{
  "type": "URL",
  "indicator": "https://l75117fe.justinstalledpanel.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://l75117fe.justinstalledpanel.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4081248033,
      "indicator": "https://l75117fe.justinstalledpanel.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "68632c19dd335ce48dbc3798",
          "name": "Apple Zombie- Multi Malware/ Ransom attack affects Upscale Networks | Devices",
          "description": "Apple IoC\u2019s Isolated from Lifestyle Community\n\u2022 Win.Packer.pkr_ce1a-9980177-0\n\u2022 Antivirus Detections\nWin.Dropper.Zombie-10044469-0\n, \nTrojan:Win32/Zombie.A |\nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 anomalous_deletefile\n#remote #device #dns #dead_host #pointers\n#active #targeting #ops #more\u2026",
          "modified": "2025-07-31T00:00:48.083000",
          "created": "2025-07-01T00:30:17.324000",
          "tags": [
            "dynamicloader",
            "vx10",
            "nxd2xebwx87",
            "wx10",
            "mxd78x8b",
            "port",
            "x0cqpyx0c",
            "delete c",
            "yara rule",
            "high",
            "tofsee",
            "grum",
            "copy",
            "stream",
            "powershell",
            "write",
            "malware",
            "push",
            "united",
            "name servers",
            "search",
            "creation date",
            "servers",
            "moved",
            "passive dns",
            "urls",
            "domain",
            "record value",
            "date",
            "body",
            "users",
            "intel",
            "ms windows",
            "pe32",
            "number",
            "pe32 executable",
            "ascii text",
            "crlf line",
            "database",
            "installer",
            "template",
            "trojan"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 202,
            "hostname": 217,
            "FileHash-SHA256": 852,
            "FileHash-MD5": 238,
            "FileHash-SHA1": 164,
            "SSLCertFingerprint": 3,
            "URL": 947,
            "email": 3
          },
          "indicator_count": 2626,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "263 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 2662
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/justinstalledpanel.com",
    "whois": "http://whois.domaintools.com/justinstalledpanel.com",
    "domain": "justinstalledpanel.com",
    "hostname": "l75117fe.justinstalledpanel.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "68632c19dd335ce48dbc3798",
      "name": "Apple Zombie- Multi Malware/ Ransom attack affects Upscale Networks | Devices",
      "description": "Apple IoC\u2019s Isolated from Lifestyle Community\n\u2022 Win.Packer.pkr_ce1a-9980177-0\n\u2022 Antivirus Detections\nWin.Dropper.Zombie-10044469-0\n, \nTrojan:Win32/Zombie.A |\nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 anomalous_deletefile\n#remote #device #dns #dead_host #pointers\n#active #targeting #ops #more\u2026",
      "modified": "2025-07-31T00:00:48.083000",
      "created": "2025-07-01T00:30:17.324000",
      "tags": [
        "dynamicloader",
        "vx10",
        "nxd2xebwx87",
        "wx10",
        "mxd78x8b",
        "port",
        "x0cqpyx0c",
        "delete c",
        "yara rule",
        "high",
        "tofsee",
        "grum",
        "copy",
        "stream",
        "powershell",
        "write",
        "malware",
        "push",
        "united",
        "name servers",
        "search",
        "creation date",
        "servers",
        "moved",
        "passive dns",
        "urls",
        "domain",
        "record value",
        "date",
        "body",
        "users",
        "intel",
        "ms windows",
        "pe32",
        "number",
        "pe32 executable",
        "ascii text",
        "crlf line",
        "database",
        "installer",
        "template",
        "trojan"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 202,
        "hostname": 217,
        "FileHash-SHA256": 852,
        "FileHash-MD5": 238,
        "FileHash-SHA1": 164,
        "SSLCertFingerprint": 3,
        "URL": 947,
        "email": 3
      },
      "indicator_count": 2626,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "263 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://l75117fe.justinstalledpanel.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://l75117fe.justinstalledpanel.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776723789.0305057
}