{ "type": "URL", "indicator": "https://gcloud.contrareturnsm.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://gcloud.contrareturnsm.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3471237234, "indicator": "https://gcloud.contrareturnsm.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 22, "pulses": [ { "id": "657093fc5e8c659c7e5cb095", "name": "cant do wrong 4 right \ud83e\udd37\u200d\u2640\ufe0f maybe it should be left", "description": "", "modified": "2023-12-06T15:32:12.609000", "created": "2023-12-06T15:32:12.609000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 663, "domain": 19, "hostname": 74, "URL": 140 }, "indicator_count": 896, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657093b1ae988bb54a2c07ca", "name": "93.140.190.0 2017 Google Error due to many redirects presents 93.140.190.0 as being my ip which is incorrect", "description": "", "modified": "2023-12-06T15:30:57.239000", "created": "2023-12-06T15:30:57.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1366, "hostname": 1331, "URL": 3507, "domain": 457, "FileHash-MD5": 1 }, "indicator_count": 6663, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570913a03b8f1cdc6abe32e", "name": "btloader.com - yep clean as a babies bum", "description": "", "modified": "2023-12-06T15:20:26.615000", "created": "2023-12-06T15:20:26.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 546, "domain": 162, "URL": 1042, "hostname": 282, "FileHash-MD5": 251, "FileHash-SHA1": 224 }, "indicator_count": 2507, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090fe5e8c659c7e5cb094", "name": "http://e.ca/?e.ca=!1:f.stopPropagation - is there no end to this shit RU/CN/UA/GB/ net sh", "description": "", "modified": "2023-12-06T15:19:26.152000", "created": "2023-12-06T15:19:26.152000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1091, "hostname": 702, "URL": 1728, "domain": 279, "CVE": 2, "FileHash-MD5": 50, "FileHash-SHA1": 46 }, "indicator_count": 3898, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090e5dc9b2e91369b6c56", "name": "bunch of KR muck", "description": "", "modified": "2023-12-06T15:19:01.428000", "created": "2023-12-06T15:19:01.428000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 632, "hostname": 227, "domain": 101, "URL": 496 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090132deb7fd89b09d555", "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns", "description": "", "modified": "2023-12-06T15:15:31.177000", "created": "2023-12-06T15:15:31.177000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 825, "domain": 308, "URL": 2036, "FileHash-SHA256": 2141 }, "indicator_count": 5310, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708fdef7d4b5483117bb67", "name": "BINGO \ud83d\udea8\ud83d\udea8\ud83d\udea8 VT Graph json upload of UBotBrowser.exe - 20.99.132.105 - 33 collections - minecraft instances", "description": "", "modified": "2023-12-06T15:14:38.824000", "created": "2023-12-06T15:14:38.824000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 812, "domain": 110, "hostname": 502, "URL": 1437 }, "indicator_count": 2861, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6399cfd2a2e42a91e57cc82a", "name": "KR Crypto Theft I guess via jotform and api.signalone.com - makes total sense to 4 both domains", "description": "How much do you want to know about the Airdrop Giveaway and how much of your prize money will be sent to the winner in a free Jotform-style giveaway?", "modified": "2023-01-13T13:02:29.978000", "created": "2022-12-14T13:29:54.052000", "tags": [ "next submit", "press enter", "select", "request", "withdraw nft", "issue wallet", "connect unable", "form", "enter", "jotform", "api.onesignal.com" ], "references": [ "https://form.jotform.com/kiheli2856/AirdropGiveaway", "api.onesgnal.cm", "with \"www\" and without \"www\"" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 450, "hostname": 77, "URL": 322, "domain": 17, "FileHash-MD5": 45, "FileHash-SHA1": 45 }, "indicator_count": 956, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1192 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "638fef9c0dc3cca2cff5ac42", "name": "coldzone.tk - btcvip.com - Tweet", "description": "", "modified": "2023-01-05T18:10:20.257000", "created": "2022-12-07T01:42:52.861000", "tags": [ "coldzone.tk", "btcvip.com" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 642, "URL": 470, "hostname": 208, "domain": 65 }, "indicator_count": 1385, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1200 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6383a7be1bcdf0dc1c023475", "name": "Part 2 of 10.0.0.172 - com.sina.weibo - this is very very BAD", "description": "So many relative ioc's from my own cache poisoning on windows in early 2016", "modified": "2022-12-27T17:03:27.434000", "created": "2022-11-27T18:09:02.710000", "tags": [ "ansi", "analysis", "memoryfile scan", "dropped file", "found", "indicator", "text", "sha1", "seen", "static parser", "android", "hybrid", "suspicious", "strings", "insert", "error", "https://ucdl.25pp.com/2014/03/29/1396060230_011736131353.apk?q", "https://www.virustotal.com/gui/url/31a0fc66018b2d3f1eac84925b75c", "https://www.virustotal.com/graph/g9c436978fc00498db5d80e1e40dca5" ], "references": [ "platformflow.staging.mambucloud.com", "https://ucdl.25pp.com/2014/03/29/1396060230_011736131353.apk?q", "https://www.virustotal.com/gui/url/31a0fc66018b2d3f1eac84925b75c449a1320cfe66645d3714daeec292e3b9e5/details", "https://www.virustotal.com/graph/g9c436978fc00498db5d80e1e40dca510e9b90f67e36d4597a25f55b55926ff5c", "https://hybrid-analysis.com/sample/4af9320f9bcbf6e68edef4c637ae724c539a2bb79aacbf0e18aaef86bc607e33" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1213", "name": "Data from Information Repositories", "display_name": "T1213 - Data from Information Repositories" }, { "id": "T1420", "name": "File and Directory Discovery", "display_name": "T1420 - File and Directory Discovery" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1540", "name": "Code Injection", "display_name": "T1540 - Code Injection" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1074, "hostname": 327, "FileHash-SHA256": 621, "domain": 72, "FileHash-MD5": 6, "FileHash-SHA1": 6, "SSLCertFingerprint": 1 }, "indicator_count": 2107, "is_author": false, "is_subscribing": null, "subscriber_count": 391, "modified_text": "1209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63717098512d7f822d066fdb", "name": "cant do wrong 4 right \ud83e\udd37\u200d\u2640\ufe0f maybe it should be left", "description": "", "modified": "2022-12-13T23:03:35.373000", "created": "2022-11-13T22:32:56.257000", "tags": [ "export json", "all types", "all detections", "close copy" ], "references": [ "pecompact cve-2008-2938 cve-2009-1535 cve-2009-0233 cve-2001-0260 contains-elf cve-2008-1447 cve-1999-0016 armadillo contains-embedded-js upx cve-2005-0560 xorcrypt winzip cve-2016-2569 upack contains-pe cve-2010-0806", "https://www.virustotal.com/graph/gbdd5a9e5527f4e80bbf32e0473e08bf56bd9e3da804944b18decfa7847796fc4" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 74, "URL": 140, "domain": 19, "FileHash-SHA256": 663 }, "indicator_count": 896, "is_author": false, "is_subscribing": null, "subscriber_count": 391, "modified_text": "1222 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6367ff6703a140789869f2de", "name": "93.140.190.0 2017 Google Error due to many redirects presents 93.140.190.0 as being my ip which is incorrect", "description": "contains a recent campaign targetting Poland domains from Sept 2022\nVN \nmany nasty .exe old but many still used in comms", "modified": "2022-12-06T18:00:30.682000", "created": "2022-11-06T18:39:35.884000", "tags": [ "93.140.190.0", "September PL infection", "VN domain malware from 2013", "https://www.virustotal.com/graph/embed/g04c1c4343dff4977a4d6b22d", "https://www.virustotal.com/gui/collection/70e122270a95cbc415c33f" ], "references": [ "g04c1c4343dff4977a4d6b22d125a1505f3d2798b3f3745bf853914b4d39f2f56.json", "https://www.virustotal.com/graph/embed/g04c1c4343dff4977a4d6b22d125a1505f3d2798b3f3745bf853914b4d39f2f56", "Collection VT - https://www.virustotal.com/gui/collection/70e122270a95cbc415c33faeb7d72d42b7864f4261dabb6e93c52af0fbc4d533" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3507, "hostname": 1331, "domain": 457, "FileHash-SHA256": 1366, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 6663, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1230 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f5310de81e9c86719c4606", "name": "empr.online", "description": "", "modified": "2022-09-10T00:03:24.542000", "created": "2022-08-11T16:40:45.460000", "tags": [ "naser rony", "alles sehr", "aber zuerst", "zusammen", "nummern", "brnette", "blondine", "es wre", "reply lisa", "parker lisa", "empr.online" ], "references": [ "comments on security weekly from episode on 10 Aug 2022", "Naser Rony Naser Rony 11 hours ago Alles sehr sch\u00f6n. Aber zuerst zusammen die Nummern 10 und 1. Eine empr.ONLINE Br\u00fcnette und eine anderec Blondine. Es w\u00e4re unfair, wenn ich 4 w\u00e4hlen w\u00fcrde REPLY Lisa Parker Lisa Parker 10 hours ago \u2764Only for fans over 18 year\u2935\ufe0f Alles sehr sch\u00f6n. Aber zuerst zusammen die Nummern 10 und 1. Eine warmthhh.Online Br\u00fcnette und eine andere" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 3124, "URL": 5818, "hostname": 2126, "FileHash-SHA256": 1401, "CVE": 3, "FileHash-MD5": 156, "FileHash-SHA1": 135 }, "indicator_count": 12763, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1317 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f2cd9eb0a80cca60963a40", "name": "btloader.com - yep clean as a babies bum", "description": "", "modified": "2022-09-08T00:01:12.540000", "created": "2022-08-09T21:11:58.646000", "tags": [ "dongfangtoutiao", "higeshi", "kuaizip", "\": [ \"http://dl.baofeng.com/baofeng5/bf5_new.exe\" ], \"match\": []" ], "references": [ "g110e315c6ce34a02a043f315490fd5ba3975905f72874717b06e3de696641216.json", "https://www.virustotal.com/graph/g110e315c6ce34a02a043f315490fd5ba3975905f72874717b06e3de696641216" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 162, "hostname": 282, "FileHash-SHA256": 546, "URL": 1042, "FileHash-MD5": 251, "FileHash-SHA1": 224 }, "indicator_count": 2507, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1319 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62ea85a0fe61cd1af7f223a4", "name": "http://e.ca/?e.ca=!1:f.stopPropagation - is there no end to this shit RU/CN/UA/GB/ net sh", "description": "CVE-2021-22941\nCVE-2017-8977", "modified": "2022-09-02T00:00:40.172000", "created": "2022-08-03T14:26:40.603000", "tags": [ "http://e.ca/?e.ca=!1:f.stopPropagation", "CVE-2021-22941", "CVE-2017-8977" ], "references": [ "https://hybrid-analysis.com/sample/82b38c9312deb8005122fb331f52898190ac29e26bd464b169f4c60599836f14/62e9cf2b9226df6fea34c0de", "CVE-2021-22941", "http://e.ca/?e.ca=!1:f.stopPropagation", "CVE-2017-8977", "https://books.google.co.uk/books?id=S3kWAAAAIAAJ&dq=university%2Bof%2Bhuesca&pg=PR3&redir_esc=y#v%3Donepage%26q%3Duniversity%20of%20huesca%26f%3Dfalse" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1091, "hostname": 702, "URL": 1728, "domain": 279, "CVE": 2, "FileHash-MD5": 50, "FileHash-SHA1": 46 }, "indicator_count": 3898, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1325 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e5b8d7e77537fbb1629232", "name": "dnserver.co.kr", "description": "", "modified": "2022-08-29T00:01:52.177000", "created": "2022-07-30T23:03:51.135000", "tags": [ "http://www.qy0531.com/gb513376_1473435.htm", "kr" ], "references": [ "http://www.qy0531.com/gb513376_1473435.htm" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1933, "hostname": 648, "domain": 741, "FileHash-SHA256": 250 }, "indicator_count": 3572, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1329 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e30981f283ef6de2035dce", "name": "bunch of KR muck", "description": "", "modified": "2022-08-27T00:02:51.006000", "created": "2022-07-28T22:11:13.491000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 632, "URL": 496, "hostname": 227, "domain": 101 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1331 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62dd3c2d995db8d35f0b4e48", "name": "How tracker/3rd party abuse translates to much bigger crime netw", "description": "ooo I wonder how much malware is being delivered by numerous means masked in whitelisted and false positive ip's", "modified": "2022-08-23T00:02:12.321000", "created": "2022-07-24T12:33:49.953000", "tags": [], "references": [ "VT graph Json upload to otx", "https://www.virustotal.com/graph/g4655ac448333498bac4fb8b20fed4be62d42ea86d1824fcd9401ba5b30027f57", "can no longer create collections in account - get exceeded api allowance even on just 28 req's in 24 hours", "https://udc-neb.kampyle.com/v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1137, "domain": 138, "hostname": 421, "FileHash-SHA256": 893, "CVE": 1 }, "indicator_count": 2590, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1335 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62c035df9d1c1df8ca3fcaea", "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns", "description": "", "modified": "2022-08-01T00:01:42.977000", "created": "2022-07-02T12:11:11.592000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 825, "FileHash-SHA256": 2141, "domain": 308, "URL": 2036 }, "indicator_count": 5310, "is_author": false, "is_subscribing": null, "subscriber_count": 396, "modified_text": "1357 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62bb7b6820f1de44d02cdc75", "name": "eset.rosconnect.ru -VT Graph JSON upload", "description": "", "modified": "2022-07-28T00:02:14.384000", "created": "2022-06-28T22:06:32.059000", "tags": [ "https://www.virustotal.com/graph/gebaa4d3d53cd4a3ea2559b9b96332a", "CVE-2017-11882" ], "references": [ "CVE-2017-11882", "https://www.virustotal.com/graph/gebaa4d3d53cd4a3ea2559b9b96332ac7139ae27294bc4bc2ba9728cdd62917f9" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "URL": 535, "hostname": 128, "FileHash-SHA256": 236, "domain": 197 }, "indicator_count": 1097, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1361 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62bb08310a8957d97aa23c30", "name": "BINGO \ud83d\udea8\ud83d\udea8\ud83d\udea8 VT Graph json upload of UBotBrowser.exe - 20.99.132.105 - 33 collections - minecraft instances", "description": "", "modified": "2022-07-28T00:02:14.384000", "created": "2022-06-28T13:54:57.927000", "tags": [ "entity", "ubotbrowser", "20.99.132.105", "minecraft" ], "references": [ "https://www.virustotal.com/graph/g57851267a0734f7fab3824bb4cca5cb9afab6573d8fa4b54a4f624390f9ba0bc" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 502, "URL": 1437, "domain": 110, "FileHash-SHA256": 812 }, "indicator_count": 2861, "is_author": false, "is_subscribing": null, "subscriber_count": 398, "modified_text": "1361 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62a3caaca484317351c448ba", "name": "JavaAppletPlugin.plugin.zip..... Downloaded from Oracle Website", "description": "JAVA??? \n\nThe full text of the text below: \u00c2\u00a31.3bn, 1.8bn euros, 2.4bn pence, or \u00a32.2bn llyb.", "modified": "2022-07-10T00:00:39.429000", "created": "2022-06-10T22:50:20.127000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "W32/BotNet.K", "display_name": "W32/BotNet.K", "target": null }, { "id": "AVG Win32:Agent-ADAU [Trj]", "display_name": "AVG Win32:Agent-ADAU [Trj]", "target": null }, { "id": "malicious.2a7bf4", "display_name": "malicious.2a7bf4", "target": null }, { "id": "AI:FileInfector.A44F3C4816", "display_name": "AI:FileInfector.A44F3C4816", "target": null }, { "id": "W32/Botgor.A", "display_name": "W32/Botgor.A", "target": null }, { "id": "Trojan.Malware.121218.susgen", "display_name": "Trojan.Malware.121218.susgen", "target": null }, { "id": "Static AI - Malicious PE", "display_name": "Static AI - Malicious PE", "target": null }, { "id": "Worm.Win32.Burn.a", "display_name": "Worm.Win32.Burn.a", "target": null }, { "id": "BKDR_BOTGOR.SML", "display_name": "BKDR_BOTGOR.SML", "target": null }, { "id": "Win32.Backdoor.Agent.A", "display_name": "Win32.Backdoor.Agent.A", "target": null }, { "id": "BScope.Backdoor.Botgor", "display_name": "BScope.Backdoor.Botgor", "target": null }, { "id": "Worm/Win32.Burn.R34863", "display_name": "Worm/Win32.Burn.R34863", "target": null }, { "id": "Backdoor:Win32/Botgor.B", "display_name": "Backdoor:Win32/Botgor.B", "target": "/malware/Backdoor:Win32/Botgor.B" }, { "id": "Backdoor.Win32.Agent.ka!s1", "display_name": "Backdoor.Win32.Agent.ka!s1", "target": null }, { "id": "BDS/Agent.qva", "display_name": "BDS/Agent.qva", "target": null }, { "id": "Backdoor/Agent.bfic", "display_name": "Backdoor/Agent.bfic", "target": null }, { "id": "Win32.Trojan.Botgor.A", "display_name": "Win32.Trojan.Botgor.A", "target": null }, { "id": "Win32.ProcessHijack", "display_name": "Win32.ProcessHijack", "target": null }, { "id": "BackDoor.Siggen.46270", "display_name": "BackDoor.Siggen.46270", "target": null }, { "id": "Backdoor.Win32.Agent.~APQ@4ud5h", "display_name": "Backdoor.Win32.Agent.~APQ@4ud5h", "target": null }, { "id": "Virus.Botgor!1.D115 (CLASSIC)", "display_name": "Virus.Botgor!1.D115 (CLASSIC)", "target": null }, { "id": "Backdoor.Win32.Agent.117760.B", "display_name": "Backdoor.Win32.Agent.117760.B", "target": null }, { "id": "Worm:Win32/Botgor.18ddf561", "display_name": "Worm:Win32/Botgor.18ddf561", "target": "/malware/Worm:Win32/Botgor.18ddf561" }, { "id": "Worm.Win32.Burn.b", "display_name": "Worm.Win32.Burn.b", "target": null }, { "id": "Win.Malware.Botgor-9853222-0", "display_name": "Win.Malware.Botgor-9853222-0", "target": null }, { "id": "generic.ml", "display_name": "generic.ml", "target": null }, { "id": "ML.Attribute.HighConfidence", "display_name": "ML.Attribute.HighConfidence", "target": null }, { "id": "W32/Backdoor.UQUT-0945", "display_name": "W32/Backdoor.UQUT-0945", "target": null }, { "id": "win/malicious_confidence_100% (W)", "display_name": "win/malicious_confidence_100% (W)", "target": null }, { "id": "Trojan ( 000569271 )", "display_name": "Trojan ( 000569271 )", "target": null }, { "id": "Worm.Win32.Burn.tnPX", "display_name": "Worm.Win32.Burn.tnPX", "target": null }, { "id": "W32.AIDetect.malware2", "display_name": "W32.AIDetect.malware2", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MarceeS26", "id": "133143", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1382, "hostname": 314, "FileHash-SHA256": 1009, "domain": 46, "FileHash-MD5": 163, "FileHash-SHA1": 612 }, "indicator_count": 3526, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1379 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://form.jotform.com/kiheli2856/AirdropGiveaway", "g110e315c6ce34a02a043f315490fd5ba3975905f72874717b06e3de696641216.json", "VT graph Json upload to otx", "g04c1c4343dff4977a4d6b22d125a1505f3d2798b3f3745bf853914b4d39f2f56.json", "https://www.virustotal.com/graph/g110e315c6ce34a02a043f315490fd5ba3975905f72874717b06e3de696641216", "https://www.virustotal.com/graph/gebaa4d3d53cd4a3ea2559b9b96332ac7139ae27294bc4bc2ba9728cdd62917f9", "https://www.virustotal.com/gui/url/31a0fc66018b2d3f1eac84925b75c449a1320cfe66645d3714daeec292e3b9e5/details", "https://www.virustotal.com/graph/g4655ac448333498bac4fb8b20fed4be62d42ea86d1824fcd9401ba5b30027f57", "api.onesgnal.cm", "CVE-2017-8977", "https://udc-neb.kampyle.com/v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track", "CVE-2017-11882", "https://hybrid-analysis.com/sample/4af9320f9bcbf6e68edef4c637ae724c539a2bb79aacbf0e18aaef86bc607e33", "https://www.virustotal.com/graph/g57851267a0734f7fab3824bb4cca5cb9afab6573d8fa4b54a4f624390f9ba0bc", "with \"www\" and without \"www\"", "Naser Rony Naser Rony 11 hours ago Alles sehr sch\u00f6n. Aber zuerst zusammen die Nummern 10 und 1. Eine empr.ONLINE Br\u00fcnette und eine anderec Blondine. Es w\u00e4re unfair, wenn ich 4 w\u00e4hlen w\u00fcrde REPLY Lisa Parker Lisa Parker 10 hours ago \u2764Only for fans over 18 year\u2935\ufe0f Alles sehr sch\u00f6n. Aber zuerst zusammen die Nummern 10 und 1. Eine warmthhh.Online Br\u00fcnette und eine andere", "https://www.virustotal.com/graph/gbdd5a9e5527f4e80bbf32e0473e08bf56bd9e3da804944b18decfa7847796fc4", "CVE-2021-22941", "https://www.virustotal.com/graph/embed/g04c1c4343dff4977a4d6b22d125a1505f3d2798b3f3745bf853914b4d39f2f56", "pecompact cve-2008-2938 cve-2009-1535 cve-2009-0233 cve-2001-0260 contains-elf cve-2008-1447 cve-1999-0016 armadillo contains-embedded-js upx cve-2005-0560 xorcrypt winzip cve-2016-2569 upack contains-pe cve-2010-0806", "https://books.google.co.uk/books?id=S3kWAAAAIAAJ&dq=university%2Bof%2Bhuesca&pg=PR3&redir_esc=y#v%3Donepage%26q%3Duniversity%20of%20huesca%26f%3Dfalse", "comments on security weekly from episode on 10 Aug 2022", "Collection VT - https://www.virustotal.com/gui/collection/70e122270a95cbc415c33faeb7d72d42b7864f4261dabb6e93c52af0fbc4d533", "http://e.ca/?e.ca=!1:f.stopPropagation", "can no longer create collections in account - get exceeded api allowance even on just 28 req's in 24 hours", "https://ucdl.25pp.com/2014/03/29/1396060230_011736131353.apk?q", "platformflow.staging.mambucloud.com", "http://www.qy0531.com/gb513376_1473435.htm", "https://www.virustotal.com/graph/g9c436978fc00498db5d80e1e40dca510e9b90f67e36d4597a25f55b55926ff5c", "https://hybrid-analysis.com/sample/82b38c9312deb8005122fb331f52898190ac29e26bd464b169f4c60599836f14/62e9cf2b9226df6fea34c0de" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "W32/botnet.k", "Backdoor.siggen.46270", "Win32.trojan.botgor.a", "Ai:fileinfector.a44f3c4816", "Backdoor.win32.agent.ka!s1", "Ml.attribute.highconfidence", "Win/malicious_confidence_100% (w)", "Static ai - malicious pe", "Bkdr_botgor.sml", "Worm/win32.burn.r34863", "Generic.ml", "Worm:win32/botgor.18ddf561", "Malicious.2a7bf4", "W32/botgor.a", "Win32.backdoor.agent.a", "W32.aidetect.malware2", "Backdoor.win32.agent.~apq@4ud5h", "Win32.processhijack", "Backdoor.win32.agent.117760.b", "Bds/agent.qva", "W32/backdoor.uqut-0945", "Win.malware.botgor-9853222-0", "Worm.win32.burn.tnpx", "Virus.botgor!1.d115 (classic)", "Backdoor/agent.bfic", "Bscope.backdoor.botgor", "Trojan ( 000569271 )", "Avg win32:agent-adau [trj]", "Backdoor:win32/botgor.b", "Worm.win32.burn.b", "Worm.win32.burn.a", "Trojan.malware.121218.susgen" ], "industries": [], "unique_indicators": 38324 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/contrareturnsm.com", "whois": "http://whois.domaintools.com/contrareturnsm.com", "domain": "contrareturnsm.com", "hostname": "gcloud.contrareturnsm.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 22, "pulses": [ { "id": "657093fc5e8c659c7e5cb095", "name": "cant do wrong 4 right \ud83e\udd37\u200d\u2640\ufe0f maybe it should be left", "description": "", "modified": "2023-12-06T15:32:12.609000", "created": "2023-12-06T15:32:12.609000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 663, "domain": 19, "hostname": 74, "URL": 140 }, "indicator_count": 896, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657093b1ae988bb54a2c07ca", "name": "93.140.190.0 2017 Google Error due to many redirects presents 93.140.190.0 as being my ip which is incorrect", "description": "", "modified": "2023-12-06T15:30:57.239000", "created": "2023-12-06T15:30:57.239000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1366, "hostname": 1331, "URL": 3507, "domain": 457, "FileHash-MD5": 1 }, "indicator_count": 6663, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570913a03b8f1cdc6abe32e", "name": "btloader.com - yep clean as a babies bum", "description": "", "modified": "2023-12-06T15:20:26.615000", "created": "2023-12-06T15:20:26.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 546, "domain": 162, "URL": 1042, "hostname": 282, "FileHash-MD5": 251, "FileHash-SHA1": 224 }, "indicator_count": 2507, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090fe5e8c659c7e5cb094", "name": "http://e.ca/?e.ca=!1:f.stopPropagation - is there no end to this shit RU/CN/UA/GB/ net sh", "description": "", "modified": "2023-12-06T15:19:26.152000", "created": "2023-12-06T15:19:26.152000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1091, "hostname": 702, "URL": 1728, "domain": 279, "CVE": 2, "FileHash-MD5": 50, "FileHash-SHA1": 46 }, "indicator_count": 3898, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090e5dc9b2e91369b6c56", "name": "bunch of KR muck", "description": "", "modified": "2023-12-06T15:19:01.428000", "created": "2023-12-06T15:19:01.428000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 632, "hostname": 227, "domain": 101, "URL": 496 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657090132deb7fd89b09d555", "name": "a whole bunch of hell effected by the recent mozilla/firefox vulns", "description": "", "modified": "2023-12-06T15:15:31.177000", "created": "2023-12-06T15:15:31.177000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 825, "domain": 308, "URL": 2036, "FileHash-SHA256": 2141 }, "indicator_count": 5310, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708fdef7d4b5483117bb67", "name": "BINGO \ud83d\udea8\ud83d\udea8\ud83d\udea8 VT Graph json upload of UBotBrowser.exe - 20.99.132.105 - 33 collections - minecraft instances", "description": "", "modified": "2023-12-06T15:14:38.824000", "created": "2023-12-06T15:14:38.824000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 812, "domain": 110, "hostname": 502, "URL": 1437 }, "indicator_count": 2861, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6399cfd2a2e42a91e57cc82a", "name": "KR Crypto Theft I guess via jotform and api.signalone.com - makes total sense to 4 both domains", "description": "How much do you want to know about the Airdrop Giveaway and how much of your prize money will be sent to the winner in a free Jotform-style giveaway?", "modified": "2023-01-13T13:02:29.978000", "created": "2022-12-14T13:29:54.052000", "tags": [ "next submit", "press enter", "select", "request", "withdraw nft", "issue wallet", "connect unable", "form", "enter", "jotform", "api.onesignal.com" ], "references": [ "https://form.jotform.com/kiheli2856/AirdropGiveaway", "api.onesgnal.cm", "with \"www\" and without \"www\"" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 450, "hostname": 77, "URL": 322, "domain": 17, "FileHash-MD5": 45, "FileHash-SHA1": 45 }, "indicator_count": 956, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1192 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "638fef9c0dc3cca2cff5ac42", "name": "coldzone.tk - btcvip.com - Tweet", "description": "", "modified": "2023-01-05T18:10:20.257000", "created": "2022-12-07T01:42:52.861000", "tags": [ "coldzone.tk", "btcvip.com" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 642, "URL": 470, "hostname": 208, "domain": 65 }, "indicator_count": 1385, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1200 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6383a7be1bcdf0dc1c023475", "name": "Part 2 of 10.0.0.172 - com.sina.weibo - this is very very BAD", "description": "So many relative ioc's from my own cache poisoning on windows in early 2016", "modified": "2022-12-27T17:03:27.434000", "created": "2022-11-27T18:09:02.710000", "tags": [ "ansi", "analysis", "memoryfile scan", "dropped file", "found", "indicator", "text", "sha1", "seen", "static parser", "android", "hybrid", "suspicious", "strings", "insert", "error", "https://ucdl.25pp.com/2014/03/29/1396060230_011736131353.apk?q", "https://www.virustotal.com/gui/url/31a0fc66018b2d3f1eac84925b75c", "https://www.virustotal.com/graph/g9c436978fc00498db5d80e1e40dca5" ], "references": [ "platformflow.staging.mambucloud.com", "https://ucdl.25pp.com/2014/03/29/1396060230_011736131353.apk?q", "https://www.virustotal.com/gui/url/31a0fc66018b2d3f1eac84925b75c449a1320cfe66645d3714daeec292e3b9e5/details", "https://www.virustotal.com/graph/g9c436978fc00498db5d80e1e40dca510e9b90f67e36d4597a25f55b55926ff5c", "https://hybrid-analysis.com/sample/4af9320f9bcbf6e68edef4c637ae724c539a2bb79aacbf0e18aaef86bc607e33" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1213", "name": "Data from Information Repositories", "display_name": "T1213 - Data from Information Repositories" }, { "id": "T1420", "name": "File and Directory Discovery", "display_name": "T1420 - File and Directory Discovery" }, { "id": "T1421", "name": "System Network Connections Discovery", "display_name": "T1421 - System Network Connections Discovery" }, { "id": "T1540", "name": "Code Injection", "display_name": "T1540 - Code Injection" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1074, "hostname": 327, "FileHash-SHA256": 621, "domain": 72, "FileHash-MD5": 6, "FileHash-SHA1": 6, "SSLCertFingerprint": 1 }, "indicator_count": 2107, "is_author": false, "is_subscribing": null, "subscriber_count": 391, "modified_text": "1209 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://gcloud.contrareturnsm.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://gcloud.contrareturnsm.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629878.6862047 }