{
  "type": "URL",
  "indicator": "https://js.msedgeupdate.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://js.msedgeupdate.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3777724576,
      "indicator": "https://js.msedgeupdate.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 14,
      "pulses": [
        {
          "id": "66994bda3e150656cd5ac9dd",
          "name": "Browser Session Hijacking Various MyChart Phishing Scams",
          "description": "Ongoing issues with medical information hijacking. Various medical corporations affected. Tracking, medical, injection process, records retrieval, botnets.",
          "modified": "2024-08-17T16:01:11.866000",
          "created": "2024-07-18T17:07:38.719000",
          "tags": [
            "historical ssl",
            "referrer",
            "domains",
            "august",
            "phishingscams",
            "domains part",
            "domain tracker",
            "roundup",
            "new problems",
            "privacy badger",
            "startpage",
            "self",
            "httponly",
            "samesitenone",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "pragma",
            "mychartlocale",
            "urls",
            "ip detections",
            "country",
            "contacted",
            "files",
            "file type",
            "name file",
            "gmbh",
            "cloudflare",
            "tucows",
            "ii llc",
            "alibaba cloud",
            "computing",
            "sample",
            "media t1091",
            "t1497 may",
            "mitre att",
            "access ta0001",
            "replication",
            "ta0004 process",
            "injection t1055",
            "defense evasion",
            "http requests",
            "get http",
            "request",
            "host",
            "dns resolutions",
            "ip traffic",
            "hashes",
            "tsara brashears",
            "red team",
            "hackers",
            "highly targeted",
            "critical risk",
            "cyberstalking",
            "apple",
            "apple ios",
            "logistics",
            "cyber defense",
            "guloader",
            "hacktool",
            "emotet",
            "phishing",
            "facebook",
            "malware",
            "hiddentear",
            "maze",
            "server",
            "domain status",
            "date",
            "algorithm",
            "google llc",
            "registrar abuse",
            "registrar",
            "record type",
            "ttl value",
            "aaaa",
            "whois lookup",
            "admin country",
            "ca creation",
            "dnssec",
            "markmonitor",
            "siblings",
            "whois lookups",
            "expiration date",
            "registrar iana",
            "creation date",
            "first",
            "united",
            "as15169 google",
            "cname",
            "status",
            "virtool",
            "cryp",
            "as396982 google",
            "search",
            "name servers",
            "win32",
            "remote"
          ],
          "references": [
            "MyChart Phishing Scams",
            "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82",
            "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win64-Trojan/Pakes.Exp",
              "display_name": "Win64-Trojan/Pakes.Exp",
              "target": null
            },
            {
              "id": "Win64:RansomX-gen",
              "display_name": "Win64:RansomX-gen",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 37,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 3473,
            "domain": 693,
            "URL": 4384,
            "hostname": 1610,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10235,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "610 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b7119615db47ea27706a86",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-04-12T23:03:13.367000",
          "created": "2024-01-29T02:46:46.076000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9102,
            "CVE": 5,
            "FileHash-MD5": 68,
            "FileHash-SHA1": 67,
            "FileHash-SHA256": 2209,
            "domain": 1427,
            "hostname": 4334
          },
          "indicator_count": 17212,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "736 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65de941acedcdd661f0593b6",
          "name": "Esurance Remote Attacks (Cloned. Who modifies reports? This happens to me)",
          "description": "",
          "modified": "2024-02-28T02:02:02.807000",
          "created": "2024-02-28T02:02:02.807000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": "65b711a6f49f057c311f2642",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "781 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b7119e9272b1426729e1ed",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T02:46:54.594000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b711a6f49f057c311f2642",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T02:47:02.117000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80763e9d9e18cf87d985b",
          "name": "Esurance Remote Attacks| Emotet | Lolkek | Part I",
          "description": "",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T20:15:31.163000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": "65b711a6f49f057c311f2642",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6580d422fb57aab8e21c1f39",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password",
          "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-18T23:22:10.482000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6581d83bfd115be1f92d75a9",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
          "description": "",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-19T17:51:55.338000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6580d422fb57aab8e21c1f39",
          "export_count": 36,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6581d83e20634ac0d58ceca9",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
          "description": "",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-19T17:51:58.995000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6580d422fb57aab8e21c1f39",
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136b5eb9bdd21070ff9d7",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:17:41.263000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 70,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136c1ac991f85328604d2",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:17:52.382000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 69,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654136c8e530066ae793dc64",
          "name": "Cyber Espionage",
          "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:18:00.623000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "tsara brashears",
            "adult content",
            "pornography",
            "malvertizing",
            "privacy invasion",
            "privilege escalation",
            "packed",
            "aig.com",
            "aig.rastreator.mx",
            "apple",
            "ios",
            "tracking",
            "monitoring",
            "nr-data.net",
            "asp.net"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            }
          ],
          "industries": [
            "Defense",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 69,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5806,
            "URL": 16475,
            "domain": 3302,
            "hostname": 5135,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 31033,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65413ea960cc79abf6d446fb",
          "name": "Vawtrak credential stealer | CNC",
          "description": "Cyber warfare\nTracking\nMonitoring\nMalvertizing\nCNC\nKeylogging\nBotNet\nSever Privacy Invasion",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-10-31T17:51:37.016000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "keylogger",
            "sample path",
            "Miles IT"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5688,
            "URL": 15015,
            "domain": 3262,
            "hostname": 4687,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 28967,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6545be6e02e0f9f82cb1febf",
          "name": "Vawtrak credential stealer | CNC",
          "description": "",
          "modified": "2023-11-30T07:01:37.424000",
          "created": "2023-11-04T03:45:50.234000",
          "tags": [
            "contacted",
            "resolutions",
            "origin1",
            "ip address",
            "list",
            "communicating",
            "cyber threat",
            "united",
            "phishing",
            "phishing site",
            "covid19",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "detection list",
            "installcore",
            "nymaim",
            "suppobox",
            "malicious",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware",
            "malware site",
            "malicious site",
            "heur",
            "exploit",
            "alexa",
            "riskware",
            "team",
            "blacklist https",
            "blacklist",
            "facebook",
            "engineering",
            "iframe",
            "downloader",
            "unsafe",
            "artemis",
            "trojanx",
            "agent",
            "unruy",
            "win64",
            "fakealert",
            "fusioncore",
            "redirector",
            "killav",
            "trojan",
            "lokibot",
            "emotet",
            "redline stealer",
            "cobalt strike",
            "citadel",
            "vawtrak",
            "qakbot",
            "qbot",
            "bankerx",
            "dropper",
            "nimda",
            "formbook",
            "swrort",
            "adwind",
            "crack",
            "generic",
            "wacatac",
            "opencandy",
            "nircmd",
            "downldr",
            "filetour",
            "cleaner",
            "conduit",
            "tiggre",
            "presenoker",
            "zpevdo",
            "webcompanion",
            "seraph",
            "tofsee",
            "xrat",
            "xtrat",
            "patcher",
            "adload",
            "stealer",
            "vidar",
            "raccoon",
            "bank",
            "urls",
            "generic malware",
            "noname057",
            "reimer",
            "agency",
            "charles",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "name verdict",
            "date",
            "root ca",
            "markmonitor",
            "name server",
            "windir",
            "unknown",
            "swisscom root",
            "post root",
            "trust",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "defence",
            "fraud",
            "logistics",
            "ipv4",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "report spam",
            "author",
            "cyber warfare",
            "created",
            "months ago",
            "modified",
            "next",
            "url https",
            "url http",
            "all octoseek",
            "month ago",
            "utmsourcemailer",
            "ck id",
            "t1140",
            "filehashsha256",
            "keylogger",
            "sample path",
            "Miles IT"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65413ea960cc79abf6d446fb",
          "export_count": 86,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 166,
            "FileHash-SHA1": 125,
            "FileHash-SHA256": 5688,
            "URL": 15015,
            "domain": 3262,
            "hostname": 4687,
            "CVE": 16,
            "email": 8
          },
          "indicator_count": 28967,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "871 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "api.anonfiles.com",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "https://www.malwarebytes.com/emotet",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "discord.com",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community",
        "qbittorrent.exe",
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "MyChart Phishing Scams",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "DNS Query for Anonfiles.com Domain",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "EaZy Client.exe",
        "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
        "https://www.esurance.com/",
        "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Witchetty APT Group"
          ],
          "malware_families": [
            "Lolkek",
            "Witchetty",
            "Lokbit",
            "Blueshell",
            "Win64:ransomx-gen",
            "Mac.malware",
            "Win64-trojan/pakes.exp",
            "Emotet",
            "Trojan.msil/stealer"
          ],
          "industries": [
            "Technology",
            "Insurance",
            "Government",
            "Telecom",
            "Healthcare",
            "Defense",
            "Civil society"
          ],
          "unique_indicators": 63549
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/msedgeupdate.com",
    "whois": "http://whois.domaintools.com/msedgeupdate.com",
    "domain": "msedgeupdate.com",
    "hostname": "js.msedgeupdate.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 14,
  "pulses": [
    {
      "id": "66994bda3e150656cd5ac9dd",
      "name": "Browser Session Hijacking Various MyChart Phishing Scams",
      "description": "Ongoing issues with medical information hijacking. Various medical corporations affected. Tracking, medical, injection process, records retrieval, botnets.",
      "modified": "2024-08-17T16:01:11.866000",
      "created": "2024-07-18T17:07:38.719000",
      "tags": [
        "historical ssl",
        "referrer",
        "domains",
        "august",
        "phishingscams",
        "domains part",
        "domain tracker",
        "roundup",
        "new problems",
        "privacy badger",
        "startpage",
        "self",
        "httponly",
        "samesitenone",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "pragma",
        "mychartlocale",
        "urls",
        "ip detections",
        "country",
        "contacted",
        "files",
        "file type",
        "name file",
        "gmbh",
        "cloudflare",
        "tucows",
        "ii llc",
        "alibaba cloud",
        "computing",
        "sample",
        "media t1091",
        "t1497 may",
        "mitre att",
        "access ta0001",
        "replication",
        "ta0004 process",
        "injection t1055",
        "defense evasion",
        "http requests",
        "get http",
        "request",
        "host",
        "dns resolutions",
        "ip traffic",
        "hashes",
        "tsara brashears",
        "red team",
        "hackers",
        "highly targeted",
        "critical risk",
        "cyberstalking",
        "apple",
        "apple ios",
        "logistics",
        "cyber defense",
        "guloader",
        "hacktool",
        "emotet",
        "phishing",
        "facebook",
        "malware",
        "hiddentear",
        "maze",
        "server",
        "domain status",
        "date",
        "algorithm",
        "google llc",
        "registrar abuse",
        "registrar",
        "record type",
        "ttl value",
        "aaaa",
        "whois lookup",
        "admin country",
        "ca creation",
        "dnssec",
        "markmonitor",
        "siblings",
        "whois lookups",
        "expiration date",
        "registrar iana",
        "creation date",
        "first",
        "united",
        "as15169 google",
        "cname",
        "status",
        "virtool",
        "cryp",
        "as396982 google",
        "search",
        "name servers",
        "win32",
        "remote"
      ],
      "references": [
        "MyChart Phishing Scams",
        "exploit_source IP's: 20.99.186.246 , 40.126.24.147 , 40.126.24.149 , 40.126.24.81 , 40.126.24.82",
        "VirTool:Win32/Obfuscator: 0.googleusercontent.com [hacking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttp://45.159.189.105/bot/regex |\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win64-Trojan/Pakes.Exp",
          "display_name": "Win64-Trojan/Pakes.Exp",
          "target": null
        },
        {
          "id": "Win64:RansomX-gen",
          "display_name": "Win64:RansomX-gen",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 37,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 3473,
        "domain": 693,
        "URL": 4384,
        "hostname": 1610,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10235,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "610 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b7119615db47ea27706a86",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-04-12T23:03:13.367000",
      "created": "2024-01-29T02:46:46.076000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9102,
        "CVE": 5,
        "FileHash-MD5": 68,
        "FileHash-SHA1": 67,
        "FileHash-SHA256": 2209,
        "domain": 1427,
        "hostname": 4334
      },
      "indicator_count": 17212,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "736 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65de941acedcdd661f0593b6",
      "name": "Esurance Remote Attacks (Cloned. Who modifies reports? This happens to me)",
      "description": "",
      "modified": "2024-02-28T02:02:02.807000",
      "created": "2024-02-28T02:02:02.807000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": "65b711a6f49f057c311f2642",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "781 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b7119e9272b1426729e1ed",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T02:46:54.594000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b711a6f49f057c311f2642",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T02:47:02.117000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80763e9d9e18cf87d985b",
      "name": "Esurance Remote Attacks| Emotet | Lolkek | Part I",
      "description": "",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T20:15:31.163000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": "65b711a6f49f057c311f2642",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6580d422fb57aab8e21c1f39",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password",
      "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-18T23:22:10.482000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6581d83bfd115be1f92d75a9",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
      "description": "",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-19T17:51:55.338000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6580d422fb57aab8e21c1f39",
      "export_count": 36,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6581d83e20634ac0d58ceca9",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
      "description": "",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-19T17:51:58.995000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6580d422fb57aab8e21c1f39",
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654136b5eb9bdd21070ff9d7",
      "name": "Cyber Espionage",
      "description": "Cyber warfare. Extravagant attack that includes, phishing, monitoring, spyware, tracking, remote vehicle tracking, API calls after identification of anything computerized; car, phone, mobile phone, mail, ups, television. Apple private data services nr-data.net. This may be a Honeypot. Interesting. Attacker alleging to be a  government contractor actively attacks and porn smears alleged SA victim assaulted by someone with his last name. Coincidence or Honeypot?\nTarget still at risk.\nTarget again is Tsara Brashears. \nSevere privacy invasion.\nShhhh....Active Silencing",
      "modified": "2023-11-30T07:01:37.424000",
      "created": "2023-10-31T17:17:41.263000",
      "tags": [
        "contacted",
        "resolutions",
        "origin1",
        "ip address",
        "list",
        "communicating",
        "cyber threat",
        "united",
        "phishing",
        "phishing site",
        "covid19",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "detection list",
        "installcore",
        "nymaim",
        "suppobox",
        "malicious",
        "cisco umbrella",
        "site",
        "alexa top",
        "million",
        "safe site",
        "malware",
        "malware site",
        "malicious site",
        "heur",
        "exploit",
        "alexa",
        "riskware",
        "team",
        "blacklist https",
        "blacklist",
        "facebook",
        "engineering",
        "iframe",
        "downloader",
        "unsafe",
        "artemis",
        "trojanx",
        "agent",
        "unruy",
        "win64",
        "fakealert",
        "fusioncore",
        "redirector",
        "killav",
        "trojan",
        "lokibot",
        "emotet",
        "redline stealer",
        "cobalt strike",
        "citadel",
        "vawtrak",
        "qakbot",
        "qbot",
        "bankerx",
        "dropper",
        "nimda",
        "formbook",
        "swrort",
        "adwind",
        "crack",
        "generic",
        "wacatac",
        "opencandy",
        "nircmd",
        "downldr",
        "filetour",
        "cleaner",
        "conduit",
        "tiggre",
        "presenoker",
        "zpevdo",
        "webcompanion",
        "seraph",
        "tofsee",
        "xrat",
        "xtrat",
        "patcher",
        "adload",
        "stealer",
        "vidar",
        "raccoon",
        "bank",
        "urls",
        "generic malware",
        "noname057",
        "reimer",
        "agency",
        "charles",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "name verdict",
        "date",
        "root ca",
        "markmonitor",
        "name server",
        "windir",
        "unknown",
        "swisscom root",
        "post root",
        "trust",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "defence",
        "fraud",
        "logistics",
        "ipv4",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "report spam",
        "author",
        "cyber warfare",
        "created",
        "months ago",
        "modified",
        "next",
        "url https",
        "url http",
        "all octoseek",
        "month ago",
        "utmsourcemailer",
        "ck id",
        "t1140",
        "filehashsha256",
        "tsara brashears",
        "adult content",
        "pornography",
        "malvertizing",
        "privacy invasion",
        "privilege escalation",
        "packed",
        "aig.com",
        "aig.rastreator.mx",
        "apple",
        "ios",
        "tracking",
        "monitoring",
        "nr-data.net",
        "asp.net"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        }
      ],
      "industries": [
        "Defense",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 70,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 166,
        "FileHash-SHA1": 125,
        "FileHash-SHA256": 5806,
        "URL": 16475,
        "domain": 3302,
        "hostname": 5135,
        "CVE": 16,
        "email": 8
      },
      "indicator_count": 31033,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "871 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://js.msedgeupdate.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://js.msedgeupdate.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629934.7858076
}