",
      "name": "Sprouts Farmers Market - Apple Product Access Attack | Pegasus | EndGame (01.25.26)",
      "description": "Suspicious redirect on an infected Apple product. Pegasus auto populated. Targets positive for Pegasus Hit List. Brian Sabey , Christopher P. Ahmann , State of Colorado quasi government entities.  \n\nPegasus isn\u2019t obviously seen in this pulse. Next pulse will show Installer.\n[OTX Auto Populated- LevelBlue - Open Threat Exchange - Why?] \n#ProjecctEndgame #Pegasus #Sprouts #SuspiciousRedirect #Malicious_Coding #Hello",
      "modified": "2026-02-25T02:03:02.441000",
      "created": "2026-01-26T02:51:27.248000",
      "tags": [
        "united",
        "error",
        "port",
        "destination",
        "host",
        "tlsv1",
        "intel",
        "ms windows",
        "worm",
        "delphi",
        "write",
        "malware",
        "suspicious",
        "autorun",
        "bloat",
        "checkin",
        "google",
        "drive",
        "cape",
        "lowfi",
        "hookwowlow dec",
        "passive dns",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "twitter",
        "trojandropper",
        "virtool",
        "win32",
        "susp",
        "hookwowlow",
        "injection",
        "please",
        "x msedge",
        "ipv4 add",
        "urls",
        "dynamicloader",
        "windows",
        "professional",
        "delete c",
        "tls issuing",
        "x005x00xc0",
        "xc0xc0",
        "xc0nxc0tx00jx00",
        "stwa",
        "lredmond",
        "explorer",
        "powershell",
        "accept",
        "corporation10",
        "trojan",
        "pegasus",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "present sep",
        "present aug",
        "redacted for",
        "ip address",
        "search",
        "unknown cname",
        "memcommit",
        "default",
        "sectigo limited",
        "read c",
        "gb st",
        "inprocserver32",
        "sectigo public",
        "defender",
        "next",
        "present jan",
        "spain",
        "domain add",
        "files",
        "asn as15169",
        "flag",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "ck techniques",
        "mitre att",
        "ck matrix",
        "starfield",
        "hybrid",
        "general",
        "path",
        "strings",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "exclude sugges",
        "stop data",
        "levelblue",
        "open threat",
        "url https",
        "none google",
        "url http",
        "no expiration",
        "iocs",
        "domain",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "ocs to",
        "exclude",
        "suggesteu",
        "find s",
        "snow",
        "aitypes",
        "suspicious_redirect",
        "url_encoding",
        "present dec",
        "unknown aaaa",
        "present oct",
        "record value",
        "body",
        "encrypt",
        "access att",
        "link initial",
        "ascii text",
        "pattern match",
        "sha256",
        "show technique",
        "iframe",
        "local",
        "united states",
        "brian sabey",
        "christopher p. ahmann",
        "black rock",
        "td td",
        "td tr",
        "a td",
        "dynamic dns",
        "meta name",
        "strong",
        "static dns",
        "date",
        "null",
        "enough",
        "hosts",
        "fast"
      ],
      "references": [
        "Sprouts Farmers Market",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print? _gl=1*loeqyip*_ *_gc|_au*MTM5Mjg3NzAwNC4xNzY5MzY30DA2",
        "https://shop.sprouts.com/store/sprouts/flyers/view/weekly/print?",
        "Pegasus | A targets devices are obviously infiltrated",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com",
        "IDS Detections: Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections: Zeppelin_30 ,  Zeppelin_19 ,  ConventionEngine_Term_Desktop ,",
        "Yara Detections: ConventionEngine_Term_Users ,  ConventionEngine_Keyword_Launch ,  Delphi",
        "Alerts: cape_detected_threat https_ urls",
        "IP\u2019s Contacted:  142.250.217.65  142.251.33.110  69.42.215.252",
        "Domains Contacted: xred.mooo.com freedns.afraid.org docs.google.com crls.pki.goog",
        "Domains Contacted: drive.usercontent.google.com",
        "ConventionEngine_Anomaly_MultiPDB_Double",
        "https://jviwczq.zc-apple.com/",
        "SUSP_NET_NAME_ConfuserEx ConfuserEx AssemblyTitle dbgdetect_files siCe ntIce dbgdetect DotNET_ConfuserEx",
        "Registrar: JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD,",
        "Malware Hosting: 13.107.226.70",
        "Scanning Host: 13.107.246.70",
        "https://blog.endgames.com/ \u2022  https://pages.endgames.com \u2022 https://www.endgames.com",
        "http://www.endgames.com \u2022 http://www.endgames.com/ \u2022 https://blog.endgames.com  \u2022 http://pages.endgames.com/",
        "pages.endgames.com\u2022 http://blog.endgames.com \u2022 http://blog.endgames.com/ \u2022 http://pages.endgames.com",
        "www.endgame.com \u2022 blog.endgames.com \u2022 blog.endgames.us \u2022 blog.endgamesystems.com\t\u2022 www.onyx-ware.com",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com \u2022 https://www.endgamesystems.com/",
        "endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "endgames.us \u2022 endgames.com \u2022 endgamesystems.com \u2022 http://www.endgames.us \u2022 http://www.endgames.us/",
        "https://wg41xm05b3.endgamesystems.com \u2022 http://blog.endgames.us/ \u2022 http://blog.endgames.us",
        "https://blog.endgamesystems.com \u2022 https://blog.endgamesystems.com/ \u2022 https://httpswww.endgamesystems.com",
        "https://blog.endgames.us \u2022 https://blog.endgames.us/ \u2022 https://www.endgames.us \u2022 https://www.endgames.us/",
        "wg41xm05b3.endgamesystems.com \u2022 http://blog.endgamesystems.com \u2022 http://blog.endgamesystems.com/",
        "http://httpswww.endgamesystems.com \u2022 http://wg41xm05b3.endgamesystems.com \u2022 http://www.endgamesystems.com/",
        "http://wg41xm05b3.endgamesystems.com/ \u2022http://www.endgamesystems.com",
        "sprouts@em.sprouts.com?",
        "http://blackrock.work.gd/",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io/",
        "blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "https://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "http://blackbox-exporter.lenovo-k8s.home.local.advena.io",
        "supplierportal.gov2x.com",
        "http://wonporn.com/top/Pakistani_Sucking",
        "https://embed-nl.pornoperso.com/storage/videos/l/o/lottie/lottie-moss-nude-spreading-it-open-wide-fo",
        "https://otx.alienvault.com/indicator/url/https://sl.trustedtechteam.com/t/112341/opt_out/25cf6e0a-4f09-4066-ac1d-ded32587a303",
        "supply.qld.gov.au",
        "okta-dev.gov2x.com",
        "verify.gov.tl",
        "api.optimizer.insitemaxdev.gov2x.com",
        "iot.insitemaxdev.gov2x.com",
        "https://kb.drakesoftware.com/Site/Browse/15183/State",
        "https://support.drakesoftware.com/oidc-callback&response_mode=query&response_type=code&scope=openid openid profile email&state=OpenIdConnect.AuthenticationProperties=VWCAd8SYI908zOmw3cLV0bBiMQ-qzTmuLAOEu1zXcvGui69s75FlxoGyoi9h1TNe6C5MlboHQM_xJqlqHjIBmxbRn-oJzJr3TfLSdIw_joIphiQwbzCTE1_5-elZiRtGglrbVEqQCSBFbo3AlcHMdEQyyO_3brHjBAm4yhRw04eEYb4DhQTrBumIoEyEAsxDnnhElMDx7h6lPliA_JWZW3IabbYj5k8oFf9lS-XgQAqEkYbPRkhT8d96uNjSlex7BcM0Ug&nonce=639003960753552218.MGNhMjllMTktYTA3My00NzUzLTljYjUtNzNkNzM0NTA0OGEyZTZlYmZjYW",
        "freedns.afraid.org",
        "https://hello.riskxchange.co/api/mailings/unsubscribe",
        "Sabey , Ahmann, Quasi Government, Government"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Emotet-9850453-0",
          "display_name": "Win.Trojan.Emotet-9850453-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "#LowFI:HookwowLow",
          "display_name": "#LowFI:HookwowLow",
          "target": null
        },
        {
          "id": "Win.Trojan.CobaltStrike-9044898-1",
          "display_name": "Win.Trojan.CobaltStrike-9044898-1",
          "target": null
        },
        {
          "id": "Win.Trojan.VBGeneric-6735875-0",
          "display_name": "Win.Trojan.VBGeneric-6735875-0",
          "target": null
        },
        {
          "id": "SLF:Win64/CobPipe.A",
          "display_name": "SLF:Win64/CobPipe.A",
          "target": "/malware/SLF:Win64/CobPipe.A"
        },
        {
          "id": "ALF:Program:Win32/Webcompanion",
          "display_name": "ALF:Program:Win32/Webcompanion",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "ALF:Trojan:Win32/Anorocuriv.A",
          "display_name": "ALF:Trojan:Win32/Anorocuriv.A",
          "target": null
        },
        {
          "id": "Sf:ShellCode-AU\\ [Trj]",
          "display_name": "Sf:ShellCode-AU\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Pushdo-15",
          "display_name": "Win.Trojan.Pushdo-15",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail.BS",
          "display_name": "TrojanDownloader:Win32/Cutwail.BS",
          "target": "/malware/TrojanDownloader:Win32/Cutwail.BS"
        },
        {
          "id": "Win32:Trojano-CHF\\ [Trj]",
          "display_name": "Win32:Trojano-CHF\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Downloader.3867-1",
          "display_name": "Win.Downloader.3867-1",
          "target": null
        },
        {
          "id": "Win32:Evo-gen\\ [Susp]",
          "display_name": "Win32:Evo-gen\\ [Susp]",
          "target": null
        },
        {
          "id": "Virtool:Win32/CeeInject.gen!AH",
          "display_name": "Virtool:Win32/CeeInject.gen!AH",
          "target": "/malware/Virtool:Win32/CeeInject.gen!AH"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1003.003",
          "name": "NTDS",
          "display_name": "T1003.003 - NTDS"
        },
        {
          "id": "T1055.008",
          "name": "Ptrace System Calls",
          "display_name": "T1055.008 - Ptrace System Calls"
        },
        {
          "id": "T1001.003",
          "name": "Protocol Impersonation",
          "display_name": "T1001.003 - Protocol Impersonation"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1564.005",
          "name": "Hidden File System",
          "display_name": "T1564.005 - Hidden File System"
        }
      ],
      "industries": [
        "Retail",
        "Government",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12640,
        "hostname": 4429,
        "email": 7,
        "domain": 1250,
        "FileHash-SHA256": 1633,
        "FileHash-MD5": 278,
        "FileHash-SHA1": 343,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 20597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "53 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650a0b7c9a6b3c5d0a2a3960",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
      "modified": "2023-10-19T14:04:37.381000",
      "created": "2023-09-19T20:58:36.137000",
      "tags": [
        "contacted",
        "threat roundup",
        "execution",
        "ssl certificate",
        "dark web",
        "crypto threat",
        "resolutions",
        "referrer",
        "stealer",
        "quasar",
        "asyncrat",
        "error",
        "social engineering",
        "iPhone phishing",
        "Apple phishing",
        "email phishing",
        "emotet",
        "remote",
        "attacks"
      ],
      "references": [
        "Alienvault OTX",
        "Data Analysis",
        "Online Research",
        "WebTools"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "India"
      ],
      "malware_families": [
        {
          "id": "Backdoor:MSIL/AsyncRAT",
          "display_name": "Backdoor:MSIL/AsyncRAT",
          "target": "/malware/Backdoor:MSIL/AsyncRAT"
        },
        {
          "id": "Backdoor:MSIL/QuasarRat",
          "display_name": "Backdoor:MSIL/QuasarRat",
          "target": "/malware/Backdoor:MSIL/QuasarRat"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1548",
          "name": "Abuse Elevation Control Mechanism",
          "display_name": "T1548 - Abuse Elevation Control Mechanism"
        }
      ],
      "industries": [
        "Media",
        "Social Media",
        "Technology",
        "Hacking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 5791,
        "URL": 11513,
        "domain": 2317,
        "hostname": 3255,
        "CVE": 3
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cv.braun.dev",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cv.braun.dev",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638530.4532795
}