{
  "type": "URL",
  "indicator": "https://forms.static.microsoft/scripts/dists/light-response-page.min.2b58470.js",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://forms.static.microsoft/scripts/dists/light-response-page.min.2b58470.js",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4131753674,
      "indicator": "https://forms.static.microsoft/scripts/dists/light-response-page.min.2b58470.js",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6a04e84167efe8b5fa43e0ca",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-14T01:04:28.762000",
          "created": "2026-05-13T21:08:17.669000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 51,
            "hostname": 147,
            "FileHash-SHA1": 4,
            "domain": 119,
            "URL": 169,
            "IPv4": 282,
            "FileHash-MD5": 3,
            "FileHash-SHA256": 283
          },
          "indicator_count": 1058,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04e8423bba51f1e0ff3030",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-13T22:50:49.596000",
          "created": "2026-05-13T21:08:18.159000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 51,
            "hostname": 147,
            "FileHash-SHA1": 4,
            "domain": 119,
            "URL": 169,
            "IPv4": 281,
            "FileHash-MD5": 3,
            "FileHash-SHA256": 283
          },
          "indicator_count": 1057,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a04e83b9a762101e54d6a4f",
          "name": "cve-2020-0601 + spoof signing",
          "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
          "modified": "2026-05-13T22:50:48.345000",
          "created": "2026-05-13T21:08:11.231000",
          "tags": [
            "indicators show",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "instagram",
            "identifier",
            "cve-2020-0601"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 53,
            "hostname": 147,
            "FileHash-SHA1": 24,
            "domain": 119,
            "URL": 167,
            "IPv4": 281,
            "FileHash-MD5": 15,
            "FileHash-SHA256": 469,
            "Mutex": 2
          },
          "indicator_count": 1277,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ce1c7b60a3065cc75b7e23",
          "name": "Chance Encounter Clone CREDIT: UCP_GoA23 Public - same watering hole?",
          "description": "",
          "modified": "2026-04-21T05:29:42.247000",
          "created": "2026-04-02T07:36:27.829000",
          "tags": [
            "raspberry pi",
            "hdmi",
            "hdmi mode",
            "uncomment",
            "additional",
            "usb mass",
            "pi02",
            "pi zero",
            "zero",
            "enable drm",
            "program",
            "license",
            "free software",
            "foundation",
            "general public",
            "gnu general",
            "public license",
            "the program",
            "copyright",
            "sections",
            "june",
            "general",
            "april",
            "vice",
            "drivers",
            "analog",
            "digital",
            "video",
            "bus support",
            "media",
            "accelerometers",
            "capacitance",
            "resolver",
            "android",
            "flash",
            "monitoring",
            "codec",
            "loop",
            "light",
            "linear",
            "tools",
            "class",
            "speakup",
            "core support",
            "legacy",
            "kernel",
            "this software",
            "including",
            "but not",
            "limited to",
            "ltd all",
            "redistributions",
            "disclaimer",
            "is provided",
            "damage",
            "info",
            "params",
            "gpio",
            "gpio pin",
            "select",
            "digital volume",
            "load",
            "gpios",
            "compute module",
            "spi bus",
            "front",
            "clock",
            "speed",
            "tiny",
            "kali",
            "oled",
            "systemd",
            "digi",
            "miso",
            "screen",
            "show",
            "global property",
            "bootmenu",
            "label",
            "booting",
            "please",
            "javascript",
            "entity",
            "file list",
            "size first",
            "credits text",
            "readme text",
            "no meaningful",
            "url list",
            "status https",
            "domain list",
            "enom",
            "registrar",
            "ltd dba",
            "com laude",
            "ip address",
            "ip adresses",
            "U of A",
            "GoA",
            "Treaty 6",
            "Treaty 7",
            "Treaty 8",
            "AHS"
          ],
          "references": [
            "cmdline.txt",
            "config.txt",
            "COPYING.linux",
            "config-5.15.44-Re4son-v7+",
            "config-5.15.44-Re4son-v7l+",
            "config-5.15.44-Re4son-v8l+",
            "config-5.15.44-Re4son+",
            "config-5.15.44-Re4son-v8+",
            "grub_background.sh",
            "LICENCE.broadcom",
            "README",
            "theme.txt",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
            "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1050",
              "name": "New Service",
              "display_name": "T1050 - New Service"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [
            "Education",
            "Government",
            "Healthcare",
            "Telecommunications",
            "Agriculture",
            "Finance",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": "698f07428f6e35876e034e41",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 812,
            "URL": 2492,
            "hostname": 1171,
            "FileHash-SHA256": 2057,
            "CVE": 2,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 16,
            "email": 2,
            "CIDR": 118
          },
          "indicator_count": 6684,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "41 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "698f07428f6e35876e034e41",
          "name": "Chance Encounter Commuting from U of A to GoA - 02.13.2026",
          "description": "My 1st Graph: Hidden Boots on my Phone ( Chance Encounter Commuting from U of A to GoA - 02.13.2026 ). \nConclusion: U of A and the Governments of Alberta, and those of Treaty 6/7/8 have been victims of crime.\nhttps://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
          "modified": "2026-03-15T10:19:15.579000",
          "created": "2026-02-13T11:13:03.870000",
          "tags": [
            "raspberry pi",
            "hdmi",
            "hdmi mode",
            "uncomment",
            "additional",
            "usb mass",
            "pi02",
            "pi zero",
            "zero",
            "enable drm",
            "program",
            "license",
            "free software",
            "foundation",
            "general public",
            "gnu general",
            "public license",
            "the program",
            "copyright",
            "sections",
            "june",
            "general",
            "april",
            "vice",
            "drivers",
            "analog",
            "digital",
            "video",
            "bus support",
            "media",
            "accelerometers",
            "capacitance",
            "resolver",
            "android",
            "flash",
            "monitoring",
            "codec",
            "loop",
            "light",
            "linear",
            "tools",
            "class",
            "speakup",
            "core support",
            "legacy",
            "kernel",
            "this software",
            "including",
            "but not",
            "limited to",
            "ltd all",
            "redistributions",
            "disclaimer",
            "is provided",
            "damage",
            "info",
            "params",
            "gpio",
            "gpio pin",
            "select",
            "digital volume",
            "load",
            "gpios",
            "compute module",
            "spi bus",
            "front",
            "clock",
            "speed",
            "tiny",
            "kali",
            "oled",
            "systemd",
            "digi",
            "miso",
            "screen",
            "show",
            "global property",
            "bootmenu",
            "label",
            "booting",
            "please",
            "javascript",
            "entity",
            "file list",
            "size first",
            "credits text",
            "readme text",
            "no meaningful",
            "url list",
            "status https",
            "domain list",
            "enom",
            "registrar",
            "ltd dba",
            "com laude",
            "ip address",
            "ip adresses",
            "U of A",
            "GoA",
            "Treaty 6",
            "Treaty 7",
            "Treaty 8",
            "AHS"
          ],
          "references": [
            "cmdline.txt",
            "config.txt",
            "COPYING.linux",
            "config-5.15.44-Re4son-v7+",
            "config-5.15.44-Re4son-v7l+",
            "config-5.15.44-Re4son-v8l+",
            "config-5.15.44-Re4son+",
            "config-5.15.44-Re4son-v8+",
            "grub_background.sh",
            "LICENCE.broadcom",
            "README",
            "theme.txt",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
            "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
            "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
            "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1050",
              "name": "New Service",
              "display_name": "T1050 - New Service"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [
            "Education",
            "Government",
            "Healthcare",
            "Telecommunications",
            "Agriculture",
            "Finance",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "UCP_GoA23",
            "id": "382539",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 812,
            "URL": 2492,
            "hostname": 1171,
            "FileHash-SHA256": 2057,
            "CVE": 2,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 16,
            "email": 2,
            "CIDR": 118
          },
          "indicator_count": 6684,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 20,
          "modified_text": "77 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "698037098c99c37cb91037c2",
          "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
          "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
          "modified": "2026-03-04T04:07:14.513000",
          "created": "2026-02-02T05:32:57.303000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "domain",
            "hostname",
            "filehashmd5",
            "filehashsha1",
            "iocs",
            "url https",
            "search",
            "type indicator",
            "review iocs",
            "role title",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "extraction",
            "sc data",
            "extre data",
            "include review",
            "exclude sugges",
            "data upload",
            "failed",
            "find s",
            "oo data",
            "enter source",
            "url or",
            "text drag",
            "expiration",
            "showing",
            "entries",
            "protect",
            "pulse show",
            "email abuse",
            "related pulses",
            "indicator role",
            "returnurl no",
            "drop",
            "pulse provide",
            "public tlp",
            "green",
            "adversary tags",
            "buzz",
            "x8664",
            "add tag",
            "groups add",
            "add industry",
            "trojan",
            "tags"
          ],
          "references": [
            "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
            "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
            "Antivirus Detections: Trojan:Win32/Dorv.A",
            "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
            "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
            "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
            "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
            "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
            "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
            "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
            "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
            "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
            "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
            "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
            "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
            "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
            "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
            "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
            "Antivirus Detections: Win.Malware.Pits-10035540-0",
            "Yara: Detections Delphi",
            "Alerts: infostealer_cookies antiav_detectfile",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
            "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
            "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
            "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
            "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
            "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
            "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
            "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
            "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
            "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
            "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
            "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
            "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
            "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
            "https://cpcontacts.apple4you.it",
            "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
            "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
            "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
            "https://fs25.mygamesteam.com/download/underground-parking/",
            "http://spiritzuridgerunelahubcloudgusparkx.rest/",
            "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
            "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
            "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
            "IDS Detections: Suspicious Activity potential UPnProxy",
            "Yara Detections: is__elf ,  ECHOBOT",
            "Alerts: dead_host network_icmp tcp_by",
            "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
            "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
            "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
            "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
            "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
            "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
            "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
            "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
            "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
            "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
            "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
            "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
            "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
            "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
            "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
            "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
            "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
            "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
            "TAGS: sample analysis se domains search security quic add source level span spawns spy",
            "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
            "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
            "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Hungary"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "DDos:Linux/Gafgyt.YA!MTB",
              "display_name": "DDos:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "ELF:DDoS-S\\ [Trj]",
              "display_name": "ELF:DDoS-S\\ [Trj]",
              "target": null
            },
            {
              "id": "Pykspa.C",
              "display_name": "Pykspa.C",
              "target": null
            },
            {
              "id": "Trojan:Win32/Dorv.A",
              "display_name": "Trojan:Win32/Dorv.A",
              "target": "/malware/Trojan:Win32/Dorv.A"
            },
            {
              "id": "Unix.Trojan.Gafgyt-698115",
              "display_name": "Unix.Trojan.Gafgyt-698115",
              "target": null
            },
            {
              "id": "4-0 Win.Malware.Pits-10035540-0",
              "display_name": "4-0 Win.Malware.Pits-10035540-0",
              "target": null
            },
            {
              "id": "Win.Packed.Usteal-7531303-0",
              "display_name": "Win.Packed.Usteal-7531303-0",
              "target": null
            },
            {
              "id": "tR",
              "display_name": "tR",
              "target": null
            },
            {
              "id": "DeathHiddenTear (Large&Small HT)   >",
              "display_name": "DeathHiddenTear (Large&Small HT)   >",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1608",
              "name": "Stage Capabilities",
              "display_name": "T1608 - Stage Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1586,
            "FileHash-SHA1": 1479,
            "FileHash-SHA256": 1938,
            "URL": 4548,
            "domain": 1052,
            "hostname": 2501,
            "email": 9,
            "SSLCertFingerprint": 7,
            "CIDR": 2
          },
          "indicator_count": 13122,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68cb233ba91aa1eb958b3f31",
          "name": "Home - RMHS | APT 10 \u2022 Andromeda \u2022  OneLouder",
          "description": "I don\u2019t even know what to say. I\u2019ve received several complaints. This is 2nd time checking out technical issues that do exist. Operates as a Human Service entity for injured persons. OTX auto populated \u2018Golfing\u2019 as industry. \n\nDoes serve the severely disabled population. Does pay caregivers. Possibly a front page a FF link page, I have no idea",
          "modified": "2025-10-17T19:03:15.031000",
          "created": "2025-09-17T21:08:11.518000",
          "tags": [
            "script urls",
            "meta",
            "moved",
            "x tec",
            "passive dns",
            "encrypt",
            "america flag",
            "san francisco",
            "extraction",
            "data upload",
            "type indicatod",
            "united states",
            "a domains",
            "united",
            "gmt server",
            "jose",
            "university",
            "bill",
            "rmhs",
            "information",
            "board",
            "lorin",
            "joseph",
            "all veterans",
            "rocky mountain",
            "mission",
            "vice",
            "april",
            "school",
            "austin",
            "prior",
            "ipv4 add",
            "urls",
            "files",
            "location united",
            "wordpress",
            "rmhs meta",
            "tags viewport",
            "rmhs og",
            "rmhs article",
            "wpbakery page",
            "builder",
            "slider plugin",
            "google tag",
            "mountain human",
            "denver",
            "connecting",
            "denver start",
            "relevance home",
            "providers",
            "contact us",
            "rmhs main",
            "server",
            "redacted tech",
            "redacted admin",
            "registrar abuse",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "dnssec",
            "country",
            "ttl value",
            "graph summary",
            "resolved ips",
            "ip address",
            "port",
            "data",
            "screenshots no",
            "involved direct",
            "country name",
            "name response",
            "tcp connections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "found",
            "spawns",
            "t1590 gather",
            "path",
            "ascii text",
            "exif standard",
            "tiff image",
            "format",
            "stop",
            "false",
            "soldier",
            "model",
            "youth",
            "baby",
            "june",
            "general",
            "local",
            "click",
            "strings",
            "core",
            "warrior",
            "green",
            "emotion",
            "flash",
            "nina",
            "hunk",
            "fono",
            "daam",
            "mitre att",
            "ck techniques",
            "id name",
            "malicious",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "brand",
            "microsoft edge",
            "show process",
            "self",
            "date",
            "comspec",
            "hybrid",
            "form",
            "log id",
            "gmtn",
            "tls web",
            "b2 f6",
            "b0n timestamp",
            "f9401a",
            "record value",
            "x wix",
            "certificate",
            "domain add",
            "pulse submit",
            "body",
            "domain related",
            "blackbox",
            "apple",
            "helix",
            "dvrdns",
            "tracking",
            "remote access",
            "ios",
            "spyware",
            "hoax",
            "dynamicloader",
            "ptls6",
            "medium",
            "flashpix",
            "high",
            "ygjpavclsline",
            "officespace",
            "chartshared",
            "powershell",
            "write",
            "malware",
            "ygjpaulscontext",
            "status",
            "japan unknown",
            "domain",
            "pulses",
            "search",
            "accept",
            "apt10",
            "trojanspy",
            "win32",
            "entries",
            "susp",
            "backdoor",
            "useragent",
            "showing",
            "virtool",
            "twitter",
            "mozilla",
            "trojandropper",
            "trojan",
            "title",
            "onelouder",
            "yara det",
            "maware samoe",
            "genaco x",
            "ids detec",
            "ids terse",
            "win3 data",
            "include review",
            "exclude sugges",
            "targeting",
            "show",
            "copy",
            "reads",
            "dynamic",
            "vendor finding",
            "notes clamav",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "date hash",
            "next yara"
          ],
          "references": [
            "rmhumanservices.org",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
            "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
            "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
            "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
            "https://www.mlkfoundation.net/ (Foundry DGA)",
            "remotewd.com x 34 devices",
            "South Africa based:  remote.advisoroffice.com",
            "acc.lehigtapp.com - malware",
            "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
            "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
            "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
            "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
            "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
            "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
            "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
            "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
            "1.organization.api.powerplatform.partner.microsoftonline.cn",
            "chinaeast2.admin.api.powerautomate.cn",
            "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
            "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
            "ssa-gov.authorizeddns",
            "hmmm\u2026http://palander.stjernstrom.se/",
            "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU"
          ],
          "public": 1,
          "adversary": "APT 10",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APT 10",
              "display_name": "APT 10",
              "target": null
            },
            {
              "id": "OneLouder",
              "display_name": "OneLouder",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Sality",
              "display_name": "Sality",
              "target": null
            },
            {
              "id": "KoobFace",
              "display_name": "KoobFace",
              "target": null
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Nivdort Checkin",
              "display_name": "Nivdort Checkin",
              "target": null
            },
            {
              "id": "Win.Malware.Installcore-6950365-0",
              "display_name": "Win.Malware.Installcore-6950365-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1574.006",
              "name": "Dynamic Linker Hijacking",
              "display_name": "T1574.006 - Dynamic Linker Hijacking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Golfing",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 690,
            "hostname": 1912,
            "URL": 5925,
            "FileHash-SHA1": 273,
            "email": 8,
            "FileHash-SHA256": 3618,
            "CIDR": 3,
            "FileHash-MD5": 254,
            "SSLCertFingerprint": 19,
            "CVE": 2
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "config-5.15.44-Re4son-v7l+",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs",
        "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "ssa-gov.authorizeddns",
        "README",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "Yara: Detections Delphi",
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "Alerts: infostealer_cookies antiav_detectfile",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "config.txt",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "LICENCE.broadcom",
        "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "config-5.15.44-Re4son-v8+",
        "Yara Detections: is__elf ,  ECHOBOT",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "config-5.15.44-Re4son-v7+",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "cmdline.txt",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "remotewd.com x 34 devices",
        "acc.lehigtapp.com - malware",
        "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU",
        "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "config-5.15.44-Re4son+",
        "chinaeast2.admin.api.powerautomate.cn",
        "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "theme.txt",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "https://fs25.mygamesteam.com/download/underground-parking/",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule",
        "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
        "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
        "COPYING.linux",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "https://cpcontacts.apple4you.it",
        "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
        "rmhumanservices.org",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "1.organization.api.powerplatform.partner.microsoftonline.cn",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "Alerts: dead_host network_icmp tcp_by",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "hmmm\u2026http://palander.stjernstrom.se/",
        "grub_background.sh",
        "South Africa based:  remote.advisoroffice.com",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "config-5.15.44-Re4son-v8l+",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "https://www.mlkfoundation.net/ (Foundry DGA)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "APT 10"
          ],
          "malware_families": [
            "4-0 win.malware.pits-10035540-0",
            "Ddos:linux/gafgyt.ya!mtb",
            "Elf:ddos-s\\ [trj]",
            "Unix.trojan.gafgyt-698115",
            "Deathhiddentear (large&small ht)   >",
            "Andromeda",
            "Sality",
            "Onelouder",
            "Koobface",
            "Bayrob",
            "Nivdort checkin",
            "Win.malware.installcore-6950365-0",
            "Trojan:win32/dorv.a",
            "Tr",
            "Pykspa.c",
            "Win.packed.usteal-7531303-0",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Apt 10"
          ],
          "industries": [
            "Transportation",
            "Government",
            "Telecommunications",
            "Golfing",
            "Healthcare",
            "Finance",
            "Education",
            "Agriculture"
          ],
          "unique_indicators": 33838
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/static.microsoft",
    "whois": "http://whois.domaintools.com/static.microsoft",
    "domain": "static.microsoft",
    "hostname": "forms.static.microsoft"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6a04e84167efe8b5fa43e0ca",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-14T01:04:28.762000",
      "created": "2026-05-13T21:08:17.669000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 51,
        "hostname": 147,
        "FileHash-SHA1": 4,
        "domain": 119,
        "URL": 169,
        "IPv4": 282,
        "FileHash-MD5": 3,
        "FileHash-SHA256": 283
      },
      "indicator_count": 1058,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04e8423bba51f1e0ff3030",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-13T22:50:49.596000",
      "created": "2026-05-13T21:08:18.159000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 51,
        "hostname": 147,
        "FileHash-SHA1": 4,
        "domain": 119,
        "URL": 169,
        "IPv4": 281,
        "FileHash-MD5": 3,
        "FileHash-SHA256": 283
      },
      "indicator_count": 1057,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a04e83b9a762101e54d6a4f",
      "name": "cve-2020-0601 + spoof signing",
      "description": "CVE2020-0601 is a Curveball vulnerability that could allow attackers to spoof signatures and is a high cryptographic validation flaw. Per NIST, \"A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability',\".",
      "modified": "2026-05-13T22:50:48.345000",
      "created": "2026-05-13T21:08:11.231000",
      "tags": [
        "indicators show",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "instagram",
        "identifier",
        "cve-2020-0601"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 53,
        "hostname": 147,
        "FileHash-SHA1": 24,
        "domain": 119,
        "URL": 167,
        "IPv4": 281,
        "FileHash-MD5": 15,
        "FileHash-SHA256": 469,
        "Mutex": 2
      },
      "indicator_count": 1277,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ce1c7b60a3065cc75b7e23",
      "name": "Chance Encounter Clone CREDIT: UCP_GoA23 Public - same watering hole?",
      "description": "",
      "modified": "2026-04-21T05:29:42.247000",
      "created": "2026-04-02T07:36:27.829000",
      "tags": [
        "raspberry pi",
        "hdmi",
        "hdmi mode",
        "uncomment",
        "additional",
        "usb mass",
        "pi02",
        "pi zero",
        "zero",
        "enable drm",
        "program",
        "license",
        "free software",
        "foundation",
        "general public",
        "gnu general",
        "public license",
        "the program",
        "copyright",
        "sections",
        "june",
        "general",
        "april",
        "vice",
        "drivers",
        "analog",
        "digital",
        "video",
        "bus support",
        "media",
        "accelerometers",
        "capacitance",
        "resolver",
        "android",
        "flash",
        "monitoring",
        "codec",
        "loop",
        "light",
        "linear",
        "tools",
        "class",
        "speakup",
        "core support",
        "legacy",
        "kernel",
        "this software",
        "including",
        "but not",
        "limited to",
        "ltd all",
        "redistributions",
        "disclaimer",
        "is provided",
        "damage",
        "info",
        "params",
        "gpio",
        "gpio pin",
        "select",
        "digital volume",
        "load",
        "gpios",
        "compute module",
        "spi bus",
        "front",
        "clock",
        "speed",
        "tiny",
        "kali",
        "oled",
        "systemd",
        "digi",
        "miso",
        "screen",
        "show",
        "global property",
        "bootmenu",
        "label",
        "booting",
        "please",
        "javascript",
        "entity",
        "file list",
        "size first",
        "credits text",
        "readme text",
        "no meaningful",
        "url list",
        "status https",
        "domain list",
        "enom",
        "registrar",
        "ltd dba",
        "com laude",
        "ip address",
        "ip adresses",
        "U of A",
        "GoA",
        "Treaty 6",
        "Treaty 7",
        "Treaty 8",
        "AHS"
      ],
      "references": [
        "cmdline.txt",
        "config.txt",
        "COPYING.linux",
        "config-5.15.44-Re4son-v7+",
        "config-5.15.44-Re4son-v7l+",
        "config-5.15.44-Re4son-v8l+",
        "config-5.15.44-Re4son+",
        "config-5.15.44-Re4son-v8+",
        "grub_background.sh",
        "LICENCE.broadcom",
        "README",
        "theme.txt",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1050",
          "name": "New Service",
          "display_name": "T1050 - New Service"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [
        "Education",
        "Government",
        "Healthcare",
        "Telecommunications",
        "Agriculture",
        "Finance",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": "698f07428f6e35876e034e41",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 812,
        "URL": 2492,
        "hostname": 1171,
        "FileHash-SHA256": 2057,
        "CVE": 2,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 16,
        "email": 2,
        "CIDR": 118
      },
      "indicator_count": 6684,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "41 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "698f07428f6e35876e034e41",
      "name": "Chance Encounter Commuting from U of A to GoA - 02.13.2026",
      "description": "My 1st Graph: Hidden Boots on my Phone ( Chance Encounter Commuting from U of A to GoA - 02.13.2026 ). \nConclusion: U of A and the Governments of Alberta, and those of Treaty 6/7/8 have been victims of crime.\nhttps://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
      "modified": "2026-03-15T10:19:15.579000",
      "created": "2026-02-13T11:13:03.870000",
      "tags": [
        "raspberry pi",
        "hdmi",
        "hdmi mode",
        "uncomment",
        "additional",
        "usb mass",
        "pi02",
        "pi zero",
        "zero",
        "enable drm",
        "program",
        "license",
        "free software",
        "foundation",
        "general public",
        "gnu general",
        "public license",
        "the program",
        "copyright",
        "sections",
        "june",
        "general",
        "april",
        "vice",
        "drivers",
        "analog",
        "digital",
        "video",
        "bus support",
        "media",
        "accelerometers",
        "capacitance",
        "resolver",
        "android",
        "flash",
        "monitoring",
        "codec",
        "loop",
        "light",
        "linear",
        "tools",
        "class",
        "speakup",
        "core support",
        "legacy",
        "kernel",
        "this software",
        "including",
        "but not",
        "limited to",
        "ltd all",
        "redistributions",
        "disclaimer",
        "is provided",
        "damage",
        "info",
        "params",
        "gpio",
        "gpio pin",
        "select",
        "digital volume",
        "load",
        "gpios",
        "compute module",
        "spi bus",
        "front",
        "clock",
        "speed",
        "tiny",
        "kali",
        "oled",
        "systemd",
        "digi",
        "miso",
        "screen",
        "show",
        "global property",
        "bootmenu",
        "label",
        "booting",
        "please",
        "javascript",
        "entity",
        "file list",
        "size first",
        "credits text",
        "readme text",
        "no meaningful",
        "url list",
        "status https",
        "domain list",
        "enom",
        "registrar",
        "ltd dba",
        "com laude",
        "ip address",
        "ip adresses",
        "U of A",
        "GoA",
        "Treaty 6",
        "Treaty 7",
        "Treaty 8",
        "AHS"
      ],
      "references": [
        "cmdline.txt",
        "config.txt",
        "COPYING.linux",
        "config-5.15.44-Re4son-v7+",
        "config-5.15.44-Re4son-v7l+",
        "config-5.15.44-Re4son-v8l+",
        "config-5.15.44-Re4son+",
        "config-5.15.44-Re4son-v8+",
        "grub_background.sh",
        "LICENCE.broadcom",
        "README",
        "theme.txt",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/details",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/relations",
        "https://www.virustotal.com/gui/file/4b2f7e790d88a330808e6b2a81c8ea81268f69eb6c10ad4beccf2063158d0423/behavior",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e",
        "https://www.virustotal.com/graph/embed/g24019548c37d405da58015e7220072ab73c17ac93ac14e538e1f4535dda6c615?theme=dark",
        "https://www.virustotal.com/gui/collection/cd709a94571c706f4c86a2432508b5fa9e3618a4ba42f5773306208a431ae01e/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1050",
          "name": "New Service",
          "display_name": "T1050 - New Service"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [
        "Education",
        "Government",
        "Healthcare",
        "Telecommunications",
        "Agriculture",
        "Finance",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "UCP_GoA23",
        "id": "382539",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 812,
        "URL": 2492,
        "hostname": 1171,
        "FileHash-SHA256": 2057,
        "CVE": 2,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 16,
        "email": 2,
        "CIDR": 118
      },
      "indicator_count": 6684,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 20,
      "modified_text": "77 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "698037098c99c37cb91037c2",
      "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
      "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
      "modified": "2026-03-04T04:07:14.513000",
      "created": "2026-02-02T05:32:57.303000",
      "tags": [
        "no expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "domain",
        "hostname",
        "filehashmd5",
        "filehashsha1",
        "iocs",
        "url https",
        "search",
        "type indicator",
        "review iocs",
        "role title",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "extraction",
        "sc data",
        "extre data",
        "include review",
        "exclude sugges",
        "data upload",
        "failed",
        "find s",
        "oo data",
        "enter source",
        "url or",
        "text drag",
        "expiration",
        "showing",
        "entries",
        "protect",
        "pulse show",
        "email abuse",
        "related pulses",
        "indicator role",
        "returnurl no",
        "drop",
        "pulse provide",
        "public tlp",
        "green",
        "adversary tags",
        "buzz",
        "x8664",
        "add tag",
        "groups add",
        "add industry",
        "trojan",
        "tags"
      ],
      "references": [
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "Yara: Detections Delphi",
        "Alerts: infostealer_cookies antiav_detectfile",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "https://cpcontacts.apple4you.it",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "https://fs25.mygamesteam.com/download/underground-parking/",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "Yara Detections: is__elf ,  ECHOBOT",
        "Alerts: dead_host network_icmp tcp_by",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Hungary"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "DDos:Linux/Gafgyt.YA!MTB",
          "display_name": "DDos:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "ELF:DDoS-S\\ [Trj]",
          "display_name": "ELF:DDoS-S\\ [Trj]",
          "target": null
        },
        {
          "id": "Pykspa.C",
          "display_name": "Pykspa.C",
          "target": null
        },
        {
          "id": "Trojan:Win32/Dorv.A",
          "display_name": "Trojan:Win32/Dorv.A",
          "target": "/malware/Trojan:Win32/Dorv.A"
        },
        {
          "id": "Unix.Trojan.Gafgyt-698115",
          "display_name": "Unix.Trojan.Gafgyt-698115",
          "target": null
        },
        {
          "id": "4-0 Win.Malware.Pits-10035540-0",
          "display_name": "4-0 Win.Malware.Pits-10035540-0",
          "target": null
        },
        {
          "id": "Win.Packed.Usteal-7531303-0",
          "display_name": "Win.Packed.Usteal-7531303-0",
          "target": null
        },
        {
          "id": "tR",
          "display_name": "tR",
          "target": null
        },
        {
          "id": "DeathHiddenTear (Large&Small HT)   >",
          "display_name": "DeathHiddenTear (Large&Small HT)   >",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1608",
          "name": "Stage Capabilities",
          "display_name": "T1608 - Stage Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1586,
        "FileHash-SHA1": 1479,
        "FileHash-SHA256": 1938,
        "URL": 4548,
        "domain": 1052,
        "hostname": 2501,
        "email": 9,
        "SSLCertFingerprint": 7,
        "CIDR": 2
      },
      "indicator_count": 13122,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68cb233ba91aa1eb958b3f31",
      "name": "Home - RMHS | APT 10 \u2022 Andromeda \u2022  OneLouder",
      "description": "I don\u2019t even know what to say. I\u2019ve received several complaints. This is 2nd time checking out technical issues that do exist. Operates as a Human Service entity for injured persons. OTX auto populated \u2018Golfing\u2019 as industry. \n\nDoes serve the severely disabled population. Does pay caregivers. Possibly a front page a FF link page, I have no idea",
      "modified": "2025-10-17T19:03:15.031000",
      "created": "2025-09-17T21:08:11.518000",
      "tags": [
        "script urls",
        "meta",
        "moved",
        "x tec",
        "passive dns",
        "encrypt",
        "america flag",
        "san francisco",
        "extraction",
        "data upload",
        "type indicatod",
        "united states",
        "a domains",
        "united",
        "gmt server",
        "jose",
        "university",
        "bill",
        "rmhs",
        "information",
        "board",
        "lorin",
        "joseph",
        "all veterans",
        "rocky mountain",
        "mission",
        "vice",
        "april",
        "school",
        "austin",
        "prior",
        "ipv4 add",
        "urls",
        "files",
        "location united",
        "wordpress",
        "rmhs meta",
        "tags viewport",
        "rmhs og",
        "rmhs article",
        "wpbakery page",
        "builder",
        "slider plugin",
        "google tag",
        "mountain human",
        "denver",
        "connecting",
        "denver start",
        "relevance home",
        "providers",
        "contact us",
        "rmhs main",
        "server",
        "redacted tech",
        "redacted admin",
        "registrar abuse",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "dnssec",
        "country",
        "ttl value",
        "graph summary",
        "resolved ips",
        "ip address",
        "port",
        "data",
        "screenshots no",
        "involved direct",
        "country name",
        "name response",
        "tcp connections",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "found",
        "spawns",
        "t1590 gather",
        "path",
        "ascii text",
        "exif standard",
        "tiff image",
        "format",
        "stop",
        "false",
        "soldier",
        "model",
        "youth",
        "baby",
        "june",
        "general",
        "local",
        "click",
        "strings",
        "core",
        "warrior",
        "green",
        "emotion",
        "flash",
        "nina",
        "hunk",
        "fono",
        "daam",
        "mitre att",
        "ck techniques",
        "id name",
        "malicious",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "brand",
        "microsoft edge",
        "show process",
        "self",
        "date",
        "comspec",
        "hybrid",
        "form",
        "log id",
        "gmtn",
        "tls web",
        "b2 f6",
        "b0n timestamp",
        "f9401a",
        "record value",
        "x wix",
        "certificate",
        "domain add",
        "pulse submit",
        "body",
        "domain related",
        "blackbox",
        "apple",
        "helix",
        "dvrdns",
        "tracking",
        "remote access",
        "ios",
        "spyware",
        "hoax",
        "dynamicloader",
        "ptls6",
        "medium",
        "flashpix",
        "high",
        "ygjpavclsline",
        "officespace",
        "chartshared",
        "powershell",
        "write",
        "malware",
        "ygjpaulscontext",
        "status",
        "japan unknown",
        "domain",
        "pulses",
        "search",
        "accept",
        "apt10",
        "trojanspy",
        "win32",
        "entries",
        "susp",
        "backdoor",
        "useragent",
        "showing",
        "virtool",
        "twitter",
        "mozilla",
        "trojandropper",
        "trojan",
        "title",
        "onelouder",
        "yara det",
        "maware samoe",
        "genaco x",
        "ids detec",
        "ids terse",
        "win3 data",
        "include review",
        "exclude sugges",
        "targeting",
        "show",
        "copy",
        "reads",
        "dynamic",
        "vendor finding",
        "notes clamav",
        "files matching",
        "number",
        "sample analysis",
        "hide samples",
        "date hash",
        "next yara"
      ],
      "references": [
        "rmhumanservices.org",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
        "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
        "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
        "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
        "https://www.mlkfoundation.net/ (Foundry DGA)",
        "remotewd.com x 34 devices",
        "South Africa based:  remote.advisoroffice.com",
        "acc.lehigtapp.com - malware",
        "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
        "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
        "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
        "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
        "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
        "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
        "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
        "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
        "1.organization.api.powerplatform.partner.microsoftonline.cn",
        "chinaeast2.admin.api.powerautomate.cn",
        "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
        "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
        "ssa-gov.authorizeddns",
        "hmmm\u2026http://palander.stjernstrom.se/",
        "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU"
      ],
      "public": 1,
      "adversary": "APT 10",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APT 10",
          "display_name": "APT 10",
          "target": null
        },
        {
          "id": "OneLouder",
          "display_name": "OneLouder",
          "target": null
        },
        {
          "id": "Andromeda",
          "display_name": "Andromeda",
          "target": null
        },
        {
          "id": "Sality",
          "display_name": "Sality",
          "target": null
        },
        {
          "id": "KoobFace",
          "display_name": "KoobFace",
          "target": null
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Nivdort Checkin",
          "display_name": "Nivdort Checkin",
          "target": null
        },
        {
          "id": "Win.Malware.Installcore-6950365-0",
          "display_name": "Win.Malware.Installcore-6950365-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1574.006",
          "name": "Dynamic Linker Hijacking",
          "display_name": "T1574.006 - Dynamic Linker Hijacking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Golfing",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 690,
        "hostname": 1912,
        "URL": 5925,
        "FileHash-SHA1": 273,
        "email": 8,
        "FileHash-SHA256": 3618,
        "CIDR": 3,
        "FileHash-MD5": 254,
        "SSLCertFingerprint": 19,
        "CVE": 2
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://forms.static.microsoft/scripts/dists/light-response-page.min.2b58470.js",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://forms.static.microsoft/scripts/dists/light-response-page.min.2b58470.js",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780297233.110008
}