{
  "type": "URL",
  "indicator": "https://hardstyledrops-001-site1.site4future.com/login",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://hardstyledrops-001-site1.site4future.com/login",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4254690364,
      "indicator": "https://hardstyledrops-001-site1.site4future.com/login",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6a07250fb9562ea208d26946",
          "name": "Credit *Q.Vashti* Clone [\u2022 Virus Total | P.S Banker | Attacked/Blocked \u2022] ",
          "description": "",
          "modified": "2026-05-16T05:47:36.553000",
          "created": "2026-05-15T13:52:15.176000",
          "tags": [
            "indicator role",
            "active related",
            "ck ids",
            "files",
            "information",
            "discovery",
            "mitre att",
            "pattern match",
            "ck id",
            "ck matrix",
            "ascii text",
            "united",
            "binary file",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "protocol",
            "learn",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "execution att",
            "related pulses",
            "dll read",
            "function read",
            "icmp traffic",
            "machineguid",
            "systembiosdate",
            "total",
            "read",
            "write",
            "network_icmp",
            "js_eval",
            "recon_fingerprint",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "tls handshake",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "neue",
            "certificate",
            "error",
            "scans show",
            "record value",
            "title site",
            "servers",
            "emails",
            "all hostname",
            "dnsadmin",
            "data upload",
            "extraction",
            "failed",
            "include review",
            "exclude sugges",
            "find s",
            "typ no",
            "active",
            "urls",
            "ip address",
            "asn as54113",
            "registrar",
            "wscript",
            "united states",
            "stcalifornia",
            "lmountain view",
            "ogoogle llc",
            "ogoogle trust",
            "cngts ca",
            "whitelisted",
            "as15169",
            "hostile",
            "crash",
            "contacted",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "hostile yara",
            "detections none",
            "less ip",
            "domains",
            "ms windows",
            "intel",
            "pe32",
            "regsetvalueexa",
            "langturkish",
            "sublangdefault",
            "port",
            "destination",
            "entries",
            "worm",
            "delphi",
            "win32",
            "body",
            "explorer",
            "defender",
            "regdword",
            "false",
            "true",
            "end sub",
            "object",
            "createobject",
            "sheetschanged",
            "private sub",
            "string",
            "boolean",
            "cancel",
            "trojan",
            "copy",
            "query",
            "dns update",
            "useragent",
            "myapp",
            "delphi alerts",
            "alerts deadhost",
            "women who code",
            "tulach",
            "114.114.114.114",
            "samuel",
            "brian sabey"
          ],
          "references": [
            "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
            "this.target",
            "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
            "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
            "authrootstl.cab common file extension",
            "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
            "https://securityaffairs.com/144927/cyber-crime~#",
            "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
            "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
            "https://clockoutbox.es/password",
            "http://cr-malware.testpanw.com/url",
            "IDS Detections: Query to a *.pw domain - Likely Hostile",
            "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
            "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
            "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
            "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
            "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
            "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
            "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
            "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
            "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
            "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
            "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
            "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
            "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
            "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
            "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
            "114.114.114.114 = Tulach"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:Trojan:Win64/PsBanker",
              "display_name": "ALF:Trojan:Win64/PsBanker",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "Trojan:O97M/Madeba.A!det",
              "display_name": "Trojan:O97M/Madeba.A!det",
              "target": "/malware/Trojan:O97M/Madeba.A!det"
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69dc04c12782d2d76c111a93",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1114,
            "hostname": 594,
            "domain": 200,
            "FileHash-SHA256": 2379,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 259,
            "SSLCertFingerprint": 24,
            "email": 2,
            "IPv4": 1
          },
          "indicator_count": 4999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "16 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dc04c12782d2d76c111a93",
          "name": "VirusTotal \u2022 PsBanker \u2022 Attacked / Blocked",
          "description": "",
          "modified": "2026-05-12T20:40:08.152000",
          "created": "2026-04-12T20:46:57.338000",
          "tags": [
            "indicator role",
            "active related",
            "ck ids",
            "files",
            "information",
            "discovery",
            "mitre att",
            "pattern match",
            "ck id",
            "ck matrix",
            "ascii text",
            "united",
            "binary file",
            "april",
            "hybrid",
            "apikey",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "protocol",
            "learn",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "execution att",
            "related pulses",
            "dll read",
            "function read",
            "icmp traffic",
            "machineguid",
            "systembiosdate",
            "total",
            "read",
            "write",
            "network_icmp",
            "js_eval",
            "recon_fingerprint",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "tls handshake",
            "execution",
            "dock",
            "persistence",
            "malware",
            "unknown",
            "neue",
            "certificate",
            "error",
            "scans show",
            "record value",
            "title site",
            "servers",
            "emails",
            "all hostname",
            "dnsadmin",
            "data upload",
            "extraction",
            "failed",
            "include review",
            "exclude sugges",
            "find s",
            "typ no",
            "active",
            "urls",
            "ip address",
            "asn as54113",
            "registrar",
            "wscript",
            "united states",
            "stcalifornia",
            "lmountain view",
            "ogoogle llc",
            "ogoogle trust",
            "cngts ca",
            "whitelisted",
            "as15169",
            "hostile",
            "crash",
            "contacted",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "hostile yara",
            "detections none",
            "less ip",
            "domains",
            "ms windows",
            "intel",
            "pe32",
            "regsetvalueexa",
            "langturkish",
            "sublangdefault",
            "port",
            "destination",
            "entries",
            "worm",
            "delphi",
            "win32",
            "body",
            "explorer",
            "defender",
            "regdword",
            "false",
            "true",
            "end sub",
            "object",
            "createobject",
            "sheetschanged",
            "private sub",
            "string",
            "boolean",
            "cancel",
            "trojan",
            "copy",
            "query",
            "dns update",
            "useragent",
            "myapp",
            "delphi alerts",
            "alerts deadhost",
            "women who code",
            "tulach",
            "114.114.114.114",
            "samuel",
            "brian sabey"
          ],
          "references": [
            "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
            "this.target",
            "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
            "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
            "authrootstl.cab common file extension",
            "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
            "https://securityaffairs.com/144927/cyber-crime~#",
            "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
            "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
            "https://clockoutbox.es/password",
            "http://cr-malware.testpanw.com/url",
            "IDS Detections: Query to a *.pw domain - Likely Hostile",
            "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
            "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
            "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
            "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
            "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
            "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
            "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
            "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
            "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
            "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
            "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
            "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
            "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
            "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
            "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
            "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
            "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
            "114.114.114.114 = Tulach"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:Trojan:Win64/PsBanker",
              "display_name": "ALF:Trojan:Win64/PsBanker",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "Trojan:O97M/Madeba.A!det",
              "display_name": "Trojan:O97M/Madeba.A!det",
              "target": "/malware/Trojan:O97M/Madeba.A!det"
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1114,
            "hostname": 594,
            "domain": 200,
            "FileHash-SHA256": 2379,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 259,
            "SSLCertFingerprint": 24,
            "email": 2
          },
          "indicator_count": 4998,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "20 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b7241a63b7527ac2b04d60",
          "name": "DoD_Cyber_Strategy | Umbald.A | Patched3_c.AKRV | DoD | Navy.mil extensions | Adult Content distribution [msudosos IoCs connects to]",
          "description": "I became curious about an IoC found in a Pulse labeled \u2018undefined\u2019  by msudosos notated in  references and in parenthesis below this text. I did deep research on msudosos IoC. \nhttps://www.cybercom.mil/Portals/56/Document\ns/Strategy/DoD_Cyber_Strategy_2023.pdf | Apparent cyber warfare. Distribution of pornography potentially. The only use I have seen the type of attacks used for is reputation damage. | I am going to stick with the \u2018undefined\u2019 label given by msudosos because I don\u2019t know the purpose for the alleged Navy. mil & DoD for porn distribution. It\u2019s not to ensnare child predators. Possibly quasi government access to deter potential claimants. Possible hacker involvement. Going with \u2018undefined\u2019 for the moment.\n\n[444ea032708bb0d940de0ef72b944244 | credit msudosos || Patched3_c.AKRV -> https://otx.alienvault.com/indicator/file/444ea032708bb0d940de0ef72b944244]",
          "modified": "2026-04-14T18:06:37.524000",
          "created": "2026-03-15T21:26:50.218000",
          "tags": [
            "man software",
            "destination",
            "port",
            "united",
            "delete",
            "read c",
            "virustotal",
            "patched3_c.akrv",
            "armadillov171",
            "dod",
            "thinkman",
            "win32",
            "trojan",
            "present mar",
            "backdoor",
            "urls",
            "files",
            "unknown",
            "search",
            "china as23724",
            "asnone",
            "artemis",
            "zeppelin",
            "drweb",
            "vipre",
            "panda",
            "malware",
            "suspicious",
            "cloud",
            "logic",
            "et trojan",
            "et info",
            "download",
            "windows",
            "embeddedwb",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "writeconsolew",
            "displayname",
            "service",
            "ids detections",
            "yara detections",
            "crypt",
            "medium",
            "whitelisted",
            "passive dns",
            "worm",
            "mtb may",
            "mtb aug",
            "otx logo",
            "all ipv4",
            "pulse pulses",
            "dynamicloader",
            "yara rule",
            "ff d5",
            "high",
            "reg add",
            "regsz d",
            "write",
            "file type",
            "pexe",
            "pe32",
            "intel",
            "ms windows",
            "pe packer",
            "pm size",
            "pehash",
            "richhash",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "over",
            "sha256",
            "sha1",
            "ascii text",
            "size",
            "mitre att",
            "pattern match",
            "null",
            "span",
            "error",
            "body",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "refresh",
            "tools",
            "title",
            "show technique",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "navy",
            "reputation",
            "adult content",
            "cyber warfare"
          ],
          "references": [
            "AVDetections:  Patched3_c.AKRV",
            "Yara Detections: Armadillov171",
            "Alerts: antiav_servicestop persistence_autorun network_bind antivirus_virustotal network_http",
            "IP\u2019s Contacted:  8.8.8.8  78.46.218.253  74.208.229.157  192.5.41.40",
            "Contacted Domains:  tick.usno.navy.mil www.thinkman.com",
            "AS27064 DOD Network Information Center? |  192.5.41.40 | tick.usno.navy.mil tick.usno.navy.mil | United States",
            "AS8560 1&1 ionos se | 74.208.229.157 | www.thinkman.com\twww.thinkman.com | United States",
            "AS24940 hetzner online gmbh |78.46.218.253\t | static.253.218.46.78.clients.your-server.de | Germany",
            "AS15169 google llc  | 8.8.8.8\t| dns.google | United States",
            "Email: d4@thinkman.com",
            "Domain: navy.mil DNS Files IP Address: 192.5.41.40 Location: United States",
            "ASN AS27064 dod network information center",
            "Nameservers: dns5.disa.mil. ,  dns4.disa.mil. ,  squad.navo.mil. ,  crnaone.navy.mil. ,  dns1.disa.mil.",
            "Nameservers: squid.navo. ,  squid.navo.mil. ,  dns2.disa.mil. ,  minnow.navo. ,  navy.mil. ,  dns3.disa.mil.",
            "tick.usno.navy.mil , navy.mil: trojan:Win32/Tiggre!rfn Win.Trojan.Rootkit-4668 Win32:Agent-ALXE\\ [Rtk] Win32:Malware-gen",
            "TrojanDownloader:Win32/Umbald.A\tMalware infection",
            "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
            "Alerts: nolookup_communication persistence_autorun bypass_firewall network_http p2p_cnc",
            "Alerts: allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process",
            "Alerts: stealth_window packer_entropy uses_windows_utilities",
            "Alerts: console_output antivm_memory_available pe_features",
            "Yara Detections: MS_Visual_Basic_6_0",
            "Alerts: process_creation_suspicious_location injection_write_exe_process persistence_autorun",
            "Alerts: procmem_yara static_pe_anomaly deletes_executed_files injection_runpe",
            "Alerts: mouse_movement_detect dynamic_function_loading resumethread_remote_process",
            "Alerts:  injection_write_process reads_self stealth_window injection_rwx uses_windows_utilities",
            "Alerts:  queries_user_name queries_keyboard_layout queries_locale_api",
            "Alerts: antidebug_setunhandledexceptionfilter dll_load_uncommon_file_types",
            "porn.nonstopvideos.pl \u2022 xxx-xvideo.com \u2022 essexmetals.com",
            "http://www.aerix.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/latex-porn/",
            "navy.mil \u2022 http://acts.navair.navy.mil \u2022  http://logistics.navair.navy.mil/rcm/",
            "https://www.cloud.mil/CVRC:/Users/joshua.colliflower/OneDrive/OneDrive%20-%20United%20States%20Department%20of%20the%20Navy/Documents/Archive%20Miscellaneous",
            "192.5.41.40 scanning_host\t\u2022 74.208.229.157 scanning_host",
            "444ea032708bb0d940de0ef72b944244 | credit msudosos",
            "Patched3_c.AKRV -> https://otx.alienvault.com/indicator/file/444ea032708bb0d940de0ef72b944244",
            "https://otx.alienvault.com/pulse/69b65d6a27024117a4cd3540 [credit msudosos]",
            "https://www.cybercom.mil/Portals/56/Documents/Strategy/DoD_Cyber_Strategy_2023.pdf",
            "DoD related:  192.5.41.40 scanning_host\t140.19.33.126 \u2022 199.9.2.136 \u2022 214.23.15.26",
            "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6edod--a.gif",
            "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6efyLw9|dod--a | (205.162.40.0/21) (Omeda Communications )",
            "205.162.42.171 (205.162.40.0/21) AS 53866 ( Omeda Communications )",
            "https://exchange.simply.ms/owa/auth/logon.aspx?url=https://exchange.simply.ms/owa/&reason=0",
            "mailbox.co.za",
            "fmx32.aig.com \u2022  167.230.105.81",
            "https://otx.alienvault.com/indicator/url/https://gossip.thedirty.com/cdn-cgi/l/chk_jschl?s=04e9c17f33a895764287ae3918f54f016b353177-1551745661-1800-AWU4eGCIAWcUFRuFo2RAigESClCdCQ/9FJquPKplzHISR2zmIZSTluV/jEDBqANqdDORIXIACOwCScDYumaSt5kRHUKVAK4z6Wlo0HzAhetn"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Patched3_c.AKRV",
              "display_name": "Patched3_c.AKRV",
              "target": null
            },
            {
              "id": "Win32:Agent-ALXE\\ [Rtk]",
              "display_name": "Win32:Agent-ALXE\\ [Rtk]",
              "target": null
            },
            {
              "id": "Win.Trojan.Rootkit-4668",
              "display_name": "Win.Trojan.Rootkit-4668",
              "target": null
            },
            {
              "id": "Trojan:Win32/Tiggre!rfn",
              "display_name": "Trojan:Win32/Tiggre!rfn",
              "target": "/malware/Trojan:Win32/Tiggre!rfn"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Inject2.BIVE",
              "display_name": "Inject2.BIVE",
              "target": null
            },
            {
              "id": "Crypt3.CHZW",
              "display_name": "Crypt3.CHZW",
              "target": null
            },
            {
              "id": "Crypt3.BXVC",
              "display_name": "Crypt3.BXVC",
              "target": null
            },
            {
              "id": "Crypt3.BXMJ",
              "display_name": "Crypt3.BXMJ",
              "target": null
            },
            {
              "id": "Crypt3.BOQD\t\t Inject2.BHBW",
              "display_name": "Crypt3.BOQD\t\t Inject2.BHBW",
              "target": null
            },
            {
              "id": "Crypt3.BMVU",
              "display_name": "Crypt3.BMVU",
              "target": null
            },
            {
              "id": "Trojan.DownLoader12.43161",
              "display_name": "Trojan.DownLoader12.43161",
              "target": null
            },
            {
              "id": "HEUR/UnSec",
              "display_name": "HEUR/UnSec",
              "target": null
            },
            {
              "id": "ET Trojan",
              "display_name": "ET Trojan",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Umbald.A",
              "display_name": "TrojanDownloader:Win32/Umbald.A",
              "target": "/malware/TrojanDownloader:Win32/Umbald.A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1048.001",
              "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            }
          ],
          "industries": [
            "Government",
            "Military",
            "Defense",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 165,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 3524,
            "URL": 11424,
            "email": 1,
            "hostname": 3954,
            "domain": 2523
          },
          "indicator_count": 21756,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "48 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69afd95e9073ee0f67be8694",
          "name": "URLSpirit Spyware | Targeted Device attacks | MITM attacks | AI and Browser Attacks",
          "description": "",
          "modified": "2026-04-09T08:02:04.521000",
          "created": "2026-03-10T08:42:06.133000",
          "tags": [
            "msie",
            "chrome",
            "search",
            "united",
            "unknown ns",
            "taiwan unknown",
            "requested range",
            "ip address",
            "taiwan",
            "title",
            "tlsv1",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "stcalifornia",
            "lmountain view",
            "ogoogle llc",
            "unknown",
            "encrypt",
            "malware",
            "suspicious",
            "learn",
            "informative",
            "ck id",
            "name tactics",
            "command",
            "spawns",
            "found",
            "id name",
            "malicious",
            "over",
            "ascii text",
            "pattern match",
            "mitre att",
            "size",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "http",
            "data upload",
            "enter scords",
            "one on",
            "extraction",
            "http request",
            "checkin",
            "observed dns",
            "query",
            "dns query",
            "domain",
            "lila windows",
            "all se",
            "file version",
            "product vers",
            "failed",
            "included ic",
            "review iocs",
            "ic data",
            "status",
            "ch ua",
            "emails",
            "servers",
            "for privacy",
            "record value",
            "trojan",
            "pegasus",
            "body",
            "palantir",
            "se antivirus",
            "ids deted",
            "domains",
            "tachnalnav dan",
            "origin",
            "pe versio",
            "include review",
            "exclude sugges",
            "stop data",
            "q search",
            "product",
            "contact data",
            "contact urlspirit",
            "url http",
            "hostname",
            "url https",
            "stop show",
            "types",
            "type",
            "indicator",
            "defense evasion",
            "sha1",
            "legalcopyngn",
            "copyugnt zur",
            "fileversic data",
            "exclude data",
            "no expiration",
            "ipv4",
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "macintosh",
            "khtml",
            "type indicator",
            "iocs",
            "sc type",
            "hong kong",
            "certificate",
            "enterprise",
            "adversaries",
            "evasion att",
            "urlspirit",
            "targeted att",
            "monitored target",
            "browser attacks",
            "ai chat",
            "next level",
            "quasi",
            "apple",
            "android",
            "windows"
          ],
          "references": [
            "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
            "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "Antivirus Detections: Win.Trojan.Agent-1190546",
            "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
            "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
            "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
            "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
            "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
            "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
            "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
            "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
            "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
            "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
            "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
            "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
            "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
            "URLSpirit Spyware",
            "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
            "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
            "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
            "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe",
            "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
            "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
            "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
            "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
            "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
            "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
            "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
            "quecompegasune.tk \u2022 hipicapegaso.com",
            "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
            "Incredibly false information, white screens , pink screens and chat erasure",
            "Definitely requires further research",
            "Pegasus Indicators deleted during pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Malaysia"
          ],
          "malware_families": [
            {
              "id": "URLSpirit",
              "display_name": "URLSpirit",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1608.004",
              "name": "Drive-by Target",
              "display_name": "T1608.004 - Drive-by Target"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1428",
              "name": "Exploit Enterprise Resources",
              "display_name": "T1428 - Exploit Enterprise Resources"
            },
            {
              "id": "T1080",
              "name": "Taint Shared Content",
              "display_name": "T1080 - Taint Shared Content"
            }
          ],
          "industries": [
            "Technology",
            "Government",
            "Defense"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 406,
            "FileHash-SHA1": 391,
            "FileHash-SHA256": 5770,
            "URL": 7299,
            "domain": 1307,
            "email": 13,
            "hostname": 2162,
            "CVE": 3,
            "SSLCertFingerprint": 45
          },
          "indicator_count": 17396,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "53 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "mailbox.co.za",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "Alerts: mouse_movement_detect dynamic_function_loading resumethread_remote_process",
        "AS27064 DOD Network Information Center? |  192.5.41.40 | tick.usno.navy.mil tick.usno.navy.mil | United States",
        "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
        "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
        "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
        "Yara Detections: MS_Visual_Basic_6_0",
        "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
        "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
        "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
        "https://www.cloud.mil/CVRC:/Users/joshua.colliflower/OneDrive/OneDrive%20-%20United%20States%20Department%20of%20the%20Navy/Documents/Archive%20Miscellaneous",
        "Alerts:  queries_user_name queries_keyboard_layout queries_locale_api",
        "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
        "Alerts: stealth_window packer_entropy uses_windows_utilities",
        "authrootstl.cab common file extension",
        "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
        "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
        "Antivirus Detections: Win.Trojan.Agent-1190546",
        "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
        "192.5.41.40 scanning_host\t\u2022 74.208.229.157 scanning_host",
        "DoD related:  192.5.41.40 scanning_host\t140.19.33.126 \u2022 199.9.2.136 \u2022 214.23.15.26",
        "Incredibly false information, white screens , pink screens and chat erasure",
        "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
        "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
        "quecompegasune.tk \u2022 hipicapegaso.com",
        "Alerts: procmem_yara static_pe_anomaly deletes_executed_files injection_runpe",
        "Alerts: antiav_servicestop persistence_autorun network_bind antivirus_virustotal network_http",
        "TrojanDownloader:Win32/Umbald.A\tMalware infection",
        "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
        "Domain: navy.mil DNS Files IP Address: 192.5.41.40 Location: United States",
        "http://www.aerix.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/latex-porn/",
        "https://clockoutbox.es/password",
        "Patched3_c.AKRV -> https://otx.alienvault.com/indicator/file/444ea032708bb0d940de0ef72b944244",
        "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
        "205.162.42.171 (205.162.40.0/21) AS 53866 ( Omeda Communications )",
        "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
        "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
        "Alerts: antidebug_setunhandledexceptionfilter dll_load_uncommon_file_types",
        "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6edod--a.gif",
        "https://otx.alienvault.com/pulse/69b65d6a27024117a4cd3540 [credit msudosos]",
        "444ea032708bb0d940de0ef72b944244 | credit msudosos",
        "Pegasus Indicators deleted during pulse",
        "Definitely requires further research",
        "Alerts:  injection_write_process reads_self stealth_window injection_rwx uses_windows_utilities",
        "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
        "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
        "Email: d4@thinkman.com",
        "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
        "tick.usno.navy.mil , navy.mil: trojan:Win32/Tiggre!rfn Win.Trojan.Rootkit-4668 Win32:Agent-ALXE\\ [Rtk] Win32:Malware-gen",
        "AVDetections:  Patched3_c.AKRV",
        "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
        "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
        "https://otx.alienvault.com/indicator/url/https://gossip.thedirty.com/cdn-cgi/l/chk_jschl?s=04e9c17f33a895764287ae3918f54f016b353177-1551745661-1800-AWU4eGCIAWcUFRuFo2RAigESClCdCQ/9FJquPKplzHISR2zmIZSTluV/jEDBqANqdDORIXIACOwCScDYumaSt5kRHUKVAK4z6Wlo0HzAhetn",
        "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
        "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
        "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
        "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
        "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
        "Contacted Domains:  tick.usno.navy.mil www.thinkman.com",
        "AS8560 1&1 ionos se | 74.208.229.157 | www.thinkman.com\twww.thinkman.com | United States",
        "Nameservers: dns5.disa.mil. ,  dns4.disa.mil. ,  squad.navo.mil. ,  crnaone.navy.mil. ,  dns1.disa.mil.",
        "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
        "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
        "Nameservers: squid.navo. ,  squid.navo.mil. ,  dns2.disa.mil. ,  minnow.navo. ,  navy.mil. ,  dns3.disa.mil.",
        "Alerts: console_output antivm_memory_available pe_features",
        "fmx32.aig.com \u2022  167.230.105.81",
        "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
        "Alerts: allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process",
        "AS15169 google llc  | 8.8.8.8\t| dns.google | United States",
        "porn.nonstopvideos.pl \u2022 xxx-xvideo.com \u2022 essexmetals.com",
        "AS24940 hetzner online gmbh |78.46.218.253\t | static.253.218.46.78.clients.your-server.de | Germany",
        "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
        "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
        "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
        "IP\u2019s Contacted:  8.8.8.8  78.46.218.253  74.208.229.157  192.5.41.40",
        "navy.mil \u2022 http://acts.navair.navy.mil \u2022  http://logistics.navair.navy.mil/rcm/",
        "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
        "this.target",
        "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
        "https://www.cybercom.mil/Portals/56/Documents/Strategy/DoD_Cyber_Strategy_2023.pdf",
        "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
        "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
        "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
        "Alerts: process_creation_suspicious_location injection_write_exe_process persistence_autorun",
        "http://cr-malware.testpanw.com/url",
        "IDS Detections: Query to a *.pw domain - Likely Hostile",
        "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6efyLw9|dod--a | (205.162.40.0/21) (Omeda Communications )",
        "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
        "Yara Detections: Armadillov171",
        "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
        "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe",
        "114.114.114.114 = Tulach",
        "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
        "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
        "https://exchange.simply.ms/owa/auth/logon.aspx?url=https://exchange.simply.ms/owa/&reason=0",
        "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
        "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
        "https://securityaffairs.com/144927/cyber-crime~#",
        "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
        "ASN AS27064 dod network information center",
        "URLSpirit Spyware",
        "Alerts: nolookup_communication persistence_autorun bypass_firewall network_http p2p_cnc"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan:o97m/madeba.a!det",
            "Win32:malware-gen",
            "Trojan.downloader12.43161",
            "Alf:trojan:win64/psbanker",
            "Crypt3.bxvc",
            "Worm:win32/autorun!atmn",
            "Inject2.bive",
            "Trojandownloader:win32/umbald.a",
            "Heur/unsec",
            "Trojan:win32/tiggre!rfn",
            "Urlspirit",
            "Win.trojan.rootkit-4668",
            "Crypt3.boqd\t\t inject2.bhbw",
            "Crypt3.chzw",
            "Win32:agent-alxe\\ [rtk]",
            "Backdoor:win32/tofsee.t",
            "Patched3_c.akrv",
            "Win32:trojan-gen",
            "Crypt3.bmvu",
            "Et trojan",
            "Tulach",
            "Crypt3.bxmj"
          ],
          "industries": [
            "Technology",
            "Government",
            "Insurance",
            "Military",
            "Defense"
          ],
          "unique_indicators": 44637
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/site4future.com",
    "whois": "http://whois.domaintools.com/site4future.com",
    "domain": "site4future.com",
    "hostname": "hardstyledrops-001-site1.site4future.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6a07250fb9562ea208d26946",
      "name": "Credit *Q.Vashti* Clone [\u2022 Virus Total | P.S Banker | Attacked/Blocked \u2022] ",
      "description": "",
      "modified": "2026-05-16T05:47:36.553000",
      "created": "2026-05-15T13:52:15.176000",
      "tags": [
        "indicator role",
        "active related",
        "ck ids",
        "files",
        "information",
        "discovery",
        "mitre att",
        "pattern match",
        "ck id",
        "ck matrix",
        "ascii text",
        "united",
        "binary file",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "protocol",
        "learn",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "execution att",
        "related pulses",
        "dll read",
        "function read",
        "icmp traffic",
        "machineguid",
        "systembiosdate",
        "total",
        "read",
        "write",
        "network_icmp",
        "js_eval",
        "recon_fingerprint",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "tls handshake",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "neue",
        "certificate",
        "error",
        "scans show",
        "record value",
        "title site",
        "servers",
        "emails",
        "all hostname",
        "dnsadmin",
        "data upload",
        "extraction",
        "failed",
        "include review",
        "exclude sugges",
        "find s",
        "typ no",
        "active",
        "urls",
        "ip address",
        "asn as54113",
        "registrar",
        "wscript",
        "united states",
        "stcalifornia",
        "lmountain view",
        "ogoogle llc",
        "ogoogle trust",
        "cngts ca",
        "whitelisted",
        "as15169",
        "hostile",
        "crash",
        "contacted",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "hostile yara",
        "detections none",
        "less ip",
        "domains",
        "ms windows",
        "intel",
        "pe32",
        "regsetvalueexa",
        "langturkish",
        "sublangdefault",
        "port",
        "destination",
        "entries",
        "worm",
        "delphi",
        "win32",
        "body",
        "explorer",
        "defender",
        "regdword",
        "false",
        "true",
        "end sub",
        "object",
        "createobject",
        "sheetschanged",
        "private sub",
        "string",
        "boolean",
        "cancel",
        "trojan",
        "copy",
        "query",
        "dns update",
        "useragent",
        "myapp",
        "delphi alerts",
        "alerts deadhost",
        "women who code",
        "tulach",
        "114.114.114.114",
        "samuel",
        "brian sabey"
      ],
      "references": [
        "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
        "this.target",
        "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
        "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
        "authrootstl.cab common file extension",
        "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
        "https://securityaffairs.com/144927/cyber-crime~#",
        "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
        "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
        "https://clockoutbox.es/password",
        "http://cr-malware.testpanw.com/url",
        "IDS Detections: Query to a *.pw domain - Likely Hostile",
        "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
        "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
        "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
        "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
        "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
        "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
        "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
        "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
        "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
        "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
        "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
        "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
        "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
        "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
        "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
        "114.114.114.114 = Tulach"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:Trojan:Win64/PsBanker",
          "display_name": "ALF:Trojan:Win64/PsBanker",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "Trojan:O97M/Madeba.A!det",
          "display_name": "Trojan:O97M/Madeba.A!det",
          "target": "/malware/Trojan:O97M/Madeba.A!det"
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69dc04c12782d2d76c111a93",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1114,
        "hostname": 594,
        "domain": 200,
        "FileHash-SHA256": 2379,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 259,
        "SSLCertFingerprint": 24,
        "email": 2,
        "IPv4": 1
      },
      "indicator_count": 4999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "16 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dc04c12782d2d76c111a93",
      "name": "VirusTotal \u2022 PsBanker \u2022 Attacked / Blocked",
      "description": "",
      "modified": "2026-05-12T20:40:08.152000",
      "created": "2026-04-12T20:46:57.338000",
      "tags": [
        "indicator role",
        "active related",
        "ck ids",
        "files",
        "information",
        "discovery",
        "mitre att",
        "pattern match",
        "ck id",
        "ck matrix",
        "ascii text",
        "united",
        "binary file",
        "april",
        "hybrid",
        "apikey",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "protocol",
        "learn",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "execution att",
        "related pulses",
        "dll read",
        "function read",
        "icmp traffic",
        "machineguid",
        "systembiosdate",
        "total",
        "read",
        "write",
        "network_icmp",
        "js_eval",
        "recon_fingerprint",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "tls handshake",
        "execution",
        "dock",
        "persistence",
        "malware",
        "unknown",
        "neue",
        "certificate",
        "error",
        "scans show",
        "record value",
        "title site",
        "servers",
        "emails",
        "all hostname",
        "dnsadmin",
        "data upload",
        "extraction",
        "failed",
        "include review",
        "exclude sugges",
        "find s",
        "typ no",
        "active",
        "urls",
        "ip address",
        "asn as54113",
        "registrar",
        "wscript",
        "united states",
        "stcalifornia",
        "lmountain view",
        "ogoogle llc",
        "ogoogle trust",
        "cngts ca",
        "whitelisted",
        "as15169",
        "hostile",
        "crash",
        "contacted",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "hostile yara",
        "detections none",
        "less ip",
        "domains",
        "ms windows",
        "intel",
        "pe32",
        "regsetvalueexa",
        "langturkish",
        "sublangdefault",
        "port",
        "destination",
        "entries",
        "worm",
        "delphi",
        "win32",
        "body",
        "explorer",
        "defender",
        "regdword",
        "false",
        "true",
        "end sub",
        "object",
        "createobject",
        "sheetschanged",
        "private sub",
        "string",
        "boolean",
        "cancel",
        "trojan",
        "copy",
        "query",
        "dns update",
        "useragent",
        "myapp",
        "delphi alerts",
        "alerts deadhost",
        "women who code",
        "tulach",
        "114.114.114.114",
        "samuel",
        "brian sabey"
      ],
      "references": [
        "https://www.virustotal.com/gui/search/maxsecure:%22virus.webtoolbar.w32.searchsuite.gen_227097%22%20entity:file",
        "this.target",
        "c6pPVZhf.exe FileHash-SHA256 99e60fbd12fa9cffb9e84b4f8fa53169cd9eb965f083337de1995926a5ed83f1",
        "amazon.com \u2022 pki.goog \u2022 google-analytics.com",
        "authrootstl.cab common file extension",
        "dlvr.it \u2022 securityaffairs.com \u2022 wscript.shell",
        "https://securityaffairs.com/144927/cyber-crime~#",
        "https://securityaffairs.com/144927/cyber-crime/qbot-campaign-april-2023.html",
        "virustotalcloud.firebaseapp.com \u2022 firebaseapp.com \u2022 firebase.google.com \u2022 dns-admin@google.com",
        "https://clockoutbox.es/password",
        "http://cr-malware.testpanw.com/url",
        "IDS Detections: Query to a *.pw domain - Likely Hostile",
        "Alerts: network_icmp deletes_executed_files injection_resumethread dumped_buffer",
        "Alerts: network_http nids_alert suspicious_tld allocates_rwx antisandbox_foregroundwindows",
        "Alerts: applcation_raises_exception creates_exe suspicious_process stealth_window uses_",
        "Alerts: windows_utilities antivm_memory_available pe_features raises_exception",
        "IP\u2019s Contacted: 104.16.132.229  104.31.4.167  108.177.126.101  108.177.126.94  13.107.21.200  172.217.14.227",
        "IP\u2019s Contacted: 172.217.3.163  172.217.3.202  172.217.3.206  173.194.69.94",
        "Domains Contacted: www.youtube.com www.google.co.ck www.google.com ocsp.pki.goog",
        "Domains Contacted: www.virustotal.com www.gstatic.com fonts.googleapis.com",
        "Domains Contacted:: i.ytimg.com encrypted-tbn0.gstatic.com cponline.pw",
        "Win32:Crypt-SKC\\ [Trj] ,  Win.Malware.Delf-6899401-0 ,  Worm:Win32/AutoRun!atmn",
        "IDS Detections: W32.Bloat-A Checkin DYNAMIC_DNS Query to Abused Domain *.mooo.com Suspicious Dynamic DNS Update Request Suspicious User-Agent (MyApp)",
        "Yara Detections compromised_site_redirector_fromcharcode ,  Delphi",
        "Alerts: dead_host network_icmp persistence_autorun modifies_certificates modifies_proxy_wpad",
        "Alerts: multiple_useragents dumped_buffer networkdyndns_checkip network_http allocates_rwx",
        "IP\u2019s Contacted: 104.97.41.163  142.251.33.67  142.251.33.78  209.197.3.8  216.239.32.29",
        "Domains Contacted: pki.goog www.microsoft.com ocsp.pki.goog freedns.afraid.org",
        "Domains Contacted: xred.mooo.com www.download.windowsupdate.com docs.google.com",
        "114.114.114.114 = Tulach"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:Trojan:Win64/PsBanker",
          "display_name": "ALF:Trojan:Win64/PsBanker",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "Trojan:O97M/Madeba.A!det",
          "display_name": "Trojan:O97M/Madeba.A!det",
          "target": "/malware/Trojan:O97M/Madeba.A!det"
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1114,
        "hostname": 594,
        "domain": 200,
        "FileHash-SHA256": 2379,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 259,
        "SSLCertFingerprint": 24,
        "email": 2
      },
      "indicator_count": 4998,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "20 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b7241a63b7527ac2b04d60",
      "name": "DoD_Cyber_Strategy | Umbald.A | Patched3_c.AKRV | DoD | Navy.mil extensions | Adult Content distribution [msudosos IoCs connects to]",
      "description": "I became curious about an IoC found in a Pulse labeled \u2018undefined\u2019  by msudosos notated in  references and in parenthesis below this text. I did deep research on msudosos IoC. \nhttps://www.cybercom.mil/Portals/56/Document\ns/Strategy/DoD_Cyber_Strategy_2023.pdf | Apparent cyber warfare. Distribution of pornography potentially. The only use I have seen the type of attacks used for is reputation damage. | I am going to stick with the \u2018undefined\u2019 label given by msudosos because I don\u2019t know the purpose for the alleged Navy. mil & DoD for porn distribution. It\u2019s not to ensnare child predators. Possibly quasi government access to deter potential claimants. Possible hacker involvement. Going with \u2018undefined\u2019 for the moment.\n\n[444ea032708bb0d940de0ef72b944244 | credit msudosos || Patched3_c.AKRV -> https://otx.alienvault.com/indicator/file/444ea032708bb0d940de0ef72b944244]",
      "modified": "2026-04-14T18:06:37.524000",
      "created": "2026-03-15T21:26:50.218000",
      "tags": [
        "man software",
        "destination",
        "port",
        "united",
        "delete",
        "read c",
        "virustotal",
        "patched3_c.akrv",
        "armadillov171",
        "dod",
        "thinkman",
        "win32",
        "trojan",
        "present mar",
        "backdoor",
        "urls",
        "files",
        "unknown",
        "search",
        "china as23724",
        "asnone",
        "artemis",
        "zeppelin",
        "drweb",
        "vipre",
        "panda",
        "malware",
        "suspicious",
        "cloud",
        "logic",
        "et trojan",
        "et info",
        "download",
        "windows",
        "embeddedwb",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "writeconsolew",
        "displayname",
        "service",
        "ids detections",
        "yara detections",
        "crypt",
        "medium",
        "whitelisted",
        "passive dns",
        "worm",
        "mtb may",
        "mtb aug",
        "otx logo",
        "all ipv4",
        "pulse pulses",
        "dynamicloader",
        "yara rule",
        "ff d5",
        "high",
        "reg add",
        "regsz d",
        "write",
        "file type",
        "pexe",
        "pe32",
        "intel",
        "ms windows",
        "pe packer",
        "pm size",
        "pehash",
        "richhash",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "over",
        "sha256",
        "sha1",
        "ascii text",
        "size",
        "mitre att",
        "pattern match",
        "null",
        "span",
        "error",
        "body",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "refresh",
        "tools",
        "title",
        "show technique",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "navy",
        "reputation",
        "adult content",
        "cyber warfare"
      ],
      "references": [
        "AVDetections:  Patched3_c.AKRV",
        "Yara Detections: Armadillov171",
        "Alerts: antiav_servicestop persistence_autorun network_bind antivirus_virustotal network_http",
        "IP\u2019s Contacted:  8.8.8.8  78.46.218.253  74.208.229.157  192.5.41.40",
        "Contacted Domains:  tick.usno.navy.mil www.thinkman.com",
        "AS27064 DOD Network Information Center? |  192.5.41.40 | tick.usno.navy.mil tick.usno.navy.mil | United States",
        "AS8560 1&1 ionos se | 74.208.229.157 | www.thinkman.com\twww.thinkman.com | United States",
        "AS24940 hetzner online gmbh |78.46.218.253\t | static.253.218.46.78.clients.your-server.de | Germany",
        "AS15169 google llc  | 8.8.8.8\t| dns.google | United States",
        "Email: d4@thinkman.com",
        "Domain: navy.mil DNS Files IP Address: 192.5.41.40 Location: United States",
        "ASN AS27064 dod network information center",
        "Nameservers: dns5.disa.mil. ,  dns4.disa.mil. ,  squad.navo.mil. ,  crnaone.navy.mil. ,  dns1.disa.mil.",
        "Nameservers: squid.navo. ,  squid.navo.mil. ,  dns2.disa.mil. ,  minnow.navo. ,  navy.mil. ,  dns3.disa.mil.",
        "tick.usno.navy.mil , navy.mil: trojan:Win32/Tiggre!rfn Win.Trojan.Rootkit-4668 Win32:Agent-ALXE\\ [Rtk] Win32:Malware-gen",
        "TrojanDownloader:Win32/Umbald.A\tMalware infection",
        "IDS Detections: Win32/Tofsee.AX google.com connectivity check",
        "Alerts: nolookup_communication persistence_autorun bypass_firewall network_http p2p_cnc",
        "Alerts: allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process",
        "Alerts: stealth_window packer_entropy uses_windows_utilities",
        "Alerts: console_output antivm_memory_available pe_features",
        "Yara Detections: MS_Visual_Basic_6_0",
        "Alerts: process_creation_suspicious_location injection_write_exe_process persistence_autorun",
        "Alerts: procmem_yara static_pe_anomaly deletes_executed_files injection_runpe",
        "Alerts: mouse_movement_detect dynamic_function_loading resumethread_remote_process",
        "Alerts:  injection_write_process reads_self stealth_window injection_rwx uses_windows_utilities",
        "Alerts:  queries_user_name queries_keyboard_layout queries_locale_api",
        "Alerts: antidebug_setunhandledexceptionfilter dll_load_uncommon_file_types",
        "porn.nonstopvideos.pl \u2022 xxx-xvideo.com \u2022 essexmetals.com",
        "http://www.aerix.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/latex-porn/",
        "navy.mil \u2022 http://acts.navair.navy.mil \u2022  http://logistics.navair.navy.mil/rcm/",
        "https://www.cloud.mil/CVRC:/Users/joshua.colliflower/OneDrive/OneDrive%20-%20United%20States%20Department%20of%20the%20Navy/Documents/Archive%20Miscellaneous",
        "192.5.41.40 scanning_host\t\u2022 74.208.229.157 scanning_host",
        "444ea032708bb0d940de0ef72b944244 | credit msudosos",
        "Patched3_c.AKRV -> https://otx.alienvault.com/indicator/file/444ea032708bb0d940de0ef72b944244",
        "https://otx.alienvault.com/pulse/69b65d6a27024117a4cd3540 [credit msudosos]",
        "https://www.cybercom.mil/Portals/56/Documents/Strategy/DoD_Cyber_Strategy_2023.pdf",
        "DoD related:  192.5.41.40 scanning_host\t140.19.33.126 \u2022 199.9.2.136 \u2022 214.23.15.26",
        "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6edod--a.gif",
        "https://encore360.omeclk.com/portal/wts/ug^cnOmfy6efyLw9|dod--a | (205.162.40.0/21) (Omeda Communications )",
        "205.162.42.171 (205.162.40.0/21) AS 53866 ( Omeda Communications )",
        "https://exchange.simply.ms/owa/auth/logon.aspx?url=https://exchange.simply.ms/owa/&reason=0",
        "mailbox.co.za",
        "fmx32.aig.com \u2022  167.230.105.81",
        "https://otx.alienvault.com/indicator/url/https://gossip.thedirty.com/cdn-cgi/l/chk_jschl?s=04e9c17f33a895764287ae3918f54f016b353177-1551745661-1800-AWU4eGCIAWcUFRuFo2RAigESClCdCQ/9FJquPKplzHISR2zmIZSTluV/jEDBqANqdDORIXIACOwCScDYumaSt5kRHUKVAK4z6Wlo0HzAhetn"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Patched3_c.AKRV",
          "display_name": "Patched3_c.AKRV",
          "target": null
        },
        {
          "id": "Win32:Agent-ALXE\\ [Rtk]",
          "display_name": "Win32:Agent-ALXE\\ [Rtk]",
          "target": null
        },
        {
          "id": "Win.Trojan.Rootkit-4668",
          "display_name": "Win.Trojan.Rootkit-4668",
          "target": null
        },
        {
          "id": "Trojan:Win32/Tiggre!rfn",
          "display_name": "Trojan:Win32/Tiggre!rfn",
          "target": "/malware/Trojan:Win32/Tiggre!rfn"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Inject2.BIVE",
          "display_name": "Inject2.BIVE",
          "target": null
        },
        {
          "id": "Crypt3.CHZW",
          "display_name": "Crypt3.CHZW",
          "target": null
        },
        {
          "id": "Crypt3.BXVC",
          "display_name": "Crypt3.BXVC",
          "target": null
        },
        {
          "id": "Crypt3.BXMJ",
          "display_name": "Crypt3.BXMJ",
          "target": null
        },
        {
          "id": "Crypt3.BOQD\t\t Inject2.BHBW",
          "display_name": "Crypt3.BOQD\t\t Inject2.BHBW",
          "target": null
        },
        {
          "id": "Crypt3.BMVU",
          "display_name": "Crypt3.BMVU",
          "target": null
        },
        {
          "id": "Trojan.DownLoader12.43161",
          "display_name": "Trojan.DownLoader12.43161",
          "target": null
        },
        {
          "id": "HEUR/UnSec",
          "display_name": "HEUR/UnSec",
          "target": null
        },
        {
          "id": "ET Trojan",
          "display_name": "ET Trojan",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Umbald.A",
          "display_name": "TrojanDownloader:Win32/Umbald.A",
          "target": "/malware/TrojanDownloader:Win32/Umbald.A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1048.001",
          "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        }
      ],
      "industries": [
        "Government",
        "Military",
        "Defense",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 165,
        "FileHash-SHA1": 165,
        "FileHash-SHA256": 3524,
        "URL": 11424,
        "email": 1,
        "hostname": 3954,
        "domain": 2523
      },
      "indicator_count": 21756,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "48 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69afd95e9073ee0f67be8694",
      "name": "URLSpirit Spyware | Targeted Device attacks | MITM attacks | AI and Browser Attacks",
      "description": "",
      "modified": "2026-04-09T08:02:04.521000",
      "created": "2026-03-10T08:42:06.133000",
      "tags": [
        "msie",
        "chrome",
        "search",
        "united",
        "unknown ns",
        "taiwan unknown",
        "requested range",
        "ip address",
        "taiwan",
        "title",
        "tlsv1",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "stcalifornia",
        "lmountain view",
        "ogoogle llc",
        "unknown",
        "encrypt",
        "malware",
        "suspicious",
        "learn",
        "informative",
        "ck id",
        "name tactics",
        "command",
        "spawns",
        "found",
        "id name",
        "malicious",
        "over",
        "ascii text",
        "pattern match",
        "mitre att",
        "size",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "http",
        "data upload",
        "enter scords",
        "one on",
        "extraction",
        "http request",
        "checkin",
        "observed dns",
        "query",
        "dns query",
        "domain",
        "lila windows",
        "all se",
        "file version",
        "product vers",
        "failed",
        "included ic",
        "review iocs",
        "ic data",
        "status",
        "ch ua",
        "emails",
        "servers",
        "for privacy",
        "record value",
        "trojan",
        "pegasus",
        "body",
        "palantir",
        "se antivirus",
        "ids deted",
        "domains",
        "tachnalnav dan",
        "origin",
        "pe versio",
        "include review",
        "exclude sugges",
        "stop data",
        "q search",
        "product",
        "contact data",
        "contact urlspirit",
        "url http",
        "hostname",
        "url https",
        "stop show",
        "types",
        "type",
        "indicator",
        "defense evasion",
        "sha1",
        "legalcopyngn",
        "copyugnt zur",
        "fileversic data",
        "exclude data",
        "no expiration",
        "ipv4",
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "macintosh",
        "khtml",
        "type indicator",
        "iocs",
        "sc type",
        "hong kong",
        "certificate",
        "enterprise",
        "adversaries",
        "evasion att",
        "urlspirit",
        "targeted att",
        "monitored target",
        "browser attacks",
        "ai chat",
        "next level",
        "quasi",
        "apple",
        "android",
        "windows"
      ],
      "references": [
        "Exploit Source: 210.64.137.210 | IP\u4f4d\u5740\u8cc7\u8a0a\uff08210.64.0.0 tw.ntunhs.net)",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "Antivirus Detections: Win.Trojan.Agent-1190546",
        "IDS Detections: URLSpirit Spyware Checkin Observed DNS Query to Suspicious Domain adz2you[.]com",
        "IDS Detections: DNS Query for Suspicious .cf Domain HTTP Request to a *.xyz domain",
        "Alerts: network_icmp persistence_autorun disables_proxy modifies_certificates",
        "Alerts: modifies_proxy_wpad  ransomware_dropped_files ransomware_mass_file_delete",
        "Alerts: dumped_buffer network_cnc_http network_http network_http_post suspicious_tld",
        "Alerts: allocates_rwx antisandbox_foregroundwindows antisandbox_sleep antivm_disk_size",
        "Alerts: origin_langid creates_exe injection_process_search multiple_useragents",
        "Domains Contacted: r4---sn-5goeen7d.googlevideo.com s23.cnzz.com www.youtube.com",
        "Domains Contacted: c.cnzz.com crl.comodoca4.com ocsp2.globalsign.com a.exdynsrv.com",
        "Domains Contacted: www.wanuu2.club xml.admidainsight.com www.gstatic.com .",
        "Indicator deletion during pulse | Requires more research | Positive for MITM attack",
        "IP\u2019s Contacted: 103.23.108.110  103.23.108.112  103.23.108.114  103.23.108.124  103.23.108.140",
        "IP\u2019s Contacted: 103.23.108.184  103.23.108.220  103.23.108.80  103.23.108.92  104.18.20.226",
        "URLSpirit Spyware",
        "Palantir\u2019s PIT - Prometheus Intelligence Technology Damaging Spyware distribution, AI Man in the Middle Attacks",
        "Origin: https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "https://otx.alienvault.com/indicator/file/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/8550f80522c90177b58eecc3c31b8e82cfbc0a10283c888a45da497b2b5ddca5",
        "PE Version Information :  LegalCopyright: Copyright 2012 Spiritsoft All Rights Reserved. InternalName\tjingling.exe",
        "FileVersion: 2013.10.10.100 Company Name: \u7cbe\u7075\u8f6f\u4ef6 Comments: \u6d41\u91cf\u7cbe\u7075(1094) ProductName: \u6d41\u91cf\u7cbe\u7075",
        "Product Version: 4.0.3.1 File Description: \u6d41\u91cf\u7cbe\u7075 Original File name: jingling.exe",
        "023097.palantir.events \u2022 palantir.events \u2022 url3561.palantir.events",
        "13.32.178.127 \u2022 023097.palantir.events \u2022 palantir.events \u2022 Email admin@dnstinations.com",
        "www.palantir.events  \u2022 Email cirt@palantir.com \u2022 0055-b2b-nonprod-bigip1.palantir.events \u2022",
        "151-80-200-88.palantir.events \u2022 196-196-19-74.palantir.events",
        "http://www.net-chinese.com.tw \u2022 pixanalytics.com \u2022 pixnet.cc \u2022 pixnet.tv",
        "quecompegasune.tk \u2022 hipicapegaso.com",
        "This is part of a Prometheus Intelligence Technology (PIT) Palantir Attack",
        "Incredibly false information, white screens , pink screens and chat erasure",
        "Definitely requires further research",
        "Pegasus Indicators deleted during pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Malaysia"
      ],
      "malware_families": [
        {
          "id": "URLSpirit",
          "display_name": "URLSpirit",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1608.004",
          "name": "Drive-by Target",
          "display_name": "T1608.004 - Drive-by Target"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1428",
          "name": "Exploit Enterprise Resources",
          "display_name": "T1428 - Exploit Enterprise Resources"
        },
        {
          "id": "T1080",
          "name": "Taint Shared Content",
          "display_name": "T1080 - Taint Shared Content"
        }
      ],
      "industries": [
        "Technology",
        "Government",
        "Defense"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 406,
        "FileHash-SHA1": 391,
        "FileHash-SHA256": 5770,
        "URL": 7299,
        "domain": 1307,
        "email": 13,
        "hostname": 2162,
        "CVE": 3,
        "SSLCertFingerprint": 45
      },
      "indicator_count": 17396,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "53 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://hardstyledrops-001-site1.site4future.com/login",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://hardstyledrops-001-site1.site4future.com/login",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780347654.9346154
}