{
  "type": "URL",
  "indicator": "https://gfixprice.space/app/app.exe",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://gfixprice.space/app/app.exe",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2918498768,
      "indicator": "https://gfixprice.space/app/app.exe",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68d0f099f60e98e6c4ffc1e5",
          "name": "Elaborate Medical Insurance Scheme | Claims Reversal",
          "description": "Boring? Maybe but, victim of crime became a target of an elaborate ,  phishing, social engineering , hacking, theft, reputation, stalking, & physical assault scheme.  A man using name  Brian Sabey , Esq continues an international  porn campaign.  Today I\u2019m shocked by his false Medicare insurance scam denying targets claims & treatment since 2017. This information was retrieved by me  via research due to unpaid medical bills Team 8  has uncovered multiple large scale breaches with information mailed , texted or sent to targets. \n We are all researchers with a combined 30 years of award winning researchers focuses in various areas.  We are doing this unpaid , considering the circumstances. We are not related to the victim. \n\nAll claims of any abuses have been substantiated claims.\n\n#trulymissed #rip #briansabey #hallrender #jeffreyscottreimer #formbook_cnc #panda_cnc_checkin #claimreversalscam",
          "modified": "2025-10-22T05:00:52.085000",
          "created": "2025-09-22T06:45:45.714000",
          "tags": [
            "sec ch",
            "ch ua",
            "ua full",
            "ua platform",
            "ua bitness",
            "ua arch",
            "version sec",
            "mobile sec",
            "model sec",
            "version list",
            "date",
            "encrypt",
            "united",
            "backdoor",
            "entries",
            "passive dns",
            "hstr",
            "checkin",
            "next associated",
            "lowfi",
            "trojan",
            "ipv4 add",
            "twitter",
            "trojandropper",
            "ransom",
            "body",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "ck ids",
            "t1036",
            "t1040",
            "sniffing",
            "t1045",
            "packing",
            "t1053",
            "taskjob",
            "yara",
            "report spam",
            "otx generated",
            "created",
            "hours ago",
            "otx auto",
            "new york",
            "tsara brashears",
            "search",
            "filehashsha1",
            "filehashmd5",
            "domain",
            "hostname",
            "virgin islands",
            "canada",
            "ireland",
            "pes of",
            "expiration",
            "hall render",
            "possible deep",
            "https",
            "panda",
            "post",
            "insane",
            "law firm",
            "virtool",
            "service",
            "iocs",
            "learn more",
            "et trojan",
            "msie",
            "windows nt",
            "show",
            "unknown",
            "france as16276",
            "united kingdom",
            "possible",
            "write",
            "win32",
            "malware",
            "copy",
            "next",
            "et",
            "returnurl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "Netherlands",
            "Italy",
            "Aruba",
            "Germany",
            "Ireland",
            "Spain",
            "Poland",
            "Canada",
            "T\u00fcrkiye",
            "Romania",
            "Sweden",
            "Australia",
            "Singapore",
            "Denmark"
          ],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2905,
            "URL": 5029,
            "hostname": 1146,
            "FileHash-SHA256": 935,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 100,
            "email": 3
          },
          "indicator_count": 10220,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709c1a3462dae3a7d8714b",
          "name": "IOC202306052234",
          "description": "",
          "modified": "2023-12-06T16:06:50.890000",
          "created": "2023-12-06T16:06:50.890000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1096,
            "FileHash-MD5": 307,
            "FileHash-SHA1": 268,
            "domain": 265,
            "CVE": 6,
            "hostname": 246,
            "URL": 29
          },
          "indicator_count": 2217,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "906 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708abeb0514054bd29b714",
          "name": "Microsoft.com",
          "description": "",
          "modified": "2023-12-06T14:52:46.732000",
          "created": "2023-12-06T14:52:46.732000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1346,
            "domain": 234,
            "hostname": 572,
            "URL": 947
          },
          "indicator_count": 3100,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "906 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "647e46cde36f3b047c03f8db",
          "name": "IOC202306052234",
          "description": "",
          "modified": "2023-07-05T20:01:39.023000",
          "created": "2023-06-05T20:34:21.028000",
          "tags": [
            "june",
            "seen",
            "track them",
            "all at",
            "chatgpt",
            "april",
            "march",
            "recent blog",
            "february",
            "lockbit",
            "smoke loader",
            "qbot",
            "predator",
            "emotet",
            "danabot",
            "gandcrab",
            "orcus rat",
            "icedid",
            "sodinokibi",
            "agent tesla",
            "ave maria",
            "gootkit",
            "cobalt strike",
            "dharma",
            "hawkeye",
            "trojan",
            "zloader",
            "formbook",
            "crimson rat",
            "trickbot",
            "nemty",
            "netwalker",
            "pony",
            "glupteba",
            "azorult",
            "dridex",
            "hancitor",
            "raccoon",
            "maze",
            "vidar",
            "ryuk ransomware",
            "guloader",
            "amadey",
            "adwind",
            "quasar rat",
            "troldesh",
            "rats",
            "remcos",
            "revenge",
            "ursnif",
            "cryptbot",
            "flawedammyy",
            "phobos",
            "august",
            "snake",
            "ryuk",
            "quasar",
            "netwire",
            "darkside",
            "redline",
            "asyncrat",
            "ransomware",
            "darkcomet",
            "wannacry",
            "nanocore",
            "lokibot",
            "orcus",
            "thief",
            "malware",
            "systembc",
            "powershell",
            "adwind rat",
            "squirrelwaffle",
            "redline stealer",
            "bitcoin",
            "open",
            "copy",
            "ukraine",
            "nanocore rat",
            "houdini",
            "revenge rat",
            "dyre",
            "first",
            "eternalblue",
            "fallout",
            "smokeloader",
            "dofoil",
            "macos",
            "predator pain",
            "revil",
            "wcry ransomware",
            "bladabindi",
            "teamviewer",
            "agenttesla",
            "belarus",
            "cobaltstrike",
            "hermes",
            "execution",
            "crimson",
            "crysis",
            "shadow",
            "njrat",
            "next",
            "loader",
            "malspam",
            "ransom",
            "mimikatz",
            "cloudeye",
            "hworm",
            "friendly",
            "napoleon",
            "qakbot",
            "click",
            "ammyy admin",
            "flawedammy",
            "andromut",
            "vawtrak",
            "windigo",
            "mailto",
            "kill",
            "desktop",
            "discord",
            "loki bot",
            "mars",
            "apart",
            "smokeldr",
            "racealer",
            "hunter",
            "psexec",
            "mega",
            "cve201711882",
            "maldoc",
            "dunihi",
            "jenxcus",
            "xtremerat",
            "poisonivy",
            "fareit",
            "siplog",
            "gozi",
            "egregor",
            "browserpassview",
            "mailpassview",
            "aggah",
            "virustotal",
            "pinkslipbot",
            "path",
            "chacha",
            "spelevo",
            "killswitch",
            "sockrat",
            "mexico",
            "alienspy",
            "chthonic",
            "aurora",
            "winrar",
            "bokbot",
            "ammyy",
            "servhelper",
            "neutrino",
            "angler",
            "chanitor",
            "teamspy",
            "axpergle",
            "nuclear",
            "cridex",
            "service",
            "scarimson",
            "sticky",
            "terdot",
            "zbot",
            "panda banker",
            "screen",
            "polish"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1220",
              "name": "XSL Script Processing",
              "display_name": "T1220 - XSL Script Processing"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlessandroFiori",
            "id": "91912",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 29,
            "FileHash-MD5": 307,
            "FileHash-SHA1": 268,
            "FileHash-SHA256": 1096,
            "CVE": 6,
            "domain": 265,
            "hostname": 246
          },
          "indicator_count": 2217,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 424,
          "modified_text": "1060 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624cacff4d2f91ce31240ae9",
          "name": "Microsoft.com",
          "description": "",
          "modified": "2022-05-05T00:01:02.977000",
          "created": "2022-04-05T20:56:31.913000",
          "tags": [
            "whois record",
            "whois",
            "ssl certificate",
            "hostname",
            "domain",
            "hostnames",
            "url3",
            "collection ii",
            "email",
            "collection"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 572,
            "URL": 947,
            "CVE": 1,
            "domain": 234,
            "FileHash-SHA256": 1346
          },
          "indicator_count": 3100,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 414,
          "modified_text": "1486 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Et"
          ],
          "industries": [
            "Healthcare"
          ],
          "unique_indicators": 16272
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/gfixprice.space",
    "whois": "http://whois.domaintools.com/gfixprice.space",
    "domain": "gfixprice.space",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68d0f099f60e98e6c4ffc1e5",
      "name": "Elaborate Medical Insurance Scheme | Claims Reversal",
      "description": "Boring? Maybe but, victim of crime became a target of an elaborate ,  phishing, social engineering , hacking, theft, reputation, stalking, & physical assault scheme.  A man using name  Brian Sabey , Esq continues an international  porn campaign.  Today I\u2019m shocked by his false Medicare insurance scam denying targets claims & treatment since 2017. This information was retrieved by me  via research due to unpaid medical bills Team 8  has uncovered multiple large scale breaches with information mailed , texted or sent to targets. \n We are all researchers with a combined 30 years of award winning researchers focuses in various areas.  We are doing this unpaid , considering the circumstances. We are not related to the victim. \n\nAll claims of any abuses have been substantiated claims.\n\n#trulymissed #rip #briansabey #hallrender #jeffreyscottreimer #formbook_cnc #panda_cnc_checkin #claimreversalscam",
      "modified": "2025-10-22T05:00:52.085000",
      "created": "2025-09-22T06:45:45.714000",
      "tags": [
        "sec ch",
        "ch ua",
        "ua full",
        "ua platform",
        "ua bitness",
        "ua arch",
        "version sec",
        "mobile sec",
        "model sec",
        "version list",
        "date",
        "encrypt",
        "united",
        "backdoor",
        "entries",
        "passive dns",
        "hstr",
        "checkin",
        "next associated",
        "lowfi",
        "trojan",
        "ipv4 add",
        "twitter",
        "trojandropper",
        "ransom",
        "body",
        "url https",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "ck ids",
        "t1036",
        "t1040",
        "sniffing",
        "t1045",
        "packing",
        "t1053",
        "taskjob",
        "yara",
        "report spam",
        "otx generated",
        "created",
        "hours ago",
        "otx auto",
        "new york",
        "tsara brashears",
        "search",
        "filehashsha1",
        "filehashmd5",
        "domain",
        "hostname",
        "virgin islands",
        "canada",
        "ireland",
        "pes of",
        "expiration",
        "hall render",
        "possible deep",
        "https",
        "panda",
        "post",
        "insane",
        "law firm",
        "virtool",
        "service",
        "iocs",
        "learn more",
        "et trojan",
        "msie",
        "windows nt",
        "show",
        "unknown",
        "france as16276",
        "united kingdom",
        "possible",
        "write",
        "win32",
        "malware",
        "copy",
        "next",
        "et",
        "returnurl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "Netherlands",
        "Italy",
        "Aruba",
        "Germany",
        "Ireland",
        "Spain",
        "Poland",
        "Canada",
        "T\u00fcrkiye",
        "Romania",
        "Sweden",
        "Australia",
        "Singapore",
        "Denmark"
      ],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2905,
        "URL": 5029,
        "hostname": 1146,
        "FileHash-SHA256": 935,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 100,
        "email": 3
      },
      "indicator_count": 10220,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709c1a3462dae3a7d8714b",
      "name": "IOC202306052234",
      "description": "",
      "modified": "2023-12-06T16:06:50.890000",
      "created": "2023-12-06T16:06:50.890000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1096,
        "FileHash-MD5": 307,
        "FileHash-SHA1": 268,
        "domain": 265,
        "CVE": 6,
        "hostname": 246,
        "URL": 29
      },
      "indicator_count": 2217,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "906 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708abeb0514054bd29b714",
      "name": "Microsoft.com",
      "description": "",
      "modified": "2023-12-06T14:52:46.732000",
      "created": "2023-12-06T14:52:46.732000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1346,
        "domain": 234,
        "hostname": 572,
        "URL": 947
      },
      "indicator_count": 3100,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "906 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "647e46cde36f3b047c03f8db",
      "name": "IOC202306052234",
      "description": "",
      "modified": "2023-07-05T20:01:39.023000",
      "created": "2023-06-05T20:34:21.028000",
      "tags": [
        "june",
        "seen",
        "track them",
        "all at",
        "chatgpt",
        "april",
        "march",
        "recent blog",
        "february",
        "lockbit",
        "smoke loader",
        "qbot",
        "predator",
        "emotet",
        "danabot",
        "gandcrab",
        "orcus rat",
        "icedid",
        "sodinokibi",
        "agent tesla",
        "ave maria",
        "gootkit",
        "cobalt strike",
        "dharma",
        "hawkeye",
        "trojan",
        "zloader",
        "formbook",
        "crimson rat",
        "trickbot",
        "nemty",
        "netwalker",
        "pony",
        "glupteba",
        "azorult",
        "dridex",
        "hancitor",
        "raccoon",
        "maze",
        "vidar",
        "ryuk ransomware",
        "guloader",
        "amadey",
        "adwind",
        "quasar rat",
        "troldesh",
        "rats",
        "remcos",
        "revenge",
        "ursnif",
        "cryptbot",
        "flawedammyy",
        "phobos",
        "august",
        "snake",
        "ryuk",
        "quasar",
        "netwire",
        "darkside",
        "redline",
        "asyncrat",
        "ransomware",
        "darkcomet",
        "wannacry",
        "nanocore",
        "lokibot",
        "orcus",
        "thief",
        "malware",
        "systembc",
        "powershell",
        "adwind rat",
        "squirrelwaffle",
        "redline stealer",
        "bitcoin",
        "open",
        "copy",
        "ukraine",
        "nanocore rat",
        "houdini",
        "revenge rat",
        "dyre",
        "first",
        "eternalblue",
        "fallout",
        "smokeloader",
        "dofoil",
        "macos",
        "predator pain",
        "revil",
        "wcry ransomware",
        "bladabindi",
        "teamviewer",
        "agenttesla",
        "belarus",
        "cobaltstrike",
        "hermes",
        "execution",
        "crimson",
        "crysis",
        "shadow",
        "njrat",
        "next",
        "loader",
        "malspam",
        "ransom",
        "mimikatz",
        "cloudeye",
        "hworm",
        "friendly",
        "napoleon",
        "qakbot",
        "click",
        "ammyy admin",
        "flawedammy",
        "andromut",
        "vawtrak",
        "windigo",
        "mailto",
        "kill",
        "desktop",
        "discord",
        "loki bot",
        "mars",
        "apart",
        "smokeldr",
        "racealer",
        "hunter",
        "psexec",
        "mega",
        "cve201711882",
        "maldoc",
        "dunihi",
        "jenxcus",
        "xtremerat",
        "poisonivy",
        "fareit",
        "siplog",
        "gozi",
        "egregor",
        "browserpassview",
        "mailpassview",
        "aggah",
        "virustotal",
        "pinkslipbot",
        "path",
        "chacha",
        "spelevo",
        "killswitch",
        "sockrat",
        "mexico",
        "alienspy",
        "chthonic",
        "aurora",
        "winrar",
        "bokbot",
        "ammyy",
        "servhelper",
        "neutrino",
        "angler",
        "chanitor",
        "teamspy",
        "axpergle",
        "nuclear",
        "cridex",
        "service",
        "scarimson",
        "sticky",
        "terdot",
        "zbot",
        "panda banker",
        "screen",
        "polish"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1220",
          "name": "XSL Script Processing",
          "display_name": "T1220 - XSL Script Processing"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlessandroFiori",
        "id": "91912",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 29,
        "FileHash-MD5": 307,
        "FileHash-SHA1": 268,
        "FileHash-SHA256": 1096,
        "CVE": 6,
        "domain": 265,
        "hostname": 246
      },
      "indicator_count": 2217,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 424,
      "modified_text": "1060 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "624cacff4d2f91ce31240ae9",
      "name": "Microsoft.com",
      "description": "",
      "modified": "2022-05-05T00:01:02.977000",
      "created": "2022-04-05T20:56:31.913000",
      "tags": [
        "whois record",
        "whois",
        "ssl certificate",
        "hostname",
        "domain",
        "hostnames",
        "url3",
        "collection ii",
        "email",
        "collection"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 572,
        "URL": 947,
        "CVE": 1,
        "domain": 234,
        "FileHash-SHA256": 1346
      },
      "indicator_count": 3100,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 414,
      "modified_text": "1486 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://gfixprice.space/app/app.exe",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://gfixprice.space/app/app.exe",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780185096.5650792
}