{
  "type": "URL",
  "indicator": "https://gqe.prototype.ma",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://gqe.prototype.ma",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3885097326,
      "indicator": "https://gqe.prototype.ma",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "697cdce9ec418c422eee2054",
          "name": "Device Isolation: Lumen Technologies | Palantir and \u2018Boots on the Ground Operations\u2019",
          "description": "Device Isolation: Lumen Technologies (formerly CenturyLink) deployed as an admin on iOS devices. Standard factory resets may prove ineffective. Complete hardware \"air-gap\" or clean devices that have never touched your home network may be best option for deeply monitored targets.\n\nSummary of the Campaign:\nThe involvement of Lumen Technologies (as an unwanted admin), Foundry (Palantir) for data mapping, and Mirai Botnet for network disruption represents a \"scorched earth\" approach to digital destruction. Target treated  as a criminal through Cellebrite, implicates specific attackers attempted to legalize what was actually a predatory stalking campaign/s.\n\n\nSurveillance Overlap: The use of  Lumen Technologies and Palantir, tools allows for real-time tracking of a target's physical location\u2014explains how \u2018boots on the ground\u2019 offenders can stalk , surveillance , confront, assault  and engage in various damaging attacks of specific monitored targets.",
          "modified": "2026-03-01T16:05:57.375000",
          "created": "2026-01-30T16:31:37.011000",
          "tags": [
            "url https",
            "url http",
            "tlsv1",
            "whitelisted",
            "united",
            "read c",
            "as15169",
            "stcalifornia",
            "execution",
            "dock",
            "write",
            "persistence",
            "malware",
            "encrypt",
            "active",
            "lumen technologies",
            "number",
            "error",
            "regexp",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "unknown",
            "form",
            "flash",
            "backdoor",
            "writeconsolew",
            "yara detections",
            "command line",
            "pdb path",
            "pe resource",
            "internalname",
            "windows command",
            "A",
            "aws",
            "name servers",
            "url analysis",
            "passive dns",
            "urls",
            "data upload",
            "extraction",
            "palantir",
            "c2",
            "aerospace",
            "tracking",
            "spywatchdog",
            "palapa-c2",
            "communications satellite",
            "amazon",
            "hughesnet",
            "icmp traffic",
            "washington c",
            "washington ou",
            "mopr",
            "mon jul",
            "local",
            "dynamic",
            "apple",
            "network",
            "t1057",
            "discovery",
            "t1069",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1566",
            "present jan",
            "unknown ns",
            "ip address",
            "dnssec",
            "domain",
            "dynamic dns",
            "government",
            "pcup",
            "germany unknown",
            "link",
            "dns hosting",
            "cloudns",
            "cloud dns",
            "a domains",
            "ipv4 add",
            "title",
            "meta",
            "class",
            "servers",
            "present aug",
            "aaaa",
            "present sep",
            "present nov",
            "present jul",
            "present may",
            "moved",
            "canada unknown",
            "begin",
            "record value",
            "gmt content",
            "type",
            "hostname add",
            "files",
            "ascii text",
            "pattern match",
            "href",
            "mitre att",
            "ck id",
            "ck matrix",
            "network traffic",
            "et info",
            "general",
            "path",
            "click",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "input url",
            "defense evasion",
            "france",
            "ireland",
            "netherlands",
            "denmark",
            "united kingdom",
            "type indicator",
            "role title",
            "added active",
            "savvis",
            "centurylinktechnology",
            "hybrid analysis",
            "monitoring tools",
            "monitored target",
            "triangulation",
            "worm",
            "intel",
            "ms windows",
            "pe32",
            "write c",
            "delete c",
            "show",
            "russia as47764",
            "unix",
            "lsan jose",
            "odigicert inc",
            "markus",
            "url add",
            "http",
            "related nids",
            "files location",
            "russia flag",
            "russia hostname",
            "russia",
            "russia unknown",
            "hosting",
            "federation flag",
            "body",
            "gmt vary",
            "accept encoding",
            "gmt cache",
            "certificate",
            "pulse submit",
            "unknown aaaa",
            "search",
            "entries",
            "script domains",
            "script urls",
            "pdx cf"
          ],
          "references": [
            "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
            "Yare: compromised_site_redirector_fromcharcode",
            "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
            "Alerts: console_output has_pdb pe_unknown_resource_name",
            "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
            "Tipped: A targets AI and other cyber research findings.",
            "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
            "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
            "https://palapa.c.id\t (c.id)",
            "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
            "cedevice.io  \u2022 decagonsoftware.com",
            "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
            "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
            "pcup.gov.ph:",
            "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
            "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
            "https://elegantcosmedampyeah.pages.dev/",
            "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
            "inst.govelopscold.com",
            "https://feedback.ptv.vic.gov.au/360",
            "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
            "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
            "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
            "https://brand.centurylinktechnology.com",
            "https://prod.centurylinktechnology.com",
            "https://brand2.centurylinktechnology.com",
            "https://mobile-pocket-guide.centurylinktechnology.com",
            "UPX_OEP_place",
            "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
            "ASP. NET",
            "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
            "7box.vip"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan.Tofsee/Botx",
              "display_name": "Trojan.Tofsee/Botx",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "PWS:Win32/Axespec.A",
              "display_name": "PWS:Win32/Axespec.A",
              "target": "/malware/PWS:Win32/Axespec.A"
            },
            {
              "id": "Worm:Win32/Lightmoon.H",
              "display_name": "Worm:Win32/Lightmoon.H",
              "target": "/malware/Worm:Win32/Lightmoon.H"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1439",
              "name": "Eavesdrop on Insecure Network Communication",
              "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1069.003",
              "name": "Cloud Groups",
              "display_name": "T1069.003 - Cloud Groups"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 102,
            "FileHash-SHA1": 59,
            "FileHash-SHA256": 1929,
            "domain": 854,
            "hostname": 2156,
            "URL": 4475,
            "SSLCertFingerprint": 9,
            "email": 7,
            "CVE": 1
          },
          "indicator_count": 9592,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "49 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6892e73b32af18aa302df0dc",
          "name": "Part 1.5",
          "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
          "modified": "2025-09-05T04:03:06.929000",
          "created": "2025-08-06T05:25:15.369000",
          "tags": [
            "chromeua",
            "optout",
            "object",
            "path",
            "value",
            "access type",
            "setval",
            "windir",
            "localappdata",
            "null",
            "win64",
            "error",
            "generator",
            "close",
            "roboto",
            "date",
            "format",
            "light",
            "span",
            "template",
            "void",
            "android",
            "body",
            "trident",
            "mexico",
            "sonic",
            "black",
            "critical",
            "desktop",
            "dark",
            "meta",
            "this",
            "june",
            "hybrid",
            "apache",
            "write",
            "crypto",
            "autodetect",
            "face",
            "courier",
            "gigi",
            "impact",
            "shadow",
            "click",
            "strings",
            "cray",
            "smwg",
            "eret",
            "footer",
            "infinity",
            "window",
            "canvas",
            "legend",
            "nuke",
            "lion",
            "4629",
            "ahav",
            "olsa",
            "false",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "script",
            "mitre att",
            "pattern match",
            "show technique",
            "iframe",
            "refresh",
            "august",
            "general",
            "local",
            "tools",
            "demo",
            "look",
            "verify",
            "restart",
            "url http",
            "small",
            "pulses url",
            "tellyoun",
            "showing",
            "entries",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "cc08",
            "f06a6b",
            "sfurl",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "pulses",
            "filehashsha1",
            "adversaries",
            "found",
            "webp image",
            "ascii text",
            "riff",
            "size",
            "encrypt",
            "legacy",
            "filehashmd5",
            "united",
            "flag",
            "server",
            "markmonitor",
            "name server",
            "llc name",
            "overview dns",
            "requests domain",
            "country",
            "win32",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "yara",
            "detections",
            "malware",
            "copy",
            "show",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pdb path",
            "pe resource",
            "extraction",
            "data upload",
            "enter sc",
            "type",
            "extra data",
            "please",
            "failed",
            "review",
            "exclude data",
            "included review",
            "ic data",
            "suggeste",
            "stop",
            "type onow",
            "domain",
            "passive dns",
            "urls",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "safe browsing",
            "sc data",
            "extr amanuav",
            "review included",
            "manualy",
            "sugges excluded",
            "filehash",
            "md5 add",
            "pulse pulses",
            "url add",
            "http",
            "hostname",
            "files domain",
            "pulses otx",
            "virustotal",
            "hsmi192547107",
            "pulses hostname",
            "r dec",
            "customer dec",
            "iski dec",
            "decision dec",
            "va dec",
            "bitcoin",
            "bitcoin dec",
            "petra",
            "torstatus dec",
            "paul dec",
            "sodesc",
            "planet dec",
            "emilia",
            "heroin dec",
            "difference dec",
            "palantir dec",
            "loraxlive dec",
            "chaturbate dec",
            "sandra",
            "free dec",
            "marvel dec",
            "benjis dec",
            "fresh dec",
            "sodesc dec",
            "srdirport",
            "srhostname",
            "link dec",
            "types of",
            "italy",
            "china",
            "australia",
            "france",
            "turkey",
            "discovery",
            "information",
            "ck ids",
            "t1005",
            "local system",
            "t1007",
            "system service",
            "part",
            "track",
            "locate",
            "political",
            "civil society",
            "news",
            "created",
            "hours ago",
            "report spam",
            "t1555",
            "password",
            "t1560",
            "collected data",
            "t1573",
            "channel",
            "t1574",
            "execution flow",
            "scan",
            "iocs",
            "t1497",
            "u0lhmq",
            "mtawmq",
            "t1480",
            "guardrails",
            "t1486",
            "data encrypted",
            "learn more",
            "unsubscribe aug",
            "protocol",
            "t1074",
            "staged",
            "t1083",
            "t1102",
            "web service",
            "t1105",
            "tool transfer",
            "t1140",
            "data engineer",
            "candidate",
            "tlsv1",
            "odigicert inc",
            "stcalifornia",
            "lsan jose",
            "oadobe systems",
            "incorporated",
            "cndigicert sha2",
            "push",
            "next",
            "high",
            "write c",
            "ireland as16509",
            "delete",
            "dirty",
            "tags",
            "t1012",
            "flow endpoint",
            "security scan",
            "t1106",
            "copyright",
            "levelblue"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 608,
            "FileHash-SHA1": 433,
            "FileHash-SHA256": 3663,
            "URL": 17104,
            "domain": 1316,
            "email": 39,
            "hostname": 4208,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 27388,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "663d2869e0f3a42bbddc42ff",
          "name": "UPX executable packer.",
          "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
          "modified": "2024-10-14T00:01:17.069000",
          "created": "2024-05-09T19:47:53.786000",
          "tags": [
            "cioch adrian",
            "centrum usug",
            "sieciowych",
            "elf binary",
            "upx compression",
            "roth",
            "nextron",
            "info",
            "javascript",
            "html",
            "office open",
            "xml document",
            "network capture",
            "win32 exe",
            "xml pakietu",
            "pdf zestawy",
            "przechwytywanie",
            "office",
            "filehashsha1",
            "url https",
            "cve cve20201070",
            "cve cve20203153",
            "cve cve20201048",
            "cve cve20211732",
            "cve20201048 apr",
            "filehashmd5",
            "cve cve20010901",
            "cve cve20021841",
            "cve20153202 apr",
            "cve cve20160728",
            "cve cve20161807",
            "cve cve20175123",
            "cve20185407 apr",
            "cve cve20054605",
            "cve cve20060745",
            "cve cve20070452",
            "cve cve20070453",
            "cve cve20070454",
            "cve cve20071355",
            "cve cve20071358",
            "cve cve20071871",
            "cve20149614 apr",
            "cve cve20151503",
            "cve cve20152080",
            "cve cve20157377",
            "cve cve20170131",
            "cve20200796 may",
            "cve cve20113403"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6861,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5771,
            "domain": 3139,
            "URL": 14525,
            "FileHash-SHA1": 2610,
            "IPv4": 108,
            "CIDR": 40,
            "FileHash-SHA256": 10705,
            "FileHash-MD5": 3373,
            "YARA": 2,
            "CVE": 148,
            "Mutex": 7,
            "FilePath": 3,
            "SSLCertFingerprint": 3,
            "email": 23,
            "JA3": 1,
            "IPv6": 2
          },
          "indicator_count": 40460,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "553 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
        "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
        "https://feedback.ptv.vic.gov.au/360",
        "pcup.gov.ph:",
        "ASP. NET",
        "https://palapa.c.id\t (c.id)",
        "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
        "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
        "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
        "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
        "cedevice.io  \u2022 decagonsoftware.com",
        "UPX_OEP_place",
        "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
        "https://brand.centurylinktechnology.com",
        "https://elegantcosmedampyeah.pages.dev/",
        "https://prod.centurylinktechnology.com",
        "Yare: compromised_site_redirector_fromcharcode",
        "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
        "7box.vip",
        "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
        "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
        "inst.govelopscold.com",
        "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
        "Alerts: console_output has_pdb pe_unknown_resource_name",
        "Tipped: A targets AI and other cyber research findings.",
        "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
        "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
        "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
        "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
        "https://mobile-pocket-guide.centurylinktechnology.com",
        "https://brand2.centurylinktechnology.com",
        "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Worm:win32/lightmoon.h",
            "Alf:jasyp:trojan:win32/ircbot!atmn",
            "Pws:win32/axespec.a",
            "Trojan.tofsee/botx"
          ],
          "industries": [],
          "unique_indicators": 65097
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/prototype.ma",
    "whois": "http://whois.domaintools.com/prototype.ma",
    "domain": "prototype.ma",
    "hostname": "gqe.prototype.ma"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "697cdce9ec418c422eee2054",
      "name": "Device Isolation: Lumen Technologies | Palantir and \u2018Boots on the Ground Operations\u2019",
      "description": "Device Isolation: Lumen Technologies (formerly CenturyLink) deployed as an admin on iOS devices. Standard factory resets may prove ineffective. Complete hardware \"air-gap\" or clean devices that have never touched your home network may be best option for deeply monitored targets.\n\nSummary of the Campaign:\nThe involvement of Lumen Technologies (as an unwanted admin), Foundry (Palantir) for data mapping, and Mirai Botnet for network disruption represents a \"scorched earth\" approach to digital destruction. Target treated  as a criminal through Cellebrite, implicates specific attackers attempted to legalize what was actually a predatory stalking campaign/s.\n\n\nSurveillance Overlap: The use of  Lumen Technologies and Palantir, tools allows for real-time tracking of a target's physical location\u2014explains how \u2018boots on the ground\u2019 offenders can stalk , surveillance , confront, assault  and engage in various damaging attacks of specific monitored targets.",
      "modified": "2026-03-01T16:05:57.375000",
      "created": "2026-01-30T16:31:37.011000",
      "tags": [
        "url https",
        "url http",
        "tlsv1",
        "whitelisted",
        "united",
        "read c",
        "as15169",
        "stcalifornia",
        "execution",
        "dock",
        "write",
        "persistence",
        "malware",
        "encrypt",
        "active",
        "lumen technologies",
        "number",
        "error",
        "regexp",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "unknown",
        "form",
        "flash",
        "backdoor",
        "writeconsolew",
        "yara detections",
        "command line",
        "pdb path",
        "pe resource",
        "internalname",
        "windows command",
        "A",
        "aws",
        "name servers",
        "url analysis",
        "passive dns",
        "urls",
        "data upload",
        "extraction",
        "palantir",
        "c2",
        "aerospace",
        "tracking",
        "spywatchdog",
        "palapa-c2",
        "communications satellite",
        "amazon",
        "hughesnet",
        "icmp traffic",
        "washington c",
        "washington ou",
        "mopr",
        "mon jul",
        "local",
        "dynamic",
        "apple",
        "network",
        "t1057",
        "discovery",
        "t1069",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1566",
        "present jan",
        "unknown ns",
        "ip address",
        "dnssec",
        "domain",
        "dynamic dns",
        "government",
        "pcup",
        "germany unknown",
        "link",
        "dns hosting",
        "cloudns",
        "cloud dns",
        "a domains",
        "ipv4 add",
        "title",
        "meta",
        "class",
        "servers",
        "present aug",
        "aaaa",
        "present sep",
        "present nov",
        "present jul",
        "present may",
        "moved",
        "canada unknown",
        "begin",
        "record value",
        "gmt content",
        "type",
        "hostname add",
        "files",
        "ascii text",
        "pattern match",
        "href",
        "mitre att",
        "ck id",
        "ck matrix",
        "network traffic",
        "et info",
        "general",
        "path",
        "click",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "input url",
        "defense evasion",
        "france",
        "ireland",
        "netherlands",
        "denmark",
        "united kingdom",
        "type indicator",
        "role title",
        "added active",
        "savvis",
        "centurylinktechnology",
        "hybrid analysis",
        "monitoring tools",
        "monitored target",
        "triangulation",
        "worm",
        "intel",
        "ms windows",
        "pe32",
        "write c",
        "delete c",
        "show",
        "russia as47764",
        "unix",
        "lsan jose",
        "odigicert inc",
        "markus",
        "url add",
        "http",
        "related nids",
        "files location",
        "russia flag",
        "russia hostname",
        "russia",
        "russia unknown",
        "hosting",
        "federation flag",
        "body",
        "gmt vary",
        "accept encoding",
        "gmt cache",
        "certificate",
        "pulse submit",
        "unknown aaaa",
        "search",
        "entries",
        "script domains",
        "script urls",
        "pdx cf"
      ],
      "references": [
        "\u2018Lumen Technologies\u2019 Acting as administrator of a targeted Apple IOS device",
        "Yare: compromised_site_redirector_fromcharcode",
        "Alerts: network_icmp nolookup_communication js_eval recon_fingerprint",
        "Alerts: console_output has_pdb pe_unknown_resource_name",
        "File Type PEXE - PE32+ executable (console) x86-64, for MS Windows ..",
        "Tipped: A targets AI and other cyber research findings.",
        "A \u2018Target\u2019 became a \u2018Target\u2019 vja close association to main Target of predatory retaliation campaign.",
        "track.spywarewatchdog.org \u2022  https://track.spywarewatchdog.org - monitoring software",
        "https://palapa.c.id\t (c.id)",
        "Containers-Pecorino.PalantirGov.com -pecorino.palantirgov.com",
        "cedevice.io  \u2022 decagonsoftware.com",
        "http://applevless.dns-dynamic.net/\t\u2022 dns-dynamic.net",
        "http://www.pcup.gov.ph/images/2018/pdf/ComEnBancReso/Commission_Resolution_07s2018.PDF",
        "pcup.gov.ph:",
        "http://www.pcup.gov.ph/images/pdf/Contract_of_SecurityServices2013.pdf pcup.gov.ph:",
        "https://pcup.gov.ph/375 pcup.gov.ph: | https://www.pcup.gov.ph/ pcup.gov.ph:",
        "https://elegantcosmedampyeah.pages.dev/",
        "https://www.ptv.vic.gov.au/more/travelling-on-the-network/lets-go/",
        "inst.govelopscold.com",
        "https://feedback.ptv.vic.gov.au/360",
        "nginx-php.7d4jelnf.trdlpbvl.sdp3.sdp.vic.gov.au",
        "nginx-php.standby.content-premier-vic-gov-au.sdp3.sdp.vic.gov.au",
        "https://hybrid-analysis.com/sample/a16d11910953b800369dbb667f178b3cc45cb8e3315217c0e6ceac68eeba206d",
        "https://brand.centurylinktechnology.com",
        "https://prod.centurylinktechnology.com",
        "https://brand2.centurylinktechnology.com",
        "https://mobile-pocket-guide.centurylinktechnology.com",
        "UPX_OEP_place",
        "Russia or Muskware? URL http://store.7box.vip/ad/C467F60A1AD6.Jpeg",
        "ASP. NET",
        "https://connect.facebook.net/en_US/sdk.js#xfbml=1&version=v4.0&appId=705930270206797&autoLogAppEvents=1 Akamai rank:",
        "7box.vip"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan.Tofsee/Botx",
          "display_name": "Trojan.Tofsee/Botx",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "PWS:Win32/Axespec.A",
          "display_name": "PWS:Win32/Axespec.A",
          "target": "/malware/PWS:Win32/Axespec.A"
        },
        {
          "id": "Worm:Win32/Lightmoon.H",
          "display_name": "Worm:Win32/Lightmoon.H",
          "target": "/malware/Worm:Win32/Lightmoon.H"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1439",
          "name": "Eavesdrop on Insecure Network Communication",
          "display_name": "T1439 - Eavesdrop on Insecure Network Communication"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1069.003",
          "name": "Cloud Groups",
          "display_name": "T1069.003 - Cloud Groups"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 102,
        "FileHash-SHA1": 59,
        "FileHash-SHA256": 1929,
        "domain": 854,
        "hostname": 2156,
        "URL": 4475,
        "SSLCertFingerprint": 9,
        "email": 7,
        "CVE": 1
      },
      "indicator_count": 9592,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "49 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6892e73b32af18aa302df0dc",
      "name": "Part 1.5",
      "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
      "modified": "2025-09-05T04:03:06.929000",
      "created": "2025-08-06T05:25:15.369000",
      "tags": [
        "chromeua",
        "optout",
        "object",
        "path",
        "value",
        "access type",
        "setval",
        "windir",
        "localappdata",
        "null",
        "win64",
        "error",
        "generator",
        "close",
        "roboto",
        "date",
        "format",
        "light",
        "span",
        "template",
        "void",
        "android",
        "body",
        "trident",
        "mexico",
        "sonic",
        "black",
        "critical",
        "desktop",
        "dark",
        "meta",
        "this",
        "june",
        "hybrid",
        "apache",
        "write",
        "crypto",
        "autodetect",
        "face",
        "courier",
        "gigi",
        "impact",
        "shadow",
        "click",
        "strings",
        "cray",
        "smwg",
        "eret",
        "footer",
        "infinity",
        "window",
        "canvas",
        "legend",
        "nuke",
        "lion",
        "4629",
        "ahav",
        "olsa",
        "false",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "script",
        "mitre att",
        "pattern match",
        "show technique",
        "iframe",
        "refresh",
        "august",
        "general",
        "local",
        "tools",
        "demo",
        "look",
        "verify",
        "restart",
        "url http",
        "small",
        "pulses url",
        "tellyoun",
        "showing",
        "entries",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "cc08",
        "f06a6b",
        "sfurl",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "pulses",
        "filehashsha1",
        "adversaries",
        "found",
        "webp image",
        "ascii text",
        "riff",
        "size",
        "encrypt",
        "legacy",
        "filehashmd5",
        "united",
        "flag",
        "server",
        "markmonitor",
        "name server",
        "llc name",
        "overview dns",
        "requests domain",
        "country",
        "win32",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "yara",
        "detections",
        "malware",
        "copy",
        "show",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pdb path",
        "pe resource",
        "extraction",
        "data upload",
        "enter sc",
        "type",
        "extra data",
        "please",
        "failed",
        "review",
        "exclude data",
        "included review",
        "ic data",
        "suggeste",
        "stop",
        "type onow",
        "domain",
        "passive dns",
        "urls",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "safe browsing",
        "sc data",
        "extr amanuav",
        "review included",
        "manualy",
        "sugges excluded",
        "filehash",
        "md5 add",
        "pulse pulses",
        "url add",
        "http",
        "hostname",
        "files domain",
        "pulses otx",
        "virustotal",
        "hsmi192547107",
        "pulses hostname",
        "r dec",
        "customer dec",
        "iski dec",
        "decision dec",
        "va dec",
        "bitcoin",
        "bitcoin dec",
        "petra",
        "torstatus dec",
        "paul dec",
        "sodesc",
        "planet dec",
        "emilia",
        "heroin dec",
        "difference dec",
        "palantir dec",
        "loraxlive dec",
        "chaturbate dec",
        "sandra",
        "free dec",
        "marvel dec",
        "benjis dec",
        "fresh dec",
        "sodesc dec",
        "srdirport",
        "srhostname",
        "link dec",
        "types of",
        "italy",
        "china",
        "australia",
        "france",
        "turkey",
        "discovery",
        "information",
        "ck ids",
        "t1005",
        "local system",
        "t1007",
        "system service",
        "part",
        "track",
        "locate",
        "political",
        "civil society",
        "news",
        "created",
        "hours ago",
        "report spam",
        "t1555",
        "password",
        "t1560",
        "collected data",
        "t1573",
        "channel",
        "t1574",
        "execution flow",
        "scan",
        "iocs",
        "t1497",
        "u0lhmq",
        "mtawmq",
        "t1480",
        "guardrails",
        "t1486",
        "data encrypted",
        "learn more",
        "unsubscribe aug",
        "protocol",
        "t1074",
        "staged",
        "t1083",
        "t1102",
        "web service",
        "t1105",
        "tool transfer",
        "t1140",
        "data engineer",
        "candidate",
        "tlsv1",
        "odigicert inc",
        "stcalifornia",
        "lsan jose",
        "oadobe systems",
        "incorporated",
        "cndigicert sha2",
        "push",
        "next",
        "high",
        "write c",
        "ireland as16509",
        "delete",
        "dirty",
        "tags",
        "t1012",
        "flow endpoint",
        "security scan",
        "t1106",
        "copyright",
        "levelblue"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 608,
        "FileHash-SHA1": 433,
        "FileHash-SHA256": 3663,
        "URL": 17104,
        "domain": 1316,
        "email": 39,
        "hostname": 4208,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 27388,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "663d2869e0f3a42bbddc42ff",
      "name": "UPX executable packer.",
      "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
      "modified": "2024-10-14T00:01:17.069000",
      "created": "2024-05-09T19:47:53.786000",
      "tags": [
        "cioch adrian",
        "centrum usug",
        "sieciowych",
        "elf binary",
        "upx compression",
        "roth",
        "nextron",
        "info",
        "javascript",
        "html",
        "office open",
        "xml document",
        "network capture",
        "win32 exe",
        "xml pakietu",
        "pdf zestawy",
        "przechwytywanie",
        "office",
        "filehashsha1",
        "url https",
        "cve cve20201070",
        "cve cve20203153",
        "cve cve20201048",
        "cve cve20211732",
        "cve20201048 apr",
        "filehashmd5",
        "cve cve20010901",
        "cve cve20021841",
        "cve20153202 apr",
        "cve cve20160728",
        "cve cve20161807",
        "cve cve20175123",
        "cve20185407 apr",
        "cve cve20054605",
        "cve cve20060745",
        "cve cve20070452",
        "cve cve20070453",
        "cve cve20070454",
        "cve cve20071355",
        "cve cve20071358",
        "cve cve20071871",
        "cve20149614 apr",
        "cve cve20151503",
        "cve cve20152080",
        "cve cve20157377",
        "cve cve20170131",
        "cve20200796 may",
        "cve cve20113403"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6861,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 5771,
        "domain": 3139,
        "URL": 14525,
        "FileHash-SHA1": 2610,
        "IPv4": 108,
        "CIDR": 40,
        "FileHash-SHA256": 10705,
        "FileHash-MD5": 3373,
        "YARA": 2,
        "CVE": 148,
        "Mutex": 7,
        "FilePath": 3,
        "SSLCertFingerprint": 3,
        "email": 23,
        "JA3": 1,
        "IPv6": 2
      },
      "indicator_count": 40460,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "553 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://gqe.prototype.ma",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://gqe.prototype.ma",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776677469.484273
}