{ "type": "URL", "indicator": "https://github.com/twbs/bootstrap/graphs/contributors", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://github.com/twbs/bootstrap/graphs/contributors", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #87", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #560", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain github.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain github.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 2949366157, "indicator": "https://github.com/twbs/bootstrap/graphs/contributors", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 47, "pulses": [ { "id": "69d4f2dd828bbf0ac5efaa23", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:44.957000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4f2db0b3448671adcce16", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:43.156000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4f2d9ce86a445b484593b", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:41.097000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d46ee1379578309fae9a4a", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:37.877000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 110, "hostname": 45, "domain": 179 }, "indicator_count": 1777, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d46ee073b843b1b52f59a2", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:36.582000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 116, "hostname": 49, "domain": 182, "email": 1 }, "indicator_count": 1791, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4569dc87656b4a255a124", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:05.842000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 281, "FileHash-SHA1": 277, "FileHash-SHA256": 2208, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3123, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4569a944adf94a75efcf9", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:02.158000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 287, "FileHash-SHA1": 283, "FileHash-SHA256": 2301, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3228, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4510870e9906d58e7a554", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:16.928000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d45107d82d67453e8ade06", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:15.789000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4510678007ab57751a513", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:14.009000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d45104133846ffc6b2a6fe", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:12.507000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4442a0b5217c34bbcbd2d", "name": "VirusTotal report\n for install.sh", "description": "", "modified": "2026-05-06T23:07:30.047000", "created": "2026-04-06T23:39:22.105000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 45, "FileHash-SHA256": 1421, "URL": 261, "hostname": 73, "domain": 235, "email": 1 }, "indicator_count": 2079, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d44428ad43f231ff43e175", "name": "VirusTotal report\n for install.sh", "description": "", "modified": "2026-05-06T23:07:30.047000", "created": "2026-04-06T23:39:20.767000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 43, "FileHash-SHA1": 45, "FileHash-SHA256": 1421, "URL": 261, "hostname": 73, "domain": 235, "email": 1 }, "indicator_count": 2079, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43adce952052db1643eb1", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:40.683000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43adaef39c73f026077c0", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:38.174000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43ada131daf14003078c7", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:38.191000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43ad5541cf4a7ee45cef5", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:33.577000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43ad5128bbd414bbd946f", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:33.569000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43acb355ea778bf740a6d", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:23.936000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d43ac218b1452b90077c29", "name": "VirusTotal report\n for addon.crx", "description": "<<< This is the full list of results from this year's \u00c2\u00a31.2bn (1bn euros) Google search, which includes the results of the search for the world's most popular search engine.>>", "modified": "2026-05-06T22:12:40.990000", "created": "2026-04-06T22:59:14.467000", "tags": [ "zip archive", "opera widget", "vym mind", "sweet home", "design", "mozilla firefox", "mozilla archive", "format", "file type", "php script", "ascii", "ascii text", "unicode text", "utf8 text", "crlf line", "json", "java source", "extra info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1046", "name": "Network Service Scanning", "display_name": "T1046 - Network Service Scanning" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1185", "name": "Man in the Browser", "display_name": "T1185 - Man in the Browser" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 316, "FileHash-SHA1": 314, "FileHash-SHA256": 1415, "hostname": 132, "domain": 50, "URL": 86 }, "indicator_count": 2313, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69cc5ded52dc76b20579fd67", "name": "VirusTotal report\n for sample.crx", "description": "The full text of the text and characters below:-1-2-3-4-7 January 2017:.com/1/18:00 BST.-9:30 GMT.", "modified": "2026-04-30T23:10:15.978000", "created": "2026-03-31T23:51:09.089000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "html document", "mitre attack", "malicious", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/0e93e52376dcfb8eab491737c187ad68d786fab0005bbf9d2ffab78ba19db907_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775001268&Signature=YBUj6DKVhfcrBcdkki8xfcRH%2F%2FP32FDK7Zizn8pLHZ3D6s3E7isdEd2LROfkC1lKu2qP4ZcDMm8av3%2BUajeevjxBnk%2FJLOrW%2Fcl%2FG1jKYFVsw9yQm7CXUYgYjHS2JPx%2B910377bbnD7%2FQjxuptI22kTDC%2FK4Kxn6e9yDWXa7P9r63qwHoncRKLSca%2FQDZtmttEQ0ZlmTWhu5tKz%2F8hSVLfvFkZpPRcKYX%2BQoYiNdQ4wAoK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 14, "FileHash-SHA1": 14, "FileHash-SHA256": 141, "hostname": 28, "URL": 25, "domain": 7 }, "indicator_count": 229, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "31 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69cc5324a3e01fc39bd2905c", "name": "CAPE Sandbox", "description": "tmptigu40dy", "modified": "2026-04-30T23:10:15.978000", "created": "2026-03-31T23:05:08.976000", "tags": [ "eaaa", "maaa", "kaca", "kaaa", "eaca", "uaaa", "yaaa", "iaca", "eaei", "waaa", "dino", "cheat", "twitter", "null", "span", "title", "roboto", "false", "error", "kerm", "import", "click", "mono", "cloud", "accept", "manipulator", "restart", "runner", "factory", "checkbox", "star", "egdi", "canvas", "window", "shutdown", "win64", "small", "override", "install", "meta", "body", "project", "outer", "scroll", "speed", "score" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/0e93e52376dcfb8eab491737c187ad68d786fab0005bbf9d2ffab78ba19db907_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774998466&Signature=Y4QdGLgX1a6Ct5CMRDpH9RdwtjTzLLVBFFtxY64ZOhJ4cyy5f3YP7kNt%2Bu9euHjYaM5LUKHRWbswYwhD%2BbmD8KZT57GNGNGF4xYoyqPgzPY1AQodW%2BZx5f3iJqPbAZq9pUjOzXtm22B%2FEx7BVn5qcm86M9I6BaNp8%2FJW2vSfzsewT0w5WhMAjuB84fIG4LrKD2X46mnchNmREfC3GQtUPwzIIkj7IIv7xyHtwbu%2Fwyg8Ib1VFz" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 141, "FileHash-SHA1": 141, "FileHash-SHA256": 142, "URL": 26, "domain": 19, "hostname": 69 }, "indicator_count": 538, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "31 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69cc5323b73b229c433015b3", "name": "CAPE Sandbox", "description": "tmptigu40dy", "modified": "2026-04-30T23:10:15.978000", "created": "2026-03-31T23:05:07.234000", "tags": [ "eaaa", "maaa", "kaca", "kaaa", "eaca", "uaaa", "yaaa", "iaca", "eaei", "waaa", "dino", "cheat", "twitter", "null", "span", "title", "roboto", "false", "error", "kerm", "import", "click", "mono", "cloud", "accept", "manipulator", "restart", "runner", "factory", "checkbox", "star", "egdi", "canvas", "window", "shutdown", "win64", "small", "override", "install", "meta", "body", "project", "outer", "scroll", "speed", "score" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/0e93e52376dcfb8eab491737c187ad68d786fab0005bbf9d2ffab78ba19db907_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774998466&Signature=Y4QdGLgX1a6Ct5CMRDpH9RdwtjTzLLVBFFtxY64ZOhJ4cyy5f3YP7kNt%2Bu9euHjYaM5LUKHRWbswYwhD%2BbmD8KZT57GNGNGF4xYoyqPgzPY1AQodW%2BZx5f3iJqPbAZq9pUjOzXtm22B%2FEx7BVn5qcm86M9I6BaNp8%2FJW2vSfzsewT0w5WhMAjuB84fIG4LrKD2X46mnchNmREfC3GQtUPwzIIkj7IIv7xyHtwbu%2Fwyg8Ib1VFz" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 141, "FileHash-SHA1": 141, "FileHash-SHA256": 142, "URL": 26, "domain": 19, "hostname": 69 }, "indicator_count": 538, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "31 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c2972ecff7f021de5be0d9", "name": "CAPE Sandbox", "description": "traffic manager atm", "modified": "2026-04-23T13:04:04.453000", "created": "2026-03-24T13:52:46.060000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 141, "FileHash-SHA1": 141, "FileHash-SHA256": 142, "URL": 26, "domain": 19, "hostname": 69 }, "indicator_count": 538, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "38 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68038f7eb6f6810aa6d6439f", "name": "\"+g+\"", "description": "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.aspx?Id=855bdfc1-7dbc-4a86-9d27-89ebb0ecf166&archival=False", "modified": "2025-09-01T08:05:25.121000", "created": "2025-04-19T11:56:46.933000", "tags": [ "copyright", "customevent", "typeof e", "boomerang", "typeof t", "macintosh", "os x", "post", "typeof", "iframe", "date", "poka menu", "nie znaleziono", "poka start", "poka", "max dostpnych", "pierwsza", "ostatnia", "nastpna", "poprzednia", "brak danych", "first", "ceidg", "wystpi bd", "error", "true", "null", "linkdownload", "show", "ctrlmappings", "version", "versionchange", "body", "false", "span", "input", "paginate", "next", "last", "selectstart", "loop", "function", "bootstrap", "datatables", "responsive", "2016 sprymedia", "amd define", "object", "commonjs", "window", "browser", "button", "datatable", "sprymedia ltd", "columns", "colidx", "column", "parent", "child", "param", "display", "click", "middle", "class", "target", "never", "find", "footer", "close", "regexp", "matches", "cookie", "inputmask", "input mask", "robin herbots", "mit license", "xmlhttprequest", "left", "month", "boolean", "maxdate", "right", "daterangepicker", "yyyymmdd", "calendar", "jquery", "webpackrequire", "typeof symbol", "type", "setprototypeof", "maskpos", "wrapnativesuper", "backspace", "insert", "internal", "mask", "void", "this", "nie mona", "array", "nonmsdombrowser", "horizontal", "leftarrow", "uparrow", "rightarrow", "downarrow", "explorer", "form", "legend", "hmmss", "mmmm d", "yyyy h", "typeof define", "number", "locale", "character", "seeknext", "masked", "input plugin", "josh bush", "azaz", "azaz09", "black", "kontrast", "arrcookies", "getcookielang", "and information", "on business", "sign", "twoja", "opinia", "informacja o", "notify ui", "widget", "eric hynds", "dual", "name", "dtopt", "example", "using", "open", "adata", "hungarian", "aria", "legacy", "trident", "format", "nuke", "apos", "bitcoin", "outer", "mark", "info", "reload", "behaviour", "write", "buttons", "anything", "prop", "thecookie", "create", "thevalue", "string name", "pluginscookie", "author", "eventkey", "datakey", "default", "dataapikey", "defaulttype", "config", "shown", "trigger", "delta", "guard", "arrow", "leave", "scroll", "dataspy", "sessiontimeout", "return", "settimeout", "mytimerid", "requestcounter", "starttimer", "stop", "typeof n", "adminlte", "typeof o", "main", "js application", "adminlte v2", "colorlib", "ui date", "written", "jacek wysocki", "poprzedni", "marzec", "kwiecie", "czerwiec", "lipiec", "sierpie", "wrzesie", "openpopup", "href", "toggle", "msviewport", "popover", "json", "json text", "string", "otherwise", "holder", "mind", "copy", "meta", "third", "text", "choice", "confirm", "nie pytaj", "site", "title", "value", "alert", "warn", "migrate", "foundation", "see http", "forget", "newvalue", "nones5", "fall", "wrongvalid", "onerror", "year", "fast", "argument", "popper", "method", "data", "html", "flip", "factory", "onload", "tbody", "courier", "elem", "handle", "expando", "match", "selector", "sizzle", "android", "capture", "seed", "pass", "enough", "code", "bind", "core", "local", "verify", "accept", "done", "override", "inject", "possible", "hold", "45deg", "larger", "screen styling", "90deg", "support", "sidebar mini", "e1f0ff", "font awesome", "free", "autocomplete", "folder", "expanded folder", "tabela", "sorting", "xform", "nadpisane style", "menlo", "monaco", "consolas", "mono", "courier new", "browse", "twitter", "pt serif", "georgia", "times new", "roman", "times", "typetime", "import", "roboto", "http", "label", "demos", "effect", "inst", "super", "speed", "bounce", "hack", "logic", "shift", "double", "february", "april", "june", "august", "friday", "erase", "atom", "caja", "spinner", "refresh", "alpha", "sentinel", "back", "blind", "drop", "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g", "prosz czeka", "pobierz plik" ], "references": [ "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.aspx?Id=855bdfc1-7dbc-4a86-9d27-89ebb0ecf166&archival=False", "UE_pl_top.svg", "UE_pl_top_sm.svg", "XZ4AH-ABKPW-SQPBC-CYWES-BCG6V", "dataTables.lang.js.pobrane", "EntryChangeHistory.aspx.js.pobrane", "dataTables.input.js.pobrane", "responsive.bootstrap4.js.pobrane", "dataTables.bootstrap4.js.pobrane", "dataTables.responsive.js.pobrane", "jquery.session.js.pobrane", "inputmask.binding.js.pobrane", "daterangepicker.js.pobrane", "jquery.inputmask.min.js.pobrane", "ScriptResource.axd", "moment-with-locales.min.js.pobrane", "jquery.maskedinput-1.2.2.js.pobrane", "feedback.js.pobrane", "jquery.notify.min.js.pobrane", "jquery.dataTables.js.pobrane", "jquery.cookie.js.pobrane", "bootstrap.js.pobrane", "SessionTimeout.js.pobrane", "adminlte.min.js.pobrane", "jquery.easing.1.3.js.pobrane", "jquery.feedbackBadge.min.js.pobrane", "ui.datepicker-pl.js.pobrane", "ceidg-master.js.pobrane", "CommonResponsive.js.pobrane", "json2.js.pobrane", "jquery.alerts.js.pobrane", "jquery-migrate-1.2.1.js.pobrane", "dataTables.bootstrap4.css", "CommonScripts.js.pobrane", "popper.js.pobrane", "responsive.bootstrap4.css", "jquery-3.0.0.js.pobrane", "daterangepicker.css", "AdminLTE.css", "ui.notify.css", "ceidg.css", "bootstrap-gov-pl.css", "biznes.css", "jquery-ui.js.pobrane", "saved_resource.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 4, "FileHash-SHA256": 25, "URL": 165, "domain": 353, "hostname": 215, "email": 2 }, "indicator_count": 767, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "272 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "595 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ed8f7d4b5483117bb66", "name": "abuse.ch", "description": "", "modified": "2023-12-06T15:10:16.397000", "created": "2023-12-06T15:10:16.397000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 223, "domain": 383, "URL": 1639, "hostname": 560, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c8f50527fb73205bfca", "name": "Dreamhost.com - Drift Widget", "description": "", "modified": "2023-12-06T15:00:31.809000", "created": "2023-12-06T15:00:31.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 174, "domain": 464, "URL": 1119, "hostname": 156, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 1916, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c45f8a517d76d776231", "name": "Malware - reliablesite.net", "description": "", "modified": "2023-12-06T14:59:17.346000", "created": "2023-12-06T14:59:17.346000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 238, "domain": 565, "hostname": 827, "URL": 2233 }, "indicator_count": 3863, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c37c54dd9e78f85c0fa", "name": "\u7ea2\u674f\u89c6\u9891 malware", "description": "", "modified": "2023-12-06T14:59:03.859000", "created": "2023-12-06T14:59:03.859000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1686, "hostname": 2218, "URL": 5740, "domain": 901, "FileHash-MD5": 3 }, "indicator_count": 10548, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c0791fece390b1a096e", "name": "Choopa.com - vultr", "description": "", "modified": "2023-12-06T14:58:15.734000", "created": "2023-12-06T14:58:15.734000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 453, "hostname": 1241, "domain": 430, "URL": 3454 }, "indicator_count": 5578, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657081d6ab82e2a5046133ad", "name": "maxcdn.bootstrapcdn.com:bootstrap:4.0.0:js:bootstrap.min.js%22,.", "description": "", "modified": "2023-12-06T14:14:46.566000", "created": "2023-12-06T14:14:46.566000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 83, "hostname": 93, "URL": 170, "domain": 61, "FileHash-MD5": 3 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626d5deabac11a947774de99", "name": "http://gczlau.com/c3af94f661", "description": "Live link sent via sms", "modified": "2022-05-29T00:01:17.829000", "created": "2022-04-30T16:03:54.153000", "tags": [ "move", "typetext", "typeemail", "typetel", "eace", "eacb", "aaed", "eachb", "yaay", "event", "cacb", "cacf", "typeof t", "text", "function", "load snowplow", "checks", "gets", "getmainpageub", "page", "clkg", "creates custom", "use visitor", "track form", "form", "support", "typeof", "text display", "typeof q", "typeof d", "post", "anura", "display support", "sympathizing", "quaker", "webview", "trident", "android", "date", "snowplow", "array", "anthon pang", "typeof e", "version", "author", "alex dean", "simon andersson", "fred blundun", "enter their", "phone number", "strong", "backstory", "privacy", "policy", "partner lookup", "partnerlookup", "diego", "new york", "contact", "segoe ui", "emoji", "href", "roboto", "helvetica neue", "arial", "apple color", "symbol", "typecheckbox", "typeradio", "twitter", "typeerror", "clickdataapi", "hidden", "typeof n", "bootstrap", "regexp", "error", "mouseleave", "click", "dataspy", "body", "pseudo", "child", "sufeffxa0", "class", "attr", "null", "this", "guide my", "yes no", "male female", "romance", "analyzing", "get started", "enter", "your partner", "number" ], "references": [ "https://guidemyrelationship.com/?aff_id=2509&offer_id=6300&aff_sub=1726&aff_sub2=102a78845625980c3bb3f54bd8acd3&aff_sub3=", "https://guidemyrelationship.com/assets/js/jquery-3.3.1.min.js", "https://guidemyrelationship.com/assets/js/bootstrap.min.js", "https://guidemyrelationship.com/assets/js/main.js", "https://guidemyrelationship.com/assets/css/bootstrap.min.css", "https://www.thepartnerlookup.com/?affid=1726&txid=1028d018569e59e3856f7416969ab0&offer_id=2509", "https://d34qb8suadcc4g.cloudfront.net/sp-2.14.0.js", "https://www.thepartnerlookup.com/main.bundle-fed11df.z.js", "https://builder-assets.unbounce.com/published-css/main-7b78720.z.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 333, "FileHash-SHA256": 106, "domain": 170, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1611, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1464 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62676c65b80720b582b46037", "name": "Dreamhost.com - Drift Widget", "description": "function.1, a new version of JavaScript, has been added to the end of the year to make it easier for users to keep up with the latest developments in the search for a specific date.", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-26T03:52:05.599000", "tags": [ "template7class", "regexp", "root", "context", "match", "body", "template7", "error", "prop", "function", "date", "null", "slice", "void", "factory", "window", "find", "simple", "false", "hj", "object", "hotjar", "email", "typeof symbol", "typeof e", "telefon", "array", "survey", "meta", "cookie", "scroll", "keypress", "trident", "live", "fullscreen", "generic", "widget", "ciudad", "adore", "experiment", "mutation", "click", "pluginname", "hidden", "nttt", "fieldset", "class", "form", "fast", "jquery", "format", "february", "april", "june", "august", "nova", "paris", "tokyo", "easy", "speed", "back", "target", "copy", "kill", "this", "infinity", "accept", "locale", "custom build", "https", "boolean", "new boolean", "typeof", "typeerror", "bootstrap", "typeof t", "javascript", "show", "drift widget", "segoe ui", "emoji", "type", "copyright", "browse", "roboto", "helvetica neue", "arial", "noto", "apple color", "twitter", "typeof require", "modulenotfound", "font awesome", "typeof define", "script", "new date", "number", "trackevent", "string", "watched", "search", "clicked", "path", "starter", "download", "derek", "code", "esnull", "gtmphvk7ln", "closure library", "xdfunction", "reduceright", "vd", "g1f7wlmm0k2", "r420", "uint8array", "typeof d", "ieproto", "typeof n", "widgetrootqa", "driftconductor" ], "references": [ "xfe-URL-Dreamhost.com-stix2-2.1-export.json", "https://js.driftt.com/include/1650944100000/2y43hyefanc8.js", "https://www.google-analytics.com/plugins/ua/linkid.js", "https://www.googletagmanager.com/gtag/js?id=G-1F7WLMM0K2&l=dataLayer&cx=c", "https://www.google-analytics.com/gtm/optimize.js?id=GTM-PHVK7LN", "https://www.googletagmanager.com/gtm.js?id=GTM-TLN654", "https://kit.fontawesome.com/7d998cc9b7.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://www.dreamhost.com/assets/bootstrap-aa47564acfdf18ce859b8e1fd130d889920ae66415b3db4de8505d42a0477b09.css", "https://js.driftt.com/core?embedId=2y43hyefanc8®ion=US&forceShow=false&skipCampaigns=false&sessionId=5a8c1b8d-2626-4a43-a7a6-76e9416f2f52&sessionStarted=1650943819.009&campaignRefreshToken=a2d9846a-8932-4e3c-a8d5-878681a555e0&hideController=false&pageLoadStartTime=1650943817154&mode=CHAT&driftEnableLog=false", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650943817154", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://www.dreamhost.com/assets/scripts/bootstrap-7670fc8587f9fd0608d2af67f392281a9a4fbf4cb4252952ecb8d34f6ee286b3.js", "https://www.dreamhost.com/assets/scripts/webp-support-1dd791309dc3fa5b166a0a326e49345fe5acb5acbc1831f4c7be87efce1abf51.js", "https://www.dreamhost.com/assets/site-75a1aba399db4de4e4093997b8fc8ff8ec5e65b5f4258c9a658a5cacacbf6e0d.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://cdn.abrankings.com/js/client.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 174, "URL": 1119, "domain": 464, "hostname": 156, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 1916, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6266e05eead46d425dff53c2", "name": "inap.com - Drift Widget", "description": "function R(a,b,c,d,e,f) is a new type of JavaScript, which allows the browser to control its browser without a set of buttons or controls..", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T17:54:38.551000", "tags": [ "drift widget", "javascript", "typeerror", "name", "typeof t", "getconfig", "default", "typeof e", "area", "event", "shadowroot", "boolean", "error", "shown", "click", "null", "window", "trident", "body", "formdata", "property", "377867625", "script", "textjavascript", "piscriptnum", "function", "regexp", "class", "attr", "pseudo", "child", "typeof module", "reduceright", "vd", "number", "string", "trackevent", "copyright", "standard", "pageview", "hpgform", "hpgdownload", "path", "download", "derek", "void", "date", "code", "ieproto", "object", "typeof", "typeof n", "widgetrootqa", "driftconductor", "license", "small batch", "apache license", "version", "unless", "as is", "basis", "without", "warranties or", "apache", "sessionid", "session", "post", "contenttype", "snull" ], "references": [ "xfe-URL-Inap.com-stix2-2.1-export.json", "https://ws.zoominfo.com/pixel/1FBtpCEkYmFObuGSt7zC", "https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js", "https://js.driftt.com/include/1650908400000/puh6a6h2pc6k.js", "https://www.googletagmanager.com/gtm.js?id=GTM-KPQ5FFK", "https://www.inap.com/inap/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "https://go.inap.com/analytics?conly=true&visitor_id=377865231&visitor_id_sign=fcd1b8a6054d2c2490cb77f4d0581558910b2792df8a7d07c6a0b0282eba2cd0db306c84706e8688a4165a4437c383a8e130703a&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "https://js.driftt.com/conductor/assets/4.fa5fc959.chunk.js", "https://www.inap.com/inap/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=3.2.4", "https://www.inap.com/inap/wp-content/themes/inap/assets/js/bootstrap.bundle.min.js?ver=2.0.0", "https://8794842.fls.doubleclick.net/activityi;src=8794842;type=front;cat=newun0;ord=1047846285161;gtm=2wg4k0;auiddc=1226623845.1650908333;~oref=https%3A%2F%2Fwww.inap.com%2F", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650908332393", "https://js.driftt.com/core?embedId=puh6a6h2pc6k®ion=US&forceShow=false&skipCampaigns=false&sessionId=34bf8b51-4431-413e-ac31-6833e0d5600c&sessionStarted=1650908334.439&campaignRefreshToken=6e5a949b-b933-4b76-8614-902cd18d34a6&hideController=false&pageLoadStartTime=1650908332393&mode=CHAT&driftEnableLog=false" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1239, "URL": 3619, "domain": 565, "FileHash-SHA256": 300 }, "indicator_count": 5723, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628d21a4558f3ccf49c07931", "name": "abuse.ch", "description": "Looking for wizard spider. Some domains have .ru and .su (Soviet Union)", "modified": "2022-05-24T18:19:16.027000", "created": "2022-05-24T18:19:16.027000", "tags": [ "twitter follow", "button follow", "reduceright", "number", "string", "regexp", "error", "f420", "gmzsj4f05dr", "copyright", "deviceandgeo", "googlesignals", "json", "date", "void", "sxa0", "typeerror", "cbfunction", "deferred", "closure library", "b1342177279", "this", "infinity", "iframe", "trident", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "button", "tridentmsieedge", "linux", "twttr", "area", "false", "twitter", "blank", "gvjsj", "gvjsyt", "license", "small batch", "apache license", "unless", "as is", "basis", "without", "warranties or", "null", "node", "dan vanderkam", "dygraph", "gc", "gvjs8s", "mmm dd", "infinity0", "gvjs6s", "mmm d", "axis", "cell", "column", "arial", "drawingframe", "select", "textarea", "line", "inside", "gvjsih", "rnrn", "roboto", "body", "template", "outside", "rial", "gvjsob", "azaz09", "array", "april", "june", "august", "february", "span", "android", "christ", "bbfunction", "twitter tweet", "font awesome", "free", "cc by", "sil ofl", "code", "mit license", "brands", "segoe ui", "emoji", "helvetica neue", "noto", "apple color", "symbol", "noto color", "typebutton", "sprymedia ltd", "datatables", "typeof f", "without any", "warranty", "merchantability", "fitness", "a particular", "adata", "first", "next", "typeof", "typeof n", "hide", "focusin", "focusout", "shown", "js foundation", "g5gqv3cj17n" ], "references": [ "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://bazaar.abuse.ch/css/all.min.css", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://www.gstatic.com/charts/50/loader.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://abuse.ch/js/twitter_widget.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://abuse.ch/js/bootstrap.min.js", "https://abuse.ch/js/google-charts.js", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 560, "URL": 1639, "FileHash-SHA256": 223, "domain": 383, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1468 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6263b3b617c33c9a7644a9c6", "name": "psychz.net - malware", "description": "function:function t(t)var e.handleObj, a new type of JavaScript, for all types of window.. and data-api, in the form of \"transition end\".", "modified": "2022-05-23T00:00:56.946000", "created": "2022-04-23T08:07:18.262000", "tags": [ "error", "typeof e", "object", "typeof", "array", "typeof n", "typeof t", "boolean", "typeof r", "uff5c", "null", "date", "meta", "this", "scroll", "backspace", "insert", "unknown", "4096", "void", "copyright", "closure library", "reduceright", "vd", "number", "string", "regexp", "pageview", "uint8array", "gtm5pbn7g", "host", "path", "code", "typeerror", "version", "clickdataapi", "hidden", "show", "bootstrap", "click", "dataspy", "body", "mouseleave" ], "references": [ "xfe-URL-http___psychz.net_-stix2-2.1-export.json", "https://www.psychz.net/assets/js/bootstrap.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5PBN7G", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1046749228/?random=1650700509087&cv=9&fst=1650700509087&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.psychz.net%2F&tiba=DDoS%20Protected%20Data%20Centers%20In%20America%2C%20Europe%2C%20Africa%2C%20Asia&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 120, "URL": 681, "domain": 192, "FileHash-SHA256": 188 }, "indicator_count": 1181, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1470 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261873303497c0dd414ef10", "name": "Jquery and 1api.net", "description": "var Cd, Zd.com, \"G1\", \"g1\" and \" G2\" are all part of the new code for Google's tag management system, which is based on the word \"tag\".", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T16:32:51.012000", "tags": [ "tbody", "span", "thead", "tfoot", "typecheckbox", "typeradio", "href", "typesearch", "typedate", "typetime", "twitter", "error", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "regexp", "pseudo", "child", "ajax", "ajaxjsonp", "ajaxload", "ajaxparsexml", "ajaxscript", "ajaxxhr", "class", "date", "null", "number", "string", "copyright", "gtmnl3llhs", "host", "path", "closure library", "xdfunction", "adfunction" ], "references": [ "xfe-URL-Jquery.com-stix2-2.1-export.json", "xfe-URL-1api.net-stix2-2.1-export.json", "https://www.googletagmanager.com/gtm.js?id=GTM-NL3LLHS", "https://code.jquery.com/jquery-3.1.1.slim.min.js", "https://1api.net/js/bootstrap.min.js", "https://1api.net/css/bootstrap.min.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 494, "URL": 1235, "domain": 192, "FileHash-SHA256": 267 }, "indicator_count": 2188, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1472 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1472 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6260d13ab57ec96e24359914", "name": "Malware - reliablesite.net", "description": "VUE-DEVTOOLs_GLOBAL_Hook__, a description of what it will look like when it comes to testing software, is based on the type of Object.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-21T03:36:26.313000", "tags": [ "date", "swiper", "value", "trigger", "gbps", "typeof define", "typeof module", "roboto", "helvetica neue", "arial", "small", "error", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "typeerror", "typeof", "regexp", "tether error", "typeof rnullr", "anull", "typeof b", "pseudo", "child", "array", "sufeffxa0", "class", "attr", "null", "void", "65536", "typeof f", "vd", "function", "activexobject", "number", "utmb", "firefox", "shockwave flash", "utma", "utmz", "iframe", "online", "livechat", "refreshurl", "title", "imageurl", "cssclass", "chat", "object", "string", "typeof t", "incorrect", "xfunction", "target", "typeof p", "typeof btoa", "vnode", "boolean", "typeof symbol" ], "references": [ "xfe-URL-https___www.reliablesite.net_-stix2-2.1-export.json", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-main.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-vendor.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-vendors.js", "https://cdn.jsdelivr.net/emojione/2.2.7/lib/js/emojione.min.js", "https://code.jquery.com/jquery-1.12.0.min.js", "https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.0/js/tether.min.js", "https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.6/js/bootstrap.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2233, "hostname": 827, "domain": 565, "FileHash-SHA256": 238 }, "indicator_count": 3863, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62606584633e2b9a3bc935b9", "name": "\u7ea2\u674f\u89c6\u9891 malware", "description": "function s(t,e), o, is a new type of function, which throws new TypeError when it comes to trying to make a function out of its own language or its form.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T19:56:52.162000", "tags": [ "typeof t", "typeof define", "moztransform", "success", "error", "make sure", "stop", "ajax", "action", "click", "open", "active", "button", "toggle btn", "body", "scroll", "isotope", "preloader", "function", "javascript", "mit license", "typeof module", "gplv3", "license", "copyright", "metafizzy", "math", "typeof", "typeerror", "hidden", "show", "typeof n", "version", "hide", "focusin", "focusout", "shown", "startr", "endr", "federico zivolo", "distributed", "html", "statict", "flip", "regexp", "null", "void", "width", "object", "pseudo", "child", "class", "date", "accept", "webpackrequire", "name", "number", "arraybuffer", "iterator", "typedarray", "prototype", "string", "index", "meta", "target", "infinity", "zero", "epsilon", "observer", "android", "trim", "enumerate", "freeze", "internal", "bind", "window", "next", "find", "this", "rest", "middle", "canvas", "slidercaptcha", "createelement", "textdanger", "plugin", "rgba", "imagedata", "false", "touchstart", "trident", "applewebkit", "safari", "base", "presto", "gecko", "khtml", "micromessenger", "typeof e", "swiper", "most", "september", "customevent", "image", "typeof c", "twitter", "bootstrap", "rolemenu", "typeof f", "typeof g", "cookie plugin", "https", "klaus hartl", "register", "nodecommonjs", "factory", "jquery", "write", "typeof b", "array", "sufeffxa0", "attr", "\u706b\u7bad\u5185\u6d4b\u7b7e\u540d", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "push", "shift", "tencent", "barrio", "slice", "symbol", "typeof window", "maximum", "typeof symbol", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "ufe0fg", "ud83dudc6cud83c", "ud83dudc6dud83c", "welcome", "datav66d78640", "datav2f8052f5", "90deg", "datav5f1e575c", "datave97d7462", "helvetica neue", "helvetica", "10px", "pingfang sc", "arial", "45deg", "typenumber", "opacity0", "mozopacity0", "khtmlopacity0", "opacity100", "event", "boolean", "uint8array", "errordetails", "info", "checker", "generator", "blink", "keepalive", "4096", "unknown", "meteor", "rhino", "mini", "comment", "verify", "yeke", "codec", "media", "live", "speed", "headname", "axiostimeout", "apiurl", "bmi86hjtsk", "root", "length", "indexof", "x0ax20x20x20x20", "location", "0x10", "0x18", "history", "config", "cookie", "onload", "video", "afunction", "indexnotice", "sitehome", "x20trnf", "please", "strong" ], "references": [ "xfe-URL-sys95.com-stix2-2.1-export.json", "https://2001.habyc.com/?channelNo=2001#/home", "https://sdk.51.la/event/js-sdk-event.min.js?u=JdoUNv3VSW0GHUpw", "https://2001.habyc.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://sdk.51.la/js-sdk-pro.min.js", "https://2001.habyc.com/js/config.js", "xfe-URL-2001.habyc.com-stix2-2.1-export.json", "https://2001.habyc.com/static/js/chunk-vendors.9d7684f4.js", "xfe-URL-habyc.com-stix2-2.1-export.json", "https://2001.habyc.com/static/css/chunk-vendors.6a41b67e.css", "https://2001.habyc.com/static/css/app.88afcfd8.css", "https://2001.habyc.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://2001.dwlww.com/?channelNo=2001#/home", "https://2001.dwlww.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://2001.dwlww.com/js/config.js", "https://2001.dwlww.com/static/js/chunk-vendors.9d7684f4.js", "https://2001.dwlww.com/static/js/app.9d5d18d7.js", "https://2001.dwlww.com/static/css/chunk-vendors.6a41b67e.css", "https://2001.dwlww.com/static/css/app.88afcfd8.css", "https://2001.dwlww.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://www.tidio.com/talk/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://chatting.page/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://widget-v4.tidiochat.com/code/kv6vcosd7tmhsetmarsoawzaglejnny4.js", "https://m4244.com:35003/", "https://www.8098.app:21568/?agent=7691755704", "https://www.8098.app:21568/js/jquery-1.11.3.min.js", "https://www.8098.app:21568/js/xinstall_inner_e.min.js?v=1004", "https://app.ynsdty.cn//package/GmCC6WISh", "https://app.ynsdty.cn/dist/js/jquery.min.js", "https://app.ynsdty.cn/dist/js/jquery.cookie.js", "https://app.ynsdty.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://app.ynsdty.cn/dist/vendors/swiper/swiper.min.js", "https://app.ynsdty.cn/dist/js/app.base.js", "https://app.ynsdty.cn/dist/js/longbow.slidercaptcha.js", "https://app.ynsdty.cn/dist/vendors/core-js/core.js", "xfe-URL-sun.net.hk-stix2-2.1-export.json", "https://www.sunnetwork.com.sg/sun_21/js/vendor/jquery-3.5.0.min.js", "https://www.sunnetwork.com.sg/sun_21/js/popper.min.js", "https://www.sunnetwork.com.sg/sun_21/js/bootstrap.min.js", "https://www.sunnetwork.com.sg/sun_21/js/isotope.pkgd.min.js", "https://www.sunnetwork.com.sg/sun_21/js/imagesloaded.pkgd.min.js", "https://www.sunnetwork.com.sg/sun_21/js/main.js", "https://www.sunnetwork.com.sg/sun_21/js/ajax-form.js", "https://www.sunnetwork.com.sg/sun_21/js/slick.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 901, "URL": 5740, "hostname": 2218, "FileHash-SHA256": 1686, "FileHash-MD5": 3 }, "indicator_count": 10548, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625f2b6a1f2c9d5631d261d5", "name": "Choopa.com - vultr", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T21:36:42.286000", "tags": [ "regexp", "typeof e", "typeof t", "function", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "680876936", "389564586", "17606105819", "1044525330", "176418897", "121200080426", "1473231341", "45705983", "71770035416", "1958414417", "copyright", "closure library", "trunc", "msie", "tagpath", "fbcd", "body", "html", "gettarget", "571256413046247", "prop", "click", "typeof l", "json", "array", "string", "8760", "image", "adveid", "typeof c", "typeerror", "typeof", "facebook pixel", "pixel code", "symbol", "iterator", "constantvalue", "globalvariable", "facebook", "boolean", "service", "phonenumber", "meta", "invalid uuid", "uint8array", "nullu", "1099511627776", "t4294967296", "typeof symbol", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "reduceright", "number", "gk6536fhn4d", "r300", "typeof d", "path", "caca", "addtocart", "signup", "addtowishlist", "lead", "custom", "typeof require", "sha256", "viewcontent", "search", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtolist", "contact", "download", "install", "pnull", "style", "ctnull", "post", "uint32array", "fanull", "license", "ynull", "config", "iframe", "javascript", "code", "hoverpopup", "please", "output", "popupmodal", "country", "checkall", "invcid", "base64", "score", "attr", "js foundation", "typeof module", "ffffff", "acce22", "f0f0f0", "dadada", "typesubmit", "typebutton", "f4f4f4", "trebuchet ms", "tahoma", "woff", "footer", "segoe ui", "emoji", "tbody", "roboto", "helvetica neue", "arial", "apple color", "noto color", "type", "twitter", "xava", "gbva", "hbva", "ibva", "lcva", "cdva", "oeva", "peva", "onclickpopup", "discountmonthly", "grayoverlay", "popup into", "popup var", "center", "price", "first", "classname", "eventkey", "event", "selector", "name", "datakey", "version", "default", "shown", "target", "close", "false", "trigger", "jquery", "delta", "open", "arrow", "protected", "leave", "dataspy", "typeof define", "eventlistener" ], "references": [ "xfe-URL-Choopa.com-stix2-2.1-export.json", "https://www.choopa.com/commonimages/jquery-3.5.1.min.js", "https://www.choopa.com/_js/dragscroll.js", "https://www.choopa.com/_js/bootstrap.js", "https://www.choopa.com/_js/global.js?v=209", "https://ssl.google-analytics.com/ga.js", "https://www.choopa.com/css/bootstrap.css", "https://www.choopa.com/css/global.css?v=209", "https://my.choopa.com/js/jquery-3.5.1.min.js", "https://my.choopa.com/js/desktop.js?v=41", "https://my.choopa.com/js/global.js?v=41", "xfe-URL-Vultr.com-stix2-2.1-export.json", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.google-analytics.com/analytics.js", "https://www.redditstatic.com/ads/pixel.js", "https://www.googletagmanager.com/gtag/js?id=G-K6536FHN4D&l=dataLayer&cx=c", "https://bat.bing.com/bat.js", "https://static.ads-twitter.com/uwt.js", "https://connect.facebook.net/signals/config/571256413046247?v=2.9.57&r=stable", "https://connect.facebook.net/signals/config/438248060937995?v=2.9.57&r=stable", "https://connect.facebook.net/signals/config/828098694004178?v=2.9.57&r=stable", "https://connect.facebook.net/en_US/fbevents.js", "https://js.partnerstack.com/v1/", "https://bat.bing.com/p/action/17528422.js", "https://s.adroll.com/j/roundtrip.js", "https://s.adroll.com/j/exp/DUKHAKVYIJASHDUBG4V7RE/index.js", "https://s.adroll.com/j/sendrolling.js", "https://d.adroll.com/pixel/DUKHAKVYIJASHDUBG4V7RE/E23RMKDBEFAEXMXLWK3IWO?adroll_fpc=838a57acc6141112b6107bdce5e3fde6-1650403057055&arrfrr=https%3A%2F%2Fwww.vultr.com%2F&pv=70707106758.07146&cookie=&adroll_s_ref=&keyw=", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858656304/?random=1650403054497&cv=9&fst=1650403054497&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=3&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.vultr.com%2F&tiba=SSD%20VPS%20Servers%2C%20Cloud%20Servers%20and%20Cloud%20Hosting%20by%20Vultr%20-%20Vultr.com&hn=www.googleadservices.com&rfmt=3&fmt=4" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1241, "URL": 3454, "domain": 430, "FileHash-SHA256": 453 }, "indicator_count": 5578, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624dbf64e7682b3bf049129c", "name": "Malware-USA", "description": "Shopseg Sistemas, a company specialising in software and equipamentos for supermercados, wedi dweud eu s\u00f4n i'n \u00f4l.", "modified": "2022-05-06T16:01:29.122000", "created": "2022-04-06T16:27:16.842000", "tags": [ "dataaos", "100px00", "dataaosfade", "100px0", "dataaoszoom", "dataaosflip", "woff2", "fontface", "sans", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "reduceright", "number", "string", "gtl5jtn10ss", "regexp", "error", "r300", "copyright", "dafunction", "gafunction", "uint8array", "date", "path", "void", "const", "click", "select", "scroll", "mobile", "template", "template url", "license", "easy selector", "easy event", "easy", "back", "typeof e", "typeof t", "this", "main", "swiper", "button", "most", "mit license", "android", "win32", "null", "dblock", "email form", "validation", "action", "formdata", "api url", "typeof define", "typeof module", "gplv3", "metafizzy", "math", "plyr", "typeof symbol", "typeerror", "tnull", "cnull", "typeof", "inject", "playbook", "name", "getconfig", "default", "area", "event", "shadowroot", "boolean", "window", "trident", "body", "ofunction", "symbol", "mfunction", "sfunction", "quando", "quem", "fundada em", "informtica", "sistemas", "segurana", "softwares", "supermercados", "lojas", "restaurantes", "padarias" ], "references": [ "http://www.shopsegsistemas.com.br/", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js", "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js", "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js", "http://www.shopsegsistemas.com.br/assets/js/main.js", "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS", "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css", "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr", "xfe-IP-50.116.87.164-stix2-2.0-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Quando", "display_name": "Quando", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 254, "URL": 815, "FileHash-SHA256": 168, "domain": 174 }, "indicator_count": 1411, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1486 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624dbf641e6a04169629e662", "name": "Malware-USA", "description": "Shopseg Sistemas, a company specialising in software and equipamentos for supermercados, wedi dweud eu s\u00f4n i'n \u00f4l.", "modified": "2022-05-06T16:01:29.122000", "created": "2022-04-06T16:27:16.093000", "tags": [ "dataaos", "100px00", "dataaosfade", "100px0", "dataaoszoom", "dataaosflip", "woff2", "fontface", "sans", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "reduceright", "number", "string", "gtl5jtn10ss", "regexp", "error", "r300", "copyright", "dafunction", "gafunction", "uint8array", "date", "path", "void", "const", "click", "select", "scroll", "mobile", "template", "template url", "license", "easy selector", "easy event", "easy", "back", "typeof e", "typeof t", "this", "main", "swiper", "button", "most", "mit license", "android", "win32", "null", "dblock", "email form", "validation", "action", "formdata", "api url", "typeof define", "typeof module", "gplv3", "metafizzy", "math", "plyr", "typeof symbol", "typeerror", "tnull", "cnull", "typeof", "inject", "playbook", "name", "getconfig", "default", "area", "event", "shadowroot", "boolean", "window", "trident", "body", "ofunction", "symbol", "mfunction", "sfunction", "quando", "quem", "fundada em", "informtica", "sistemas", "segurana", "softwares", "supermercados", "lojas", "restaurantes", "padarias" ], "references": [ "http://www.shopsegsistemas.com.br/", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js", "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js", "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js", "http://www.shopsegsistemas.com.br/assets/js/main.js", "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS", "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css", "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr", "xfe-IP-50.116.87.164-stix2-2.0-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Quando", "display_name": "Quando", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1498", "name": "Network Denial of Service", "display_name": "T1498 - Network Denial of Service" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 254, "URL": 815, "FileHash-SHA256": 168, "domain": 174 }, "indicator_count": 1411, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1486 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6230162630e9d8a21c43726e", "name": "maxcdn.bootstrapcdn.com:bootstrap:4.0.0:js:bootstrap.min.js%22,.", "description": "", "modified": "2022-04-13T00:01:48.292000", "created": "2022-03-15T04:29:26.334000", "tags": [], "references": [ "maxcdn.bootstrapcdn.com:bootstrap:4.0.0:js:bootstrap.min.js%22,.pdf", "MAxbootstrap1df.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 170, "domain": 61, "hostname": 93, "FileHash-SHA256": 83, "FileHash-MD5": 3 }, "indicator_count": 410, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1510 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622caa2392bdbbfb9be6ae2e", "name": "Github Exploit", "description": "", "modified": "2022-03-12T14:11:47.295000", "created": "2022-03-12T14:11:47.295000", "tags": [ "clickdataapi", "version", "strings strings", "bootstrap", "copyright", "typeof", "typeof define", "pfunction", "boolean", "regexp", "error" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "hostname": 35, "domain": 14, "FileHash-SHA256": 32 }, "indicator_count": 146, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1541 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "https://cp.enom.com/js/global-functions.js", "MAxbootstrap1df.pdf", "https://www.inap.com/inap/wp-content/themes/inap/assets/js/bootstrap.bundle.min.js?ver=2.0.0", "https://www.gstatic.com/charts/50/loader.js", "https://www.choopa.com/commonimages/jquery-3.5.1.min.js", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/EntryChangeHistory.aspx?Id=855bdfc1-7dbc-4a86-9d27-89ebb0ecf166&archival=False", "xfe-URL-sun.net.hk-stix2-2.1-export.json", "https://www.sunnetwork.com.sg/sun_21/js/imagesloaded.pkgd.min.js", "https://app.ynsdty.cn/dist/js/longbow.slidercaptcha.js", "https://bat.bing.com/bat.js", "xfe-URL-Vultr.com-stix2-2.1-export.json", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://cdn.optimizely.com/js/26241557.js", "https://d34qb8suadcc4g.cloudfront.net/sp-2.14.0.js", "https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0-alpha.6/js/bootstrap.min.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "https://4vendeta.com/assets/js/bootstrap.min.js", "jquery.session.js.pobrane", "https://ws.zoominfo.com/pixel/1FBtpCEkYmFObuGSt7zC", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://cp.enom.com/verisign-seal.htm", "https://bazaar.abuse.ch/css/all.min.css", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0", "https://app.ynsdty.cn/dist/js/jquery.min.js", "xfe-IP-78.142.35.163-stix2-2.1-export.json", "https://s.adroll.com/j/exp/DUKHAKVYIJASHDUBG4V7RE/index.js", "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css", "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "https://app.ynsdty.cn/dist/vendors/swiper/swiper.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "adminlte.min.js.pobrane", "saved_resource.html", "https://builder-assets.unbounce.com/published-css/main-7b78720.z.css", "UE_pl_top.svg", "jquery.notify.min.js.pobrane", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://d.adroll.com/pixel/DUKHAKVYIJASHDUBG4V7RE/E23RMKDBEFAEXMXLWK3IWO?adroll_fpc=838a57acc6141112b6107bdce5e3fde6-1650403057055&arrfrr=https%3A%2F%2Fwww.vultr.com%2F&pv=70707106758.07146&cookie=&adroll_s_ref=&keyw=", "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://www.sunnetwork.com.sg/sun_21/js/slick.min.js", "https://app.ynsdty.cn/dist/js/app.base.js", "https://www.googletagmanager.com/gtag/js?id=G-K6536FHN4D&l=dataLayer&cx=c", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650908332393", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://2001.dwlww.com/static/js/app.9d5d18d7.js", "https://vtbehaviour.commondatastorage.googleapis.com/0e93e52376dcfb8eab491737c187ad68d786fab0005bbf9d2ffab78ba19db907_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774998466&Signature=Y4QdGLgX1a6Ct5CMRDpH9RdwtjTzLLVBFFtxY64ZOhJ4cyy5f3YP7kNt%2Bu9euHjYaM5LUKHRWbswYwhD%2BbmD8KZT57GNGNGF4xYoyqPgzPY1AQodW%2BZx5f3iJqPbAZq9pUjOzXtm22B%2FEx7BVn5qcm86M9I6BaNp8%2FJW2vSfzsewT0w5WhMAjuB84fIG4LrKD2X46mnchNmREfC3GQtUPwzIIkj7IIv7xyHtwbu%2Fwyg8Ib1VFz", "CommonResponsive.js.pobrane", "https://widget-v4.tidiochat.com/code/kv6vcosd7tmhsetmarsoawzaglejnny4.js", "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js", "https://s.adroll.com/j/roundtrip.js", "xfe-URL-Dreamhost.com-stix2-2.1-export.json", "https://cp.enom.com/js/cart.minicart.min.js", "https://guidemyrelationship.com/assets/js/main.js", "https://app.ynsdty.cn//package/GmCC6WISh", "https://www.choopa.com/_js/dragscroll.js", "https://2001.dwlww.com/static/css/app.88afcfd8.css", "moment-with-locales.min.js.pobrane", "https://js.driftt.com/conductor/assets/4.fa5fc959.chunk.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-vendors.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "inputmask.binding.js.pobrane", "https://2001.habyc.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://vtbehaviour.commondatastorage.googleapis.com/0e93e52376dcfb8eab491737c187ad68d786fab0005bbf9d2ffab78ba19db907_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775001268&Signature=YBUj6DKVhfcrBcdkki8xfcRH%2F%2FP32FDK7Zizn8pLHZ3D6s3E7isdEd2LROfkC1lKu2qP4ZcDMm8av3%2BUajeevjxBnk%2FJLOrW%2Fcl%2FG1jKYFVsw9yQm7CXUYgYjHS2JPx%2B910377bbnD7%2FQjxuptI22kTDC%2FK4Kxn6e9yDWXa7P9r63qwHoncRKLSca%2FQDZtmttEQ0ZlmTWhu5tKz%2F8hSVLfvFkZpPRcKYX%2BQoYiNdQ4wAoK", "https://kit.fontawesome.com/7d998cc9b7.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://2001.dwlww.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://2001.dwlww.com/js/config.js", "maxcdn.bootstrapcdn.com:bootstrap:4.0.0:js:bootstrap.min.js%22,.pdf", "http://www.shopsegsistemas.com.br/", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "ceidg.css", "https://go.inap.com/analytics?conly=true&visitor_id=377865231&visitor_id_sign=fcd1b8a6054d2c2490cb77f4d0581558910b2792df8a7d07c6a0b0282eba2cd0db306c84706e8688a4165a4437c383a8e130703a&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "daterangepicker.js.pobrane", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/858656304/?random=1650403054497&cv=9&fst=1650403054497&num=1&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=3&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.vultr.com%2F&tiba=SSD%20VPS%20Servers%2C%20Cloud%20Servers%20and%20Cloud%20Hosting%20by%20Vultr%20-%20Vultr.com&hn=www.googleadservices.com&rfmt=3&fmt=4", "https://www.8098.app:21568/js/xinstall_inner_e.min.js?v=1004", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS", "https://sdk.51.la/js-sdk-pro.min.js", "https://4vendeta.com/assets/js/popper.min.js", "UE_pl_top_sm.svg", "https://js.driftt.com/core?embedId=2y43hyefanc8®ion=US&forceShow=false&skipCampaigns=false&sessionId=5a8c1b8d-2626-4a43-a7a6-76e9416f2f52&sessionStarted=1650943819.009&campaignRefreshToken=a2d9846a-8932-4e3c-a8d5-878681a555e0&hideController=false&pageLoadStartTime=1650943817154&mode=CHAT&driftEnableLog=false", "xfe-URL-Inap.com-stix2-2.1-export.json", "https://m4244.com:35003/", "http://www.shopsegsistemas.com.br/assets/js/main.js", "https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=28453&account_id=235392&title=Hybrid%20IT%20%26%20Enterprise%20Cloud%20Solutions%20-%20INAP&url=https%3A%2F%2Fwww.inap.com%2F&referrer=", "jquery.easing.1.3.js.pobrane", "jquery-migrate-1.2.1.js.pobrane", "https://guidemyrelationship.com/?aff_id=2509&offer_id=6300&aff_sub=1726&aff_sub2=102a78845625980c3bb3f54bd8acd3&aff_sub3=", "https://www.googletagmanager.com/gtm.js?id=GTM-NL3LLHS", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "ceidg-master.js.pobrane", "https://my.choopa.com/js/desktop.js?v=41", "https://www.google-analytics.com/gtm/optimize.js?id=GTM-PHVK7LN", "https://abuse.ch/js/twitter_widget.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://static.ads-twitter.com/uwt.js", "https://code.jquery.com/jquery-3.1.1.slim.min.js", "https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.0/js/tether.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5PBN7G", "jquery.dataTables.js.pobrane", "https://js.partnerstack.com/v1/", "https://code.jquery.com/jquery-1.12.0.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://2001.dwlww.com/static/js/chunk-vendors.9d7684f4.js", "https://s.adroll.com/j/sendrolling.js", "https://www.inap.com/inap/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://bazaar.abuse.ch/js/datatables.min.js", "https://2001.habyc.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://www.sunnetwork.com.sg/sun_21/js/isotope.pkgd.min.js", "https://2001.habyc.com/static/css/chunk-vendors.6a41b67e.css", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://www.8098.app:21568/js/jquery-1.11.3.min.js", "https://guidemyrelationship.com/assets/css/bootstrap.min.css", "ui.notify.css", "EntryChangeHistory.aspx.js.pobrane", "SessionTimeout.js.pobrane", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "CommonScripts.js.pobrane", "https://www.tidio.com/talk/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://ssl.google-analytics.com/ga.js", "https://connect.facebook.net/signals/config/438248060937995?v=2.9.57&r=stable", "json2.js.pobrane", "bootstrap-gov-pl.css", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "xfe-URL-http___psychz.net_-stix2-2.1-export.json", "https://app.ynsdty.cn/dist/vendors/core-js/core.js", "https://cp.enom.com/js/jquery-3.5.1.min.js", "xfe-URL-1api.net-stix2-2.1-export.json", "https://app.ynsdty.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "jquery.maskedinput-1.2.2.js.pobrane", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://cp.enom.com/responsive/_js/bootstrap.js", "biznes.css", "xfe-URL-Enom.com-stix2-2.1-export.json", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://www.dreamhost.com/assets/scripts/bootstrap-7670fc8587f9fd0608d2af67f392281a9a4fbf4cb4252952ecb8d34f6ee286b3.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1046749228/?random=1650700509087&cv=9&fst=1650700509087&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4k0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.psychz.net%2F&tiba=DDoS%20Protected%20Data%20Centers%20In%20America%2C%20Europe%2C%20Africa%2C%20Asia&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "xfe-URL-Jquery.com-stix2-2.1-export.json", "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "xfe-URL-sys95.com-stix2-2.1-export.json", "https://1api.net/css/bootstrap.min.css", "jquery.alerts.js.pobrane", "jquery.inputmask.min.js.pobrane", "popper.js.pobrane", "https://www.google-analytics.com/plugins/ua/linkid.js", "https://www.thepartnerlookup.com/?affid=1726&txid=1028d018569e59e3856f7416969ab0&offer_id=2509", "dataTables.bootstrap4.css", "https://www.sunnetwork.com.sg/sun_21/js/ajax-form.js", "daterangepicker.css", "https://www.dreamhost.com/assets/scripts/webp-support-1dd791309dc3fa5b166a0a326e49345fe5acb5acbc1831f4c7be87efce1abf51.js", "jquery-3.0.0.js.pobrane", "https://my.choopa.com/js/global.js?v=41", "https://app.ynsdty.cn/dist/js/jquery.cookie.js", "https://cp.enom.com/js/punycode.min.js", "https://ajax.googleapis.com/ajax/libs/webfont/1/webfont.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://abuse.ch/js/bootstrap.min.js", "https://2001.habyc.com/?channelNo=2001#/home", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://www.sunnetwork.com.sg/sun_21/js/bootstrap.min.js", "https://js.driftt.com/include/1650908400000/puh6a6h2pc6k.js", "https://www.inap.com/inap/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=3.2.4", "https://cdn.jsdelivr.net/emojione/2.2.7/lib/js/emojione.min.js", "https://www.choopa.com/_js/global.js?v=209", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/scripts/Session.min.js", "xfe-URL-habyc.com-stix2-2.1-export.json", "https://guidemyrelationship.com/assets/js/bootstrap.min.js", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://connect.facebook.net/en_US/fbevents.js", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://www.psychz.net/assets/js/bootstrap.min.js", "https://js.driftt.com/core?embedId=puh6a6h2pc6k®ion=US&forceShow=false&skipCampaigns=false&sessionId=34bf8b51-4431-413e-ac31-6833e0d5600c&sessionStarted=1650908334.439&campaignRefreshToken=6e5a949b-b933-4b76-8614-902cd18d34a6&hideController=false&pageLoadStartTime=1650908332393&mode=CHAT&driftEnableLog=false", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://8794842.fls.doubleclick.net/activityi;src=8794842;type=front;cat=newun0;ord=1047846285161;gtm=2wg4k0;auiddc=1226623845.1650908333;~oref=https%3A%2F%2Fwww.inap.com%2F", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://www.choopa.com/css/bootstrap.css", "xfe-URL-2001.habyc.com-stix2-2.1-export.json", "dataTables.input.js.pobrane", "https://4vendeta.com/assets/js/jquery.min.js", "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr", "https://connect.facebook.net/signals/config/571256413046247?v=2.9.57&r=stable", "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i", "ScriptResource.axd", "https://cp.enom.com/js/openWin.min.js", "https://www.sunnetwork.com.sg/sun_21/js/popper.min.js", "xfe-URL-https___www.reliablesite.net_-stix2-2.1-export.json", "https://js.driftt.com/include/1650944100000/2y43hyefanc8.js", "https://my.choopa.com/js/jquery-3.5.1.min.js", "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js", "dataTables.responsive.js.pobrane", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://chatting.page/kv6vcosd7tmhsetmarsoawzaglejnny4", "XZ4AH-ABKPW-SQPBC-CYWES-BCG6V", "dataTables.lang.js.pobrane", "feedback.js.pobrane", "ui.datepicker-pl.js.pobrane", "https://1api.net/js/bootstrap.min.js", "https://www.8098.app:21568/?agent=7691755704", "AdminLTE.css", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742", "https://sdk.51.la/event/js-sdk-event.min.js?u=JdoUNv3VSW0GHUpw", "https://www.thepartnerlookup.com/main.bundle-fed11df.z.js", "https://2001.dwlww.com/static/css/chunk-7d5d3bac.e1a32335.css", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "https://www.sunnetwork.com.sg/sun_21/js/main.js", "https://2001.habyc.com/js/config.js", "https://www.googletagmanager.com/gtm.js?id=GTM-TLN654", "jquery.cookie.js.pobrane", "dataTables.bootstrap4.js.pobrane", "https://2001.dwlww.com/static/css/chunk-vendors.6a41b67e.css", "https://2001.habyc.com/static/js/chunk-vendors.9d7684f4.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js", "jquery-ui.js.pobrane", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://www.google-analytics.com/analytics.js", "https://www.dreamhost.com/assets/site-75a1aba399db4de4e4093997b8fc8ff8ec5e65b5f4258c9a658a5cacacbf6e0d.js", "https://www.choopa.com/_js/bootstrap.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-main.js", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "xfe-IP-50.116.87.164-stix2-2.0-export.json", "https://www.dreamhost.com/assets/bootstrap-aa47564acfdf18ce859b8e1fd130d889920ae66415b3db4de8505d42a0477b09.css", "https://abuse.ch/js/google-charts.js", "https://guidemyrelationship.com/assets/js/jquery-3.3.1.min.js", "https://cdn.abrankings.com/js/client.js", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://2001.dwlww.com/?channelNo=2001#/home", "https://bat.bing.com/p/action/17528422.js", "https://cp.enom.com/global/TopMenu.ascx.js", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://www.choopa.com/css/global.css?v=209", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650943817154", "responsive.bootstrap4.js.pobrane", "https://2001.habyc.com/static/css/app.88afcfd8.css", "https://www.sunnetwork.com.sg/sun_21/js/vendor/jquery-3.5.0.min.js", "https://www.redditstatic.com/ads/pixel.js", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%", "https://www.googletagmanager.com/gtag/js?id=G-1F7WLMM0K2&l=dataLayer&cx=c", "responsive.bootstrap4.css", "bootstrap.js.pobrane", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-vendor.js", "https://connect.facebook.net/signals/config/828098694004178?v=2.9.57&r=stable", "https://www.googletagmanager.com/gtm.js?id=GTM-KPQ5FFK", "jquery.feedbackBadge.min.js.pobrane", "xfe-URL-Choopa.com-stix2-2.1-export.json" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Hj", "Gc", "Reduceright", "Vd", "Quando" ], "industries": [], "unique_indicators": 68611 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/github.com", "whois": "http://whois.domaintools.com/github.com", "domain": "github.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 47, "pulses": [ { "id": "69d4f2dd828bbf0ac5efaa23", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:44.957000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4f2db0b3448671adcce16", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:43.156000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4f2d9ce86a445b484593b", "name": "VirusTotal report\n for sample.crx", "description": "A small sample of malware has been identified by researchers at the University of Oregon in the US, and the results are published on the web, as well as on Google's Chrome extension and other sites.", "modified": "2026-05-07T12:05:50.774000", "created": "2026-04-07T12:04:41.097000", "tags": [ "file type", "json", "ascii text", "png image", "crlf line", "ascii", "rgba", "unicode text", "utf8 text", "defense evasion", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 668, "FileHash-MD5": 668, "FileHash-SHA1": 675, "URL": 153, "domain": 230, "hostname": 177, "email": 2 }, "indicator_count": 2573, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "24 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d46ee1379578309fae9a4a", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:37.877000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 110, "hostname": 45, "domain": 179 }, "indicator_count": 1777, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d46ee073b843b1b52f59a2", "name": "VirusTotal report\n for l-Management-System-School-ERP-nulled-by-CodeAlright.Com.zip", "description": "A look at the results of a report generated by the University of California, Los Angeles (UCLA) and compiled by codecanyon, a university-instikit and an academy.", "modified": "2026-05-07T02:13:20.636000", "created": "2026-04-07T02:41:36.582000", "tags": [ "file type", "unix", "mitre attack", "network info", "wed jun", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "persistence", "malicious", "next", "newstoday2", "ip address", "virustotal box", "apples sandbox", "sandbox sha256", "analysis date", "screnshots", "file", "operations", "process open", "python", "javascript", "html", "sample", "test", "urls", "united", "extra info", "uncomment", "performs dns", "layer protocol", "attack network", "info dropped", "info processes", "info", "may try", "ascii text", "png image", "https", "reads cpu", "tls version", "ascii", "usrliblog" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/01f57cc95906a44558c5c1f19ef3191fe6f2f1cc03e1d10d1da421b7c604903f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529261&Signature=RJNKrp%2FaK0APCyfk557hpXXr%2BMWPGME1nJO1%2BQCUEm9xRuKB0DlxP%2BfDSiZsLcJsAhaI%2FWxbH%2F%2FdbHllDXKgjJl92HzsTFyTAT0eMx%2BzlFLXKn0VyBmCHKLgKoFS4fDODUKy6SKJxdUav7aDP1aVhAXMPp%2BT3yWjDdSos0HQalqAt%2FcsVg1w28zfPjvVVGv%2B%2FvJeCIgzhXeE2pX6Npumx67Yym8jiiqV75WoDu", "https://vtbehaviour.commondatastorage.googleapis.com/00913627185b352deaf0ec837f85a7f606b27112956875de5d610fba8151306c_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529477&Signature=s8ZCWLcVqjdBgBGejTcqippuMvftwgsdUQHUAjBnm45yUvqDsHIMIA29%2BJcb%2BrruXxHPD5tQv1BwAzlV1o7EuhxX4qMqDcFWSLqoc%2FqAnEVxLg0zXohtwMkHxv0z%2Bp5AL0jLyAwNYz7bH56tnmUs3tHPYc48OeM4AanV030U%2FnmXlF8kJ6cjAemipfTNe1QRx3ecbONm9c3B51FK0BbzZEdRX0pTHIM4AK1M", "https://vtbehaviour.commondatastorage.googleapis.com/0347ed7ffd09f6728c494128b1d11792893d5cde9e4effdc2bcc8f9ebb12a0e1_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529533&Signature=diQ6r2CuvkDxYGybQtlzxVxtH8iGMt6XlgZBEpk7B5n%2FVtwOuZaPpuNyM%2Fr4VbSp2H67%2FddXTZ3XJG8LdUMwLVXsSDKIq%2BjyQHccTuCS0HXEDbllONqfU6gWICxxtdC%2F4wdaL8fVyCE%2FHHcnWm5PufAa002Tn02MbSx9cFdNZS4R86MEMARaMiXSCiGQuiLR2STQCGqU%2Byg16ky%2FYjPbLtB6WD5skgEs3AgDmDNlDLjtbb", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20macOS.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529640&Signature=G0ONarqL7o1MkYvMlqktPKmEpNw5A3hwHYnIBwD8r%2F0xQfBDCaCPoL6%2BMxjj5Ftsb47O6KGvZzp2CS1xFcRHfbhEnUGRJR9o2%2FjSPy6NAV226GNwtSGdDXxPJFfETfpFlDEj%2FOCd26qtcBDdT4lX2saiGfx0%2FunV94XcNq3cUTVm%2Fsf0BO74945PnFWtBu3Oq%2FBm9AlaLwnyEZ5TDLfhXyqiTv1Qsx%2FWmBk0PIieA9MtTm", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529701&Signature=BDpq68evTIZGfF61fRMAYEM%2BQtXgDfwPgp7qnaSE1mJStRV1ikHnSjRDxrMwGqkg0kaXqLEpQ%2BLuSCdJ9wJJzfrkQuV1%2Bbcg0cctnCOLgWhiXjekyol4iul%2FPXEGu6%2F1a20JEEoUfg9Dq6%2FosKMN9fmk%2BtqQcFa6PODcE3qJcO23YhWwDpmSYZ7t8JNsALFm98c6r%2BfBLLjnCSpVql2zQJifkl%2BteR57LTZG7W2lbENV", "https://vtbehaviour.commondatastorage.googleapis.com/00695c0012a8ebc08469eb0d32d3974ae70e93d129015dbfe6da128556ab3726_VirusTotal%20Box%20of%20Apples.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775529758&Signature=zXDmSolL1BXRVntoMjKFPJaZtQ0tI1lf56M%2BqCFh1c0JirSCS7DGBgxMdHuaZG8hsB%2FV1nO0JEfDegHE1Ibm55QO9TriIg9yCH6dZSsofTmiHiBOUZtTMSH1Pg1z%2FnuElFFvVDHQ2Ryhog0fw%2BwfS0Fpe5ZOoTF8KK883iH45dmOAcVEphu7K5A%2FrzfFG93bFibxA7MRKbLLGBbrIVz4yFSuuFHimac0dVn%" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1222", "name": "File and Directory Permissions Modification", "display_name": "T1222 - File and Directory Permissions Modification" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 158, "FileHash-SHA1": 158, "FileHash-SHA256": 1127, "URL": 116, "hostname": 49, "domain": 182, "email": 1 }, "indicator_count": 1791, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4569dc87656b4a255a124", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:05.842000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 281, "FileHash-SHA1": 277, "FileHash-SHA256": 2208, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3123, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4569a944adf94a75efcf9", "name": "VirusTotal report\n for download.rar", "description": "0347ed7f6728c494128d5cde9e4effdc2bcc8f944d78bca8d, as well as 1.3m2.", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:58:02.158000", "tags": [ "json text", "json" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 287, "FileHash-SHA1": 283, "FileHash-SHA256": 2301, "URL": 113, "domain": 169, "hostname": 75 }, "indicator_count": 3228, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4510870e9906d58e7a554", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:16.928000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d45107d82d67453e8ade06", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:15.789000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69d4510678007ab57751a513", "name": "CAPE Sandbox -y2k", "description": "> full text of the full report on this year's EU Referendum, which will take place on 26 May 2017, has been published by BBC Radio 5 live in the UK and Ireland.>y2k status", "modified": "2026-05-07T00:00:42.275000", "created": "2026-04-07T00:34:14.009000", "tags": [ "html document", "ascii text", "language" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 310, "FileHash-SHA1": 308, "FileHash-SHA256": 1270, "domain": 168, "hostname": 31, "URL": 98 }, "indicator_count": 2185, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://github.com/twbs/bootstrap/graphs/contributors", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://github.com/twbs/bootstrap/graphs/contributors", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780289937.2634883 }