{
  "type": "URL",
  "indicator": "https://git.irsig.net/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://git.irsig.net/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4165460490,
      "indicator": "https://git.irsig.net/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "698037098c99c37cb91037c2",
          "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
          "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
          "modified": "2026-03-04T04:07:14.513000",
          "created": "2026-02-02T05:32:57.303000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "domain",
            "hostname",
            "filehashmd5",
            "filehashsha1",
            "iocs",
            "url https",
            "search",
            "type indicator",
            "review iocs",
            "role title",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "extraction",
            "sc data",
            "extre data",
            "include review",
            "exclude sugges",
            "data upload",
            "failed",
            "find s",
            "oo data",
            "enter source",
            "url or",
            "text drag",
            "expiration",
            "showing",
            "entries",
            "protect",
            "pulse show",
            "email abuse",
            "related pulses",
            "indicator role",
            "returnurl no",
            "drop",
            "pulse provide",
            "public tlp",
            "green",
            "adversary tags",
            "buzz",
            "x8664",
            "add tag",
            "groups add",
            "add industry",
            "trojan",
            "tags"
          ],
          "references": [
            "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
            "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
            "Antivirus Detections: Trojan:Win32/Dorv.A",
            "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
            "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
            "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
            "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
            "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
            "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
            "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
            "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
            "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
            "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
            "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
            "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
            "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
            "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
            "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
            "Antivirus Detections: Win.Malware.Pits-10035540-0",
            "Yara: Detections Delphi",
            "Alerts: infostealer_cookies antiav_detectfile",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
            "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
            "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
            "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
            "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
            "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
            "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
            "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
            "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
            "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
            "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
            "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
            "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
            "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
            "https://cpcontacts.apple4you.it",
            "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
            "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
            "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
            "https://fs25.mygamesteam.com/download/underground-parking/",
            "http://spiritzuridgerunelahubcloudgusparkx.rest/",
            "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
            "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
            "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
            "IDS Detections: Suspicious Activity potential UPnProxy",
            "Yara Detections: is__elf ,  ECHOBOT",
            "Alerts: dead_host network_icmp tcp_by",
            "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
            "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
            "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
            "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
            "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
            "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
            "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
            "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
            "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
            "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
            "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
            "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
            "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
            "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
            "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
            "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
            "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
            "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
            "TAGS: sample analysis se domains search security quic add source level span spawns spy",
            "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
            "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
            "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Hungary"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "DDos:Linux/Gafgyt.YA!MTB",
              "display_name": "DDos:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "ELF:DDoS-S\\ [Trj]",
              "display_name": "ELF:DDoS-S\\ [Trj]",
              "target": null
            },
            {
              "id": "Pykspa.C",
              "display_name": "Pykspa.C",
              "target": null
            },
            {
              "id": "Trojan:Win32/Dorv.A",
              "display_name": "Trojan:Win32/Dorv.A",
              "target": "/malware/Trojan:Win32/Dorv.A"
            },
            {
              "id": "Unix.Trojan.Gafgyt-698115",
              "display_name": "Unix.Trojan.Gafgyt-698115",
              "target": null
            },
            {
              "id": "4-0 Win.Malware.Pits-10035540-0",
              "display_name": "4-0 Win.Malware.Pits-10035540-0",
              "target": null
            },
            {
              "id": "Win.Packed.Usteal-7531303-0",
              "display_name": "Win.Packed.Usteal-7531303-0",
              "target": null
            },
            {
              "id": "tR",
              "display_name": "tR",
              "target": null
            },
            {
              "id": "DeathHiddenTear (Large&Small HT)   >",
              "display_name": "DeathHiddenTear (Large&Small HT)   >",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1608",
              "name": "Stage Capabilities",
              "display_name": "T1608 - Stage Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1586,
            "FileHash-SHA1": 1479,
            "FileHash-SHA256": 1938,
            "URL": 4548,
            "domain": 1052,
            "hostname": 2501,
            "email": 9,
            "SSLCertFingerprint": 7,
            "CIDR": 2
          },
          "indicator_count": 13122,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "46 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "696ac416596cd89cf76bce55",
          "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
          "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
          "modified": "2026-02-15T22:03:06.041000",
          "created": "2026-01-16T23:04:53.997000",
          "tags": [
            "united",
            "win32",
            "urls",
            "twitter",
            "trojan",
            "united states",
            "dynamicloader",
            "default",
            "delete c",
            "json",
            "ascii text",
            "high",
            "data",
            "write c",
            "stream",
            "write",
            "malware",
            "dirty",
            "servers",
            "unknown aaaa",
            "Crazy Frost",
            "create c",
            "port",
            "destination",
            "unknown",
            "encrypt",
            "passive dns",
            "Verizon",
            "Twitter",
            "url analysis",
            "url add",
            "http",
            "files related",
            "related tags",
            "Project Cicada",
            "present nov",
            "present dec",
            "present sep",
            "present jul",
            "present jun",
            "or icon",
            "gold w",
            "dots larger",
            "background",
            "pegasus",
            "meta",
            "backdoor",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "ipv4",
            "data upload",
            "extraction",
            "ottow",
            "Christopher Ahmann",
            "Pegasus",
            "url https",
            "hostname",
            "files domain",
            "present jan",
            "moved",
            "ip address",
            "record value",
            "apache",
            "paris",
            "followupboss",
            "type",
            "hostname add",
            "next associated",
            "title error",
            "reverse dns",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "connect",
            "head",
            "tlsv1",
            "accept",
            "date",
            "powershell",
            "iframe",
            "span",
            "push",
            "next",
            "shark",
            "Connection",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "pattern match",
            "size",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "Denver, Co 80211",
            "body",
            "title",
            "One Reach AI"
          ],
          "references": [
            "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
            "pegasuspartners.followupboss.com",
            "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
            "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
            "search.roi.ros.gov.uk",
            "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
            "Denver, US 80211 http://library.verizon.onereach.ai",
            "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
            "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11078,
            "hostname": 4331,
            "domain": 1932,
            "FileHash-SHA256": 1999,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 169,
            "email": 5,
            "SSLCertFingerprint": 6,
            "CVE": 1
          },
          "indicator_count": 19878,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "696ac4327b5bc2e8be34f78a",
          "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
          "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
          "modified": "2026-02-15T22:03:06.041000",
          "created": "2026-01-16T23:05:22.323000",
          "tags": [
            "united",
            "win32",
            "urls",
            "twitter",
            "trojan",
            "united states",
            "dynamicloader",
            "default",
            "delete c",
            "json",
            "ascii text",
            "high",
            "data",
            "write c",
            "stream",
            "write",
            "malware",
            "dirty",
            "servers",
            "unknown aaaa",
            "Crazy Frost",
            "create c",
            "port",
            "destination",
            "unknown",
            "encrypt",
            "passive dns",
            "Verizon",
            "Twitter",
            "url analysis",
            "url add",
            "http",
            "files related",
            "related tags",
            "Project Cicada",
            "present nov",
            "present dec",
            "present sep",
            "present jul",
            "present jun",
            "or icon",
            "gold w",
            "dots larger",
            "background",
            "pegasus",
            "meta",
            "backdoor",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "ipv4",
            "data upload",
            "extraction",
            "ottow",
            "Christopher Ahmann",
            "Pegasus",
            "url https",
            "hostname",
            "files domain",
            "present jan",
            "moved",
            "ip address",
            "record value",
            "apache",
            "paris",
            "followupboss",
            "type",
            "hostname add",
            "next associated",
            "title error",
            "reverse dns",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "connect",
            "head",
            "tlsv1",
            "accept",
            "date",
            "powershell",
            "iframe",
            "span",
            "push",
            "next",
            "shark",
            "Connection",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "pattern match",
            "size",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "Denver, Co 80211",
            "body",
            "title",
            "One Reach AI"
          ],
          "references": [
            "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
            "pegasuspartners.followupboss.com",
            "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
            "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
            "search.roi.ros.gov.uk",
            "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
            "Denver, US 80211 http://library.verizon.onereach.ai",
            "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
            "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11078,
            "hostname": 4331,
            "domain": 1932,
            "FileHash-SHA256": 1999,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 169,
            "email": 5,
            "SSLCertFingerprint": 6,
            "CVE": 1
          },
          "indicator_count": 19878,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "696ac438a696c993b672106d",
          "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
          "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
          "modified": "2026-02-15T22:03:06.041000",
          "created": "2026-01-16T23:05:28.261000",
          "tags": [
            "united",
            "win32",
            "urls",
            "twitter",
            "trojan",
            "united states",
            "dynamicloader",
            "default",
            "delete c",
            "json",
            "ascii text",
            "high",
            "data",
            "write c",
            "stream",
            "write",
            "malware",
            "dirty",
            "servers",
            "unknown aaaa",
            "Crazy Frost",
            "create c",
            "port",
            "destination",
            "unknown",
            "encrypt",
            "passive dns",
            "Verizon",
            "Twitter",
            "url analysis",
            "url add",
            "http",
            "files related",
            "related tags",
            "Project Cicada",
            "present nov",
            "present dec",
            "present sep",
            "present jul",
            "present jun",
            "or icon",
            "gold w",
            "dots larger",
            "background",
            "pegasus",
            "meta",
            "backdoor",
            "ransom",
            "checkin",
            "trojandropper",
            "mtb nov",
            "ipv4",
            "data upload",
            "extraction",
            "ottow",
            "Christopher Ahmann",
            "Pegasus",
            "url https",
            "hostname",
            "files domain",
            "present jan",
            "moved",
            "ip address",
            "record value",
            "apache",
            "paris",
            "followupboss",
            "type",
            "hostname add",
            "next associated",
            "title error",
            "reverse dns",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "connect",
            "head",
            "tlsv1",
            "accept",
            "date",
            "powershell",
            "iframe",
            "span",
            "push",
            "next",
            "shark",
            "Connection",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "pattern match",
            "size",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "Denver, Co 80211",
            "body",
            "title",
            "One Reach AI"
          ],
          "references": [
            "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
            "pegasuspartners.followupboss.com",
            "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
            "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
            "search.roi.ros.gov.uk",
            "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
            "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
            "Denver, US 80211 http://library.verizon.onereach.ai",
            "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
            "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11078,
            "hostname": 4331,
            "domain": 1932,
            "FileHash-SHA256": 1999,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 169,
            "email": 5,
            "SSLCertFingerprint": 6,
            "CVE": 1
          },
          "indicator_count": 19878,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69642a749490c0bf404aa8ac",
          "name": "Google Services - Malware Packed Google Branded Services",
          "description": "Contacted Google services  | Service (1 of 3) || GoogleChromeElevationService | Mofksys \u2022 Unruy | Relationship: https://otx.alienvault.com/pulse/69640c0afc9805a6fa2da07b | \n#affilliated #worm _#exploit #alternate_google #infection #spyware",
          "modified": "2026-02-10T22:01:54.041000",
          "created": "2026-01-11T22:55:48.308000",
          "tags": [
            "write c",
            "write",
            "delete c",
            "ms windows",
            "pe32 executable",
            "globalc",
            "united",
            "worm",
            "malware",
            "defender",
            "united states",
            "google",
            "google account",
            "mtb ids",
            "cloudflare dns",
            "https domain",
            "tls sni",
            "medium priority",
            "yara detections",
            "alerts",
            "google play",
            "google api",
            "google chrome",
            "mofksys",
            "exploit",
            "process32nextw",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "search",
            "precreate read",
            "read c",
            "dock",
            "unknown",
            "suspicious",
            "alt google",
            "execution att",
            "lowfi",
            "mtb jan",
            "trojandropper",
            "passive dns",
            "backdoor",
            "win32upatre jan",
            "origin trial",
            "gmt cache",
            "443 ma2592000",
            "possible",
            "trojan",
            "title",
            "mtb dec",
            "ipv4 add",
            "state",
            "trojan",
            "dropper",
            "phishing",
            "ransom",
            "of colorado"
          ],
          "references": [
            "accounts.google.com \u2022 apis.google.com clients2.google.com \u2022 clients2.googleusercontent.com",
            "142.251.9.95 \u2022 https://clients2.google.com/cr/report \u2022 accounts.google.com \u2022",
            "ogads-pa.clients6.google.com \u2022  optimizationguide-pa.googleapis.com \u2022 play.google.com",
            "update.googleapis.com \u2022 www.google.com \u2022 clientservices.googleapis.com",
            "Worm:Win32/Mofksys.RND!MTB |  Yara Detections: SUSP_Imphash_Mar23_2",
            "IDS Detection: Observed Cloudflare DNS over HTTPS \u2022 Domain (cloudflare-dns .com in TLS SNI)",
            "Alerts: suspicious_iocontrol_codes infostealer_cookies persistence_autorun antisandbox_sleep",
            "Alerts: persistence_autorun_tasks polymorphic procmem_yara static_pe_anomaly antiav_detectfile",
            "Alerts: antiav_detectreg antivm_bochs_keys antivm_generic_disk infostealer_mail injection_write",
            "Alerts: suspicious_command_tools anomalous_deletefile mouse_movement_detect",
            "Alerts: dynamic_function_loading resumethread_remote_process stealth_hiddenreg",
            "Contacted Google services",
            "SERVICE NAME: SSDPSRV \u2022 Delete upnphost\tDelete \u2022 GoogleChromeElevationService",
            "https://otx.alienvault.com/indicator/file/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "codewiki.google",
            "Win.Malware.Unruy-6912804-0 IDS Detections: Win32/Unruy.C Activity 403 Forbidden",
            "Alerts: network_icmp persistence_autorun antivm_vmware_in_instruction",
            "Alerts: network_http antisandbox_sleep creates_exe dropper stealth_window",
            "Alerts: injection_process_search protection_rx",
            "IP\u2019s Contacted: 142.250.74.68  142.250.74.99  18.66.121.69  185.53.179.170  2.22.41.134  204.79.197.200",
            "IP\u2019s Contacted: 208.91.196.46  209.197.3.8  216.239.32.29  35.186.238.101",
            "Domains Contacted: www.microsoft.com www.bing.com www2.megawebdeals.com www.google.com",
            "Domains Contacted: ocsp.pki.goog www.download.windowsupdate.com ifdnzact.com",
            "Domains Contacted: d38psrni17bvxu.cloudfront.net www2.megawebfind.com  www6.megawebfind.com",
            "PE Version Information : TJprojMain.exe",
            "Found in : https://otx.alienvault.com/pulse/69640c0afc9805a6fa2da07b",
            "IDS Detections Win32/Unruy.C Activity \u2022 403 Forbidden"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Win.Malware.Unruy-6912804-0",
              "display_name": "Win.Malware.Unruy-6912804-0",
              "target": null
            },
            {
              "id": "Win.Packed.Eyestye-9754938-0",
              "display_name": "Win.Packed.Eyestye-9754938-0",
              "target": null
            },
            {
              "id": "Eyestye",
              "display_name": "Eyestye",
              "target": null
            },
            {
              "id": "AutoRun",
              "display_name": "AutoRun",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Trojan:Win32/EyeStye.T",
              "display_name": "Trojan:Win32/EyeStye.T",
              "target": "/malware/Trojan:Win32/EyeStye.T"
            },
            {
              "id": "ALF:HeraklezEval:PUA:Win32/4Shared",
              "display_name": "ALF:HeraklezEval:PUA:Win32/4Shared",
              "target": null
            },
            {
              "id": "Cassini",
              "display_name": "Cassini",
              "target": null
            },
            {
              "id": "DarkMoon",
              "display_name": "DarkMoon",
              "target": null
            },
            {
              "id": "PolyRansom",
              "display_name": "PolyRansom",
              "target": null
            },
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Malware  Packed",
              "display_name": "Malware  Packed",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1078.003",
              "name": "Local Accounts",
              "display_name": "T1078.003 - Local Accounts"
            },
            {
              "id": "T1078.001",
              "name": "Default Accounts",
              "display_name": "T1078.001 - Default Accounts"
            },
            {
              "id": "T1087.003",
              "name": "Email Account",
              "display_name": "T1087.003 - Email Account"
            },
            {
              "id": "T1078.002",
              "name": "Domain Accounts",
              "display_name": "T1078.002 - Domain Accounts"
            },
            {
              "id": "T1090.004",
              "name": "Domain Fronting",
              "display_name": "T1090.004 - Domain Fronting"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1588.001",
              "name": "Malware",
              "display_name": "T1588.001 - Malware"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 198,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 867,
            "URL": 1461,
            "hostname": 429,
            "domain": 221,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 3342,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "68 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "PE Version Information : TJprojMain.exe",
        "Found in : https://otx.alienvault.com/pulse/69640c0afc9805a6fa2da07b",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
        "Alerts: dynamic_function_loading resumethread_remote_process stealth_hiddenreg",
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule",
        "https://cpcontacts.apple4you.it",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "codewiki.google",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "Alerts: injection_process_search protection_rx",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "Alerts: suspicious_iocontrol_codes infostealer_cookies persistence_autorun antisandbox_sleep",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "Worm:Win32/Mofksys.RND!MTB |  Yara Detections: SUSP_Imphash_Mar23_2",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "Denver, US 80211 http://library.verizon.onereach.ai",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "Domains Contacted: www.microsoft.com www.bing.com www2.megawebdeals.com www.google.com",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
        "IP\u2019s Contacted: 208.91.196.46  209.197.3.8  216.239.32.29  35.186.238.101",
        "Alerts: persistence_autorun_tasks polymorphic procmem_yara static_pe_anomaly antiav_detectfile",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "pegasuspartners.followupboss.com",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "IDS Detections Win32/Unruy.C Activity \u2022 403 Forbidden",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "Alerts: suspicious_command_tools anomalous_deletefile mouse_movement_detect",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "https://fs25.mygamesteam.com/download/underground-parking/",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "142.251.9.95 \u2022 https://clients2.google.com/cr/report \u2022 accounts.google.com \u2022",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "update.googleapis.com \u2022 www.google.com \u2022 clientservices.googleapis.com",
        "ogads-pa.clients6.google.com \u2022  optimizationguide-pa.googleapis.com \u2022 play.google.com",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "accounts.google.com \u2022 apis.google.com clients2.google.com \u2022 clients2.googleusercontent.com",
        "https://otx.alienvault.com/indicator/file/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "SERVICE NAME: SSDPSRV \u2022 Delete upnphost\tDelete \u2022 GoogleChromeElevationService",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "Yara Detections: is__elf ,  ECHOBOT",
        "Contacted Google services",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "Win.Malware.Unruy-6912804-0 IDS Detections: Win32/Unruy.C Activity 403 Forbidden",
        "Alerts: network_icmp persistence_autorun antivm_vmware_in_instruction",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
        "Alerts: antiav_detectreg antivm_bochs_keys antivm_generic_disk infostealer_mail injection_write",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "IP\u2019s Contacted: 142.250.74.68  142.250.74.99  18.66.121.69  185.53.179.170  2.22.41.134  204.79.197.200",
        "Alerts: dead_host network_icmp tcp_by",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht",
        "Alerts: network_http antisandbox_sleep creates_exe dropper stealth_window",
        "Alerts: infostealer_cookies antiav_detectfile",
        "search.roi.ros.gov.uk",
        "Domains Contacted: d38psrni17bvxu.cloudfront.net www2.megawebfind.com  www6.megawebfind.com",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "Yara: Detections Delphi",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "Domains Contacted: ocsp.pki.goog www.download.windowsupdate.com ifdnzact.com",
        "IDS Detection: Observed Cloudflare DNS over HTTPS \u2022 Domain (cloudflare-dns .com in TLS SNI)",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Eyestye",
            "Trojan:win32/dorv.a",
            "Worm:win32/mofksys.rnd!mtb",
            "Win.packed.eyestye-9754938-0",
            "Darkmoon",
            "Deathhiddentear (large&small ht)   >",
            "4-0 win.malware.pits-10035540-0",
            "Tr",
            "Alf:heraklezeval:pua:win32/4shared",
            "Ddos:linux/gafgyt.ya!mtb",
            "Autorun",
            "Upatre",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Pegasus",
            "Unix.trojan.gafgyt-698115",
            "Win.malware.unruy-6912804-0",
            "Trojan:win32/eyestye.t",
            "Malware  packed",
            "Pykspa.c",
            "Other malware",
            "Cassini",
            "Elf:ddos-s\\ [trj]",
            "Polyransom",
            "Tofsee",
            "Win.packed.usteal-7531303-0"
          ],
          "industries": [],
          "unique_indicators": 35460
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/irsig.net",
    "whois": "http://whois.domaintools.com/irsig.net",
    "domain": "irsig.net",
    "hostname": "git.irsig.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "698037098c99c37cb91037c2",
      "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
      "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
      "modified": "2026-03-04T04:07:14.513000",
      "created": "2026-02-02T05:32:57.303000",
      "tags": [
        "no expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "domain",
        "hostname",
        "filehashmd5",
        "filehashsha1",
        "iocs",
        "url https",
        "search",
        "type indicator",
        "review iocs",
        "role title",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "extraction",
        "sc data",
        "extre data",
        "include review",
        "exclude sugges",
        "data upload",
        "failed",
        "find s",
        "oo data",
        "enter source",
        "url or",
        "text drag",
        "expiration",
        "showing",
        "entries",
        "protect",
        "pulse show",
        "email abuse",
        "related pulses",
        "indicator role",
        "returnurl no",
        "drop",
        "pulse provide",
        "public tlp",
        "green",
        "adversary tags",
        "buzz",
        "x8664",
        "add tag",
        "groups add",
        "add industry",
        "trojan",
        "tags"
      ],
      "references": [
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "Yara: Detections Delphi",
        "Alerts: infostealer_cookies antiav_detectfile",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "https://cpcontacts.apple4you.it",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "https://fs25.mygamesteam.com/download/underground-parking/",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "Yara Detections: is__elf ,  ECHOBOT",
        "Alerts: dead_host network_icmp tcp_by",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Hungary"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "DDos:Linux/Gafgyt.YA!MTB",
          "display_name": "DDos:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "ELF:DDoS-S\\ [Trj]",
          "display_name": "ELF:DDoS-S\\ [Trj]",
          "target": null
        },
        {
          "id": "Pykspa.C",
          "display_name": "Pykspa.C",
          "target": null
        },
        {
          "id": "Trojan:Win32/Dorv.A",
          "display_name": "Trojan:Win32/Dorv.A",
          "target": "/malware/Trojan:Win32/Dorv.A"
        },
        {
          "id": "Unix.Trojan.Gafgyt-698115",
          "display_name": "Unix.Trojan.Gafgyt-698115",
          "target": null
        },
        {
          "id": "4-0 Win.Malware.Pits-10035540-0",
          "display_name": "4-0 Win.Malware.Pits-10035540-0",
          "target": null
        },
        {
          "id": "Win.Packed.Usteal-7531303-0",
          "display_name": "Win.Packed.Usteal-7531303-0",
          "target": null
        },
        {
          "id": "tR",
          "display_name": "tR",
          "target": null
        },
        {
          "id": "DeathHiddenTear (Large&Small HT)   >",
          "display_name": "DeathHiddenTear (Large&Small HT)   >",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1608",
          "name": "Stage Capabilities",
          "display_name": "T1608 - Stage Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1586,
        "FileHash-SHA1": 1479,
        "FileHash-SHA256": 1938,
        "URL": 4548,
        "domain": 1052,
        "hostname": 2501,
        "email": 9,
        "SSLCertFingerprint": 7,
        "CIDR": 2
      },
      "indicator_count": 13122,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "46 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "696ac416596cd89cf76bce55",
      "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
      "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
      "modified": "2026-02-15T22:03:06.041000",
      "created": "2026-01-16T23:04:53.997000",
      "tags": [
        "united",
        "win32",
        "urls",
        "twitter",
        "trojan",
        "united states",
        "dynamicloader",
        "default",
        "delete c",
        "json",
        "ascii text",
        "high",
        "data",
        "write c",
        "stream",
        "write",
        "malware",
        "dirty",
        "servers",
        "unknown aaaa",
        "Crazy Frost",
        "create c",
        "port",
        "destination",
        "unknown",
        "encrypt",
        "passive dns",
        "Verizon",
        "Twitter",
        "url analysis",
        "url add",
        "http",
        "files related",
        "related tags",
        "Project Cicada",
        "present nov",
        "present dec",
        "present sep",
        "present jul",
        "present jun",
        "or icon",
        "gold w",
        "dots larger",
        "background",
        "pegasus",
        "meta",
        "backdoor",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "ipv4",
        "data upload",
        "extraction",
        "ottow",
        "Christopher Ahmann",
        "Pegasus",
        "url https",
        "hostname",
        "files domain",
        "present jan",
        "moved",
        "ip address",
        "record value",
        "apache",
        "paris",
        "followupboss",
        "type",
        "hostname add",
        "next associated",
        "title error",
        "reverse dns",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "connect",
        "head",
        "tlsv1",
        "accept",
        "date",
        "powershell",
        "iframe",
        "span",
        "push",
        "next",
        "shark",
        "Connection",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "pattern match",
        "size",
        "null",
        "refresh",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "Denver, Co 80211",
        "body",
        "title",
        "One Reach AI"
      ],
      "references": [
        "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
        "pegasuspartners.followupboss.com",
        "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
        "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
        "search.roi.ros.gov.uk",
        "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
        "Denver, US 80211 http://library.verizon.onereach.ai",
        "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
        "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 11078,
        "hostname": 4331,
        "domain": 1932,
        "FileHash-SHA256": 1999,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 169,
        "email": 5,
        "SSLCertFingerprint": 6,
        "CVE": 1
      },
      "indicator_count": 19878,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "696ac4327b5bc2e8be34f78a",
      "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
      "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
      "modified": "2026-02-15T22:03:06.041000",
      "created": "2026-01-16T23:05:22.323000",
      "tags": [
        "united",
        "win32",
        "urls",
        "twitter",
        "trojan",
        "united states",
        "dynamicloader",
        "default",
        "delete c",
        "json",
        "ascii text",
        "high",
        "data",
        "write c",
        "stream",
        "write",
        "malware",
        "dirty",
        "servers",
        "unknown aaaa",
        "Crazy Frost",
        "create c",
        "port",
        "destination",
        "unknown",
        "encrypt",
        "passive dns",
        "Verizon",
        "Twitter",
        "url analysis",
        "url add",
        "http",
        "files related",
        "related tags",
        "Project Cicada",
        "present nov",
        "present dec",
        "present sep",
        "present jul",
        "present jun",
        "or icon",
        "gold w",
        "dots larger",
        "background",
        "pegasus",
        "meta",
        "backdoor",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "ipv4",
        "data upload",
        "extraction",
        "ottow",
        "Christopher Ahmann",
        "Pegasus",
        "url https",
        "hostname",
        "files domain",
        "present jan",
        "moved",
        "ip address",
        "record value",
        "apache",
        "paris",
        "followupboss",
        "type",
        "hostname add",
        "next associated",
        "title error",
        "reverse dns",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "connect",
        "head",
        "tlsv1",
        "accept",
        "date",
        "powershell",
        "iframe",
        "span",
        "push",
        "next",
        "shark",
        "Connection",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "pattern match",
        "size",
        "null",
        "refresh",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "Denver, Co 80211",
        "body",
        "title",
        "One Reach AI"
      ],
      "references": [
        "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
        "pegasuspartners.followupboss.com",
        "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
        "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
        "search.roi.ros.gov.uk",
        "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
        "Denver, US 80211 http://library.verizon.onereach.ai",
        "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
        "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 11078,
        "hostname": 4331,
        "domain": 1932,
        "FileHash-SHA256": 1999,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 169,
        "email": 5,
        "SSLCertFingerprint": 6,
        "CVE": 1
      },
      "indicator_count": 19878,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "696ac438a696c993b672106d",
      "name": "VERIZON \u2022 One Reach AI \u2022 LEGAL \u2022 Crazy Frost \u2022 Denver, US MEGA PULSE",
      "description": "Found in peripheral looking for patterns.\nLegal mischief , Monitoring, Spyware. a Pegasus service needs to be examined further. Just glancing. [OTX Auto generated-HOSTNAME: Verizon.com-vdda.co.cc -has been added to the Pulse website, the first time the site has done so.]",
      "modified": "2026-02-15T22:03:06.041000",
      "created": "2026-01-16T23:05:28.261000",
      "tags": [
        "united",
        "win32",
        "urls",
        "twitter",
        "trojan",
        "united states",
        "dynamicloader",
        "default",
        "delete c",
        "json",
        "ascii text",
        "high",
        "data",
        "write c",
        "stream",
        "write",
        "malware",
        "dirty",
        "servers",
        "unknown aaaa",
        "Crazy Frost",
        "create c",
        "port",
        "destination",
        "unknown",
        "encrypt",
        "passive dns",
        "Verizon",
        "Twitter",
        "url analysis",
        "url add",
        "http",
        "files related",
        "related tags",
        "Project Cicada",
        "present nov",
        "present dec",
        "present sep",
        "present jul",
        "present jun",
        "or icon",
        "gold w",
        "dots larger",
        "background",
        "pegasus",
        "meta",
        "backdoor",
        "ransom",
        "checkin",
        "trojandropper",
        "mtb nov",
        "ipv4",
        "data upload",
        "extraction",
        "ottow",
        "Christopher Ahmann",
        "Pegasus",
        "url https",
        "hostname",
        "files domain",
        "present jan",
        "moved",
        "ip address",
        "record value",
        "apache",
        "paris",
        "followupboss",
        "type",
        "hostname add",
        "next associated",
        "title error",
        "reverse dns",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "connect",
        "head",
        "tlsv1",
        "accept",
        "date",
        "powershell",
        "iframe",
        "span",
        "push",
        "next",
        "shark",
        "Connection",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "pattern match",
        "size",
        "null",
        "refresh",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "Denver, Co 80211",
        "body",
        "title",
        "One Reach AI"
      ],
      "references": [
        "https://pegasuspartners.followupboss.com/unsubscribe/eh-MhVRQnJl0_bAFwnKkNcLhcpKKkFNZoZGVdqXUj3YdKSnKqAu_ZtK_m2bfbflpBDP5tU_QK4_N_bD0zVR_qs69dqt0K9vHSjNpk4p_WlGOHiyG5drGp98yBthkeHFIf3TXQbQPk8UzVtbZUILxzg~~ No Expiration\t0",
        "pegasuspartners.followupboss.com",
        "Project Cicada: verizon.pr1414.my.nonprod-asurion53.com",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/07d20574d361258ee514f507936703dbea55db4a6d123602c0d2a67e9f14196d",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/fbb538f322026e57d467e9dbccdbaf181e08149c50216385b7235a43e80ea0c8",
        "Hostname admin.test-aws-responsible-oyster-8905-us-east-1.space.dev.a0core.net",
        "search.roi.ros.gov.uk",
        "ftp.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "forum.remote.docs.home.git.fr.yandex.avito.sberbank.pay.avito.blablacar.blablacar.gitlab.ces4ld2kbfghhbju9r40.haard.info",
        "Denver, US 80211 https://otx.alienvault.com/indicator/domain/onereach.ai",
        "Denver, US 80211 http://library.verizon.onereach.ai",
        "https://sa.josht.ca\t\u2022 https://sa.josht.ca/ \u2022 https://staging.josht.ca/\t\u2022 https://test.josht.ca/",
        "https://p2d.josht.ca/api/depots/info/?depot= \u2022 https://p2d.josht"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 11078,
        "hostname": 4331,
        "domain": 1932,
        "FileHash-SHA256": 1999,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 169,
        "email": 5,
        "SSLCertFingerprint": 6,
        "CVE": 1
      },
      "indicator_count": 19878,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69642a749490c0bf404aa8ac",
      "name": "Google Services - Malware Packed Google Branded Services",
      "description": "Contacted Google services  | Service (1 of 3) || GoogleChromeElevationService | Mofksys \u2022 Unruy | Relationship: https://otx.alienvault.com/pulse/69640c0afc9805a6fa2da07b | \n#affilliated #worm _#exploit #alternate_google #infection #spyware",
      "modified": "2026-02-10T22:01:54.041000",
      "created": "2026-01-11T22:55:48.308000",
      "tags": [
        "write c",
        "write",
        "delete c",
        "ms windows",
        "pe32 executable",
        "globalc",
        "united",
        "worm",
        "malware",
        "defender",
        "united states",
        "google",
        "google account",
        "mtb ids",
        "cloudflare dns",
        "https domain",
        "tls sni",
        "medium priority",
        "yara detections",
        "alerts",
        "google play",
        "google api",
        "google chrome",
        "mofksys",
        "exploit",
        "process32nextw",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "search",
        "precreate read",
        "read c",
        "dock",
        "unknown",
        "suspicious",
        "alt google",
        "execution att",
        "lowfi",
        "mtb jan",
        "trojandropper",
        "passive dns",
        "backdoor",
        "win32upatre jan",
        "origin trial",
        "gmt cache",
        "443 ma2592000",
        "possible",
        "trojan",
        "title",
        "mtb dec",
        "ipv4 add",
        "state",
        "trojan",
        "dropper",
        "phishing",
        "ransom",
        "of colorado"
      ],
      "references": [
        "accounts.google.com \u2022 apis.google.com clients2.google.com \u2022 clients2.googleusercontent.com",
        "142.251.9.95 \u2022 https://clients2.google.com/cr/report \u2022 accounts.google.com \u2022",
        "ogads-pa.clients6.google.com \u2022  optimizationguide-pa.googleapis.com \u2022 play.google.com",
        "update.googleapis.com \u2022 www.google.com \u2022 clientservices.googleapis.com",
        "Worm:Win32/Mofksys.RND!MTB |  Yara Detections: SUSP_Imphash_Mar23_2",
        "IDS Detection: Observed Cloudflare DNS over HTTPS \u2022 Domain (cloudflare-dns .com in TLS SNI)",
        "Alerts: suspicious_iocontrol_codes infostealer_cookies persistence_autorun antisandbox_sleep",
        "Alerts: persistence_autorun_tasks polymorphic procmem_yara static_pe_anomaly antiav_detectfile",
        "Alerts: antiav_detectreg antivm_bochs_keys antivm_generic_disk infostealer_mail injection_write",
        "Alerts: suspicious_command_tools anomalous_deletefile mouse_movement_detect",
        "Alerts: dynamic_function_loading resumethread_remote_process stealth_hiddenreg",
        "Contacted Google services",
        "SERVICE NAME: SSDPSRV \u2022 Delete upnphost\tDelete \u2022 GoogleChromeElevationService",
        "https://otx.alienvault.com/indicator/file/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "codewiki.google",
        "Win.Malware.Unruy-6912804-0 IDS Detections: Win32/Unruy.C Activity 403 Forbidden",
        "Alerts: network_icmp persistence_autorun antivm_vmware_in_instruction",
        "Alerts: network_http antisandbox_sleep creates_exe dropper stealth_window",
        "Alerts: injection_process_search protection_rx",
        "IP\u2019s Contacted: 142.250.74.68  142.250.74.99  18.66.121.69  185.53.179.170  2.22.41.134  204.79.197.200",
        "IP\u2019s Contacted: 208.91.196.46  209.197.3.8  216.239.32.29  35.186.238.101",
        "Domains Contacted: www.microsoft.com www.bing.com www2.megawebdeals.com www.google.com",
        "Domains Contacted: ocsp.pki.goog www.download.windowsupdate.com ifdnzact.com",
        "Domains Contacted: d38psrni17bvxu.cloudfront.net www2.megawebfind.com  www6.megawebfind.com",
        "PE Version Information : TJprojMain.exe",
        "Found in : https://otx.alienvault.com/pulse/69640c0afc9805a6fa2da07b",
        "IDS Detections Win32/Unruy.C Activity \u2022 403 Forbidden"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Win.Malware.Unruy-6912804-0",
          "display_name": "Win.Malware.Unruy-6912804-0",
          "target": null
        },
        {
          "id": "Win.Packed.Eyestye-9754938-0",
          "display_name": "Win.Packed.Eyestye-9754938-0",
          "target": null
        },
        {
          "id": "Eyestye",
          "display_name": "Eyestye",
          "target": null
        },
        {
          "id": "AutoRun",
          "display_name": "AutoRun",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Trojan:Win32/EyeStye.T",
          "display_name": "Trojan:Win32/EyeStye.T",
          "target": "/malware/Trojan:Win32/EyeStye.T"
        },
        {
          "id": "ALF:HeraklezEval:PUA:Win32/4Shared",
          "display_name": "ALF:HeraklezEval:PUA:Win32/4Shared",
          "target": null
        },
        {
          "id": "Cassini",
          "display_name": "Cassini",
          "target": null
        },
        {
          "id": "DarkMoon",
          "display_name": "DarkMoon",
          "target": null
        },
        {
          "id": "PolyRansom",
          "display_name": "PolyRansom",
          "target": null
        },
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Malware  Packed",
          "display_name": "Malware  Packed",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1078.003",
          "name": "Local Accounts",
          "display_name": "T1078.003 - Local Accounts"
        },
        {
          "id": "T1078.001",
          "name": "Default Accounts",
          "display_name": "T1078.001 - Default Accounts"
        },
        {
          "id": "T1087.003",
          "name": "Email Account",
          "display_name": "T1087.003 - Email Account"
        },
        {
          "id": "T1078.002",
          "name": "Domain Accounts",
          "display_name": "T1078.002 - Domain Accounts"
        },
        {
          "id": "T1090.004",
          "name": "Domain Fronting",
          "display_name": "T1090.004 - Domain Fronting"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1588.001",
          "name": "Malware",
          "display_name": "T1588.001 - Malware"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 198,
        "FileHash-SHA1": 165,
        "FileHash-SHA256": 867,
        "URL": 1461,
        "hostname": 429,
        "domain": 221,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 3342,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "68 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://git.irsig.net/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://git.irsig.net/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776637494.1956244
}