{
  "type": "URL",
  "indicator": "https://m.sgsck.top",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://m.sgsck.top",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3600608331,
      "indicator": "https://m.sgsck.top",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 13,
      "pulses": [
        {
          "id": "669e65444a9e7205d738ce5f",
          "name": "Trojan:Win32/Magania.DSK!MTB | IPV4 114.114.114.114 Attacking",
          "description": "Consistently found in multiple attacks against healthcare organizations, individuals and technology businesses. There are complaints that individuals photos from cameras were being sent to this IP. Known malicious IP.",
          "modified": "2024-08-21T11:03:59.106000",
          "created": "2024-07-22T13:57:24.444000",
          "tags": [
            "ipv4",
            "added active",
            "tulach",
            "as174 cogent",
            "china unknown",
            "china",
            "backdoor",
            "passive dns",
            "entries",
            "scan endpoints",
            "all scoreblue",
            "pulse pulses",
            "twitter",
            "refloadapihash",
            "urls",
            "runtime process",
            "localappdata",
            "sha256",
            "size",
            "sha1",
            "programfiles",
            "prefetch8",
            "prefetch1",
            "unicode text",
            "date",
            "hybrid",
            "click",
            "strings",
            "contact",
            "unicode",
            "rgba",
            "type data",
            "crlf line",
            "windir",
            "malicious",
            "general"
          ],
          "references": [
            "https://otx.alienvault.com/pulse/669e42fea462f0c8f8db32a1",
            "AbuseIPDB https://www.abuseipdb.com \u203a whois WHOIS 114.114.114.114 | Nanjing Xinfeng Information Technologies Inc. 114.114.114.114",
            "IP Address Information. ISP, Nanjing Xinfeng Information Technologies Inc. Usage Type, Data Center/Web Hosting/Transit. Hostname",
            "IPV4 114.114.114.114: Verdict Suspicious Reverse DNS public1.114dns.com Location China flag China ASN AS174 cogent communications",
            "Historical OTX telemetry IP mentioned on Twitter 11 domains resolved in last 7 days 21 domains resolved in last 30 days",
            "500+ domains resolved in all time 47 top-level domains | Exploited CVEs All Time: 2017-0144 2002-0013",
            "Antivirus Detections: !#SIGATTR:IEProxyChange , ALF:Backdoor:Win64/Meterpreter.AB!MTB , ALF:HeraklezEval:Trojan:Win32/AutoItDownloader.J!ibt",
            "Antivirus Detections: !ALF:PUA:Block:VrBrothers.R!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt ,  ALFPER:RefLoadApiHash ,",
            "Antivirus Detections: Backdoor:Linux/Dofloo.A!MTB ,  Backdoor:Linux/Gafgyt.AF!MTB ,  Backdoor:Win32/PcClient.ZR ,  Can't access file",
            "DYNAMIC_DNS Query to a *.ns1.name  Domain Query to a *.top domain - Likely Hostile Observed DNS Query to .work TLD Query for .cc TLD"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Magania.DSK!MTB",
              "display_name": "Trojan:Win32/Magania.DSK!MTB",
              "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [
            "Healthcare",
            "Technology",
            "Media"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 94,
            "URL": 336,
            "FileHash-SHA256": 159,
            "domain": 128,
            "hostname": 117,
            "FileHash-SHA1": 91
          },
          "indicator_count": 925,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "650 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657098ff4c59f8ac3f86f613",
          "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link",
          "description": "",
          "modified": "2023-12-06T15:53:35.032000",
          "created": "2023-12-06T15:53:35.032000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1168,
            "hostname": 1366,
            "domain": 412,
            "URL": 3576,
            "email": 2,
            "FileHash-MD5": 61,
            "FileHash-SHA1": 54
          },
          "indicator_count": 6639,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657098f7a0c84c2c55585e87",
          "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
          "description": "",
          "modified": "2023-12-06T15:53:27.118000",
          "created": "2023-12-06T15:53:27.118000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 279,
            "FileHash-SHA256": 1027,
            "hostname": 933,
            "URL": 2201,
            "FileHash-MD5": 56,
            "FileHash-SHA1": 51,
            "email": 2
          },
          "indicator_count": 4549,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657098f2c33d291538754bc7",
          "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
          "description": "",
          "modified": "2023-12-06T15:53:22.011000",
          "created": "2023-12-06T15:53:22.011000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 279,
            "FileHash-SHA256": 1027,
            "hostname": 933,
            "URL": 2201,
            "FileHash-MD5": 56,
            "FileHash-SHA1": 51,
            "email": 2
          },
          "indicator_count": 4549,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709510e5b078aa5f09ca51",
          "name": "widevinecdm.dll seemingly problematic - supply chain holy god mother of fu.k",
          "description": "",
          "modified": "2023-12-06T15:36:48.409000",
          "created": "2023-12-06T15:36:48.409000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1447,
            "FileHash-MD5": 199,
            "FileHash-SHA1": 197,
            "domain": 267,
            "hostname": 871,
            "URL": 1930,
            "email": 2
          },
          "indicator_count": 4913,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64261bcb2ab0c762de1f196d",
          "name": "FWBG|BRIT",
          "description": "Tickets for the Fort Worth Botanic Garden open to the public on Saturday, 3 December 2022 can now be purchased online for $28.00 (\u00c2\u00a318.50) and will be used for free on the day of the event.",
          "modified": "2023-04-30T00:06:00.439000",
          "created": "2023-03-30T23:31:23.838000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "runtime data",
            "ansi",
            "unicode",
            "localappdata",
            "temp",
            "hash seen",
            "size",
            "runtime process",
            "sha256",
            "sha1",
            "date",
            "hybrid",
            "suspicious",
            "close",
            "click",
            "hosts",
            "general",
            "strings",
            "qakbot",
            "all risk",
            "and danger",
            "incidental to",
            "event",
            "the management",
            "fees",
            "fort worth",
            "refunds or",
            "exchanges",
            "the exhibition"
          ],
          "references": [
            "Part RU .js - daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789",
            "https://14237.blackbaudhosting.com/14237/page.aspx?pid=219&soid=d1dcf3df-5ff2-481a-a362-1ccca0335ec4&theme=1ab45469-962b-4350-801e-b092a27c0f86",
            "https://hybrid-analysis.com/sample/23bbbdfa4fc5c6edd70eabff3e290ef044f1547c46844ffa1279f9870567949d/635027bac5962a2ef5103714"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 212,
            "hostname": 96,
            "domain": 32,
            "FileHash-SHA256": 103,
            "email": 3,
            "FileHash-MD5": 56,
            "FileHash-SHA1": 55
          },
          "indicator_count": 557,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "1129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6425a2f9c155fd53b9922bcd",
          "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link",
          "description": "hope peeps are gona learn from 3cx that false positives are in fact often not false",
          "modified": "2023-04-29T13:05:05.409000",
          "created": "2023-03-30T14:55:53.652000",
          "tags": [
            "trojan",
            "apt",
            "ansi",
            "dropped file",
            "runtime data",
            "chromeua",
            "optout",
            "programfiles",
            "typeof e",
            "localappdata",
            "error",
            "date",
            "generator",
            "path",
            "null",
            "void",
            "win64",
            "twitter",
            "this",
            "critical",
            "desktop",
            "dark",
            "light",
            "meta",
            "roboto",
            "span",
            "class",
            "template",
            "blink",
            "suspicious",
            "facebook",
            "mexico",
            "malicious",
            "mozilla",
            "strings",
            "qakbot",
            "://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9",
            "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661",
            "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 412,
            "FileHash-SHA256": 1168,
            "URL": 3576,
            "hostname": 1366,
            "email": 2,
            "FileHash-MD5": 61,
            "FileHash-SHA1": 54
          },
          "indicator_count": 6639,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "1129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "641e0e3da4fbafac633c0124",
          "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
          "description": "email confirmation link sent for blockchain wallet on iphone",
          "modified": "2023-04-23T19:00:53.967000",
          "created": "2023-03-24T20:55:25.579000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "chromeua",
            "dropped file",
            "ansi",
            "optout",
            "license",
            "runtime data",
            "drmedgeua",
            "localappdata",
            "edgeua",
            "optin",
            "error",
            "span",
            "template",
            "unknown",
            "class",
            "window",
            "legend",
            "mexico",
            "hybrid",
            "suspicious",
            "general",
            "malicious",
            "close",
            "click",
            "date",
            "hosts",
            "express",
            "strings",
            "format",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e",
            "Full URL from email",
            "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2201,
            "hostname": 933,
            "domain": 279,
            "FileHash-SHA256": 1027,
            "email": 2,
            "FileHash-MD5": 56,
            "FileHash-SHA1": 51
          },
          "indicator_count": 4549,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1135 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "641e0e41b1efe6e622d75902",
          "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
          "description": "email confirmation link sent for blockchain wallet on iphone",
          "modified": "2023-04-23T19:00:53.967000",
          "created": "2023-03-24T20:55:29.514000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "chromeua",
            "dropped file",
            "ansi",
            "optout",
            "license",
            "runtime data",
            "drmedgeua",
            "localappdata",
            "edgeua",
            "optin",
            "error",
            "span",
            "template",
            "unknown",
            "class",
            "window",
            "legend",
            "mexico",
            "hybrid",
            "suspicious",
            "general",
            "malicious",
            "close",
            "click",
            "date",
            "hosts",
            "express",
            "strings",
            "format",
            "qakbot"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e",
            "Full URL from email",
            "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2201,
            "hostname": 933,
            "domain": 279,
            "FileHash-SHA256": 1027,
            "email": 2,
            "FileHash-MD5": 56,
            "FileHash-SHA1": 51
          },
          "indicator_count": 4549,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "1135 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f0d59458c28085290bf985",
          "name": "http://time-osx.g.aaplimg.com/",
          "description": "Hybrid ambigious",
          "modified": "2023-03-20T13:02:37.822000",
          "created": "2023-02-18T13:41:39.996000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "runtime data",
            "ansi",
            "unicode",
            "programfiles",
            "localappdata",
            "hash seen",
            "size",
            "runtime process",
            "sha256",
            "prefetch8 ansi",
            "date",
            "hybrid",
            "close",
            "click",
            "hosts",
            "ransomware",
            "february",
            "general",
            "strings",
            "suspicious"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/14eb31210220475b60801afeae9b6979ecaf76e9fce07f41f05cb4c2d63a3b70/63f0231ad6cbe30d2e28363e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 190,
            "hostname": 103,
            "domain": 37,
            "FileHash-SHA256": 96,
            "email": 1,
            "FileHash-MD5": 52,
            "FileHash-SHA1": 52
          },
          "indicator_count": 531,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "1169 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f16b22454194575dc07bc1",
          "name": "http://vinyldataexpl.com",
          "description": "",
          "modified": "2023-03-20T00:01:17.081000",
          "created": "2023-02-19T00:19:46.649000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "runtime data",
            "ansi",
            "unicode",
            "programfiles",
            "localappdata",
            "hash seen",
            "size",
            "runtime process",
            "sha256",
            "prefetch8 ansi",
            "hybrid",
            "suspicious",
            "close",
            "click",
            "ransomware",
            "february",
            "general",
            "strings",
            "http://vinyldataexpl.com"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/02b576f6d418421a99423a42a2b739f25d93802d45fa874543dd54d3c634772e/63f0cc022fe25d3f831fb01b"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 201,
            "hostname": 75,
            "domain": 24,
            "FileHash-SHA256": 84,
            "FileHash-MD5": 50,
            "FileHash-SHA1": 50
          },
          "indicator_count": 484,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63994429139dc965346ecad6",
          "name": "think of it like supply chain but using consumer infrastructure instead of corp data",
          "description": "[object Object",
          "modified": "2023-01-13T00:01:55.237000",
          "created": "2022-12-14T03:34:01.804000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "runtime data",
            "ansi",
            "localappdata",
            "unicode",
            "hash seen",
            "size",
            "runtime process",
            "temp",
            "sha256",
            "sha1",
            "hybrid",
            "close",
            "click",
            "hosts",
            "ransomware",
            "general",
            "strings",
            "suspicious",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/5e5db92f90d6ccdd7dc1eca0c1a9cd6b54493e873d07c90f72da6478ac5f24cb",
            "https://hybrid-analysis.com/sample/5e5db92f90d6ccdd7dc1eca0c1a9cd6b54493e873d07c90f72da6478ac5f24cb/6398ed7852c7e131d0022430"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 576,
            "hostname": 282,
            "domain": 51,
            "FileHash-SHA256": 85,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 50,
            "email": 2
          },
          "indicator_count": 1097,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6398fe16df6290d8fcac2f77",
          "name": "widevinecdm.dll seemingly problematic - supply chain holy god mother of fu.k",
          "description": "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf",
          "modified": "2023-01-12T21:02:22.235000",
          "created": "2022-12-13T22:35:02.021000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "runtime data",
            "ansi",
            "threat level",
            "date",
            "sha256",
            "unicode",
            "size",
            "pcap",
            "pcap processing",
            "runtime process",
            "accept",
            "suspicious",
            "hybrid",
            "malicious",
            "close",
            "click",
            "hosts",
            "ransomware",
            "general",
            "local",
            "path",
            "mozilla",
            "strings",
            "localappdata",
            "temp",
            "prefetch8 ansi",
            "entropy",
            "win64",
            "disabled hash",
            "friendly",
            "mozi",
            "trident",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "file",
            "type data",
            "download file",
            "db695a96adb70d5f6246273f4e6c218b2c44f02b3726c3dee4d56b6428bb0ddf",
            "widevinecdm.dll",
            "https://hybrid-analysis.com/sample/db695a96adb70d5f6246273f4e6c2"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 871,
            "URL": 1930,
            "domain": 267,
            "FileHash-SHA256": 1447,
            "FileHash-MD5": 199,
            "FileHash-SHA1": 197,
            "email": 2
          },
          "indicator_count": 4913,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 397,
          "modified_text": "1236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://otx.alienvault.com/pulse/669e42fea462f0c8f8db32a1",
        "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'",
        "Historical OTX telemetry IP mentioned on Twitter 11 domains resolved in last 7 days 21 domains resolved in last 30 days",
        "IP Address Information. ISP, Nanjing Xinfeng Information Technologies Inc. Usage Type, Data Center/Web Hosting/Transit. Hostname",
        "Full URL from email",
        "https://hybrid-analysis.com/sample/5e5db92f90d6ccdd7dc1eca0c1a9cd6b54493e873d07c90f72da6478ac5f24cb",
        "https://14237.blackbaudhosting.com/14237/page.aspx?pid=219&soid=d1dcf3df-5ff2-481a-a362-1ccca0335ec4&theme=1ab45469-962b-4350-801e-b092a27c0f86",
        "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661",
        "AbuseIPDB https://www.abuseipdb.com \u203a whois WHOIS 114.114.114.114 | Nanjing Xinfeng Information Technologies Inc. 114.114.114.114",
        "https://hybrid-analysis.com/sample/14eb31210220475b60801afeae9b6979ecaf76e9fce07f41f05cb4c2d63a3b70/63f0231ad6cbe30d2e28363e",
        "Antivirus Detections: !ALF:PUA:Block:VrBrothers.R!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt ,  ALFPER:RefLoadApiHash ,",
        "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k",
        "Antivirus Detections: Backdoor:Linux/Dofloo.A!MTB ,  Backdoor:Linux/Gafgyt.AF!MTB ,  Backdoor:Win32/PcClient.ZR ,  Can't access file",
        "IPV4 114.114.114.114: Verdict Suspicious Reverse DNS public1.114dns.com Location China flag China ASN AS174 cogent communications",
        "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9",
        "https://hybrid-analysis.com/sample/02b576f6d418421a99423a42a2b739f25d93802d45fa874543dd54d3c634772e/63f0cc022fe25d3f831fb01b",
        "Antivirus Detections: !#SIGATTR:IEProxyChange , ALF:Backdoor:Win64/Meterpreter.AB!MTB , ALF:HeraklezEval:Trojan:Win32/AutoItDownloader.J!ibt",
        "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e",
        "https://hybrid-analysis.com/sample/5e5db92f90d6ccdd7dc1eca0c1a9cd6b54493e873d07c90f72da6478ac5f24cb/6398ed7852c7e131d0022430",
        "500+ domains resolved in all time 47 top-level domains | Exploited CVEs All Time: 2017-0144 2002-0013",
        "Part RU .js - daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789",
        "DYNAMIC_DNS Query to a *.ns1.name  Domain Query to a *.top domain - Likely Hostile Observed DNS Query to .work TLD Query for .cc TLD",
        "https://hybrid-analysis.com/sample/23bbbdfa4fc5c6edd70eabff3e290ef044f1547c46844ffa1279f9870567949d/635027bac5962a2ef5103714"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan:win32/magania.dsk!mtb"
          ],
          "industries": [
            "Healthcare",
            "Technology",
            "Media"
          ],
          "unique_indicators": 15331
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/sgsck.top",
    "whois": "http://whois.domaintools.com/sgsck.top",
    "domain": "sgsck.top",
    "hostname": "m.sgsck.top"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 13,
  "pulses": [
    {
      "id": "669e65444a9e7205d738ce5f",
      "name": "Trojan:Win32/Magania.DSK!MTB | IPV4 114.114.114.114 Attacking",
      "description": "Consistently found in multiple attacks against healthcare organizations, individuals and technology businesses. There are complaints that individuals photos from cameras were being sent to this IP. Known malicious IP.",
      "modified": "2024-08-21T11:03:59.106000",
      "created": "2024-07-22T13:57:24.444000",
      "tags": [
        "ipv4",
        "added active",
        "tulach",
        "as174 cogent",
        "china unknown",
        "china",
        "backdoor",
        "passive dns",
        "entries",
        "scan endpoints",
        "all scoreblue",
        "pulse pulses",
        "twitter",
        "refloadapihash",
        "urls",
        "runtime process",
        "localappdata",
        "sha256",
        "size",
        "sha1",
        "programfiles",
        "prefetch8",
        "prefetch1",
        "unicode text",
        "date",
        "hybrid",
        "click",
        "strings",
        "contact",
        "unicode",
        "rgba",
        "type data",
        "crlf line",
        "windir",
        "malicious",
        "general"
      ],
      "references": [
        "https://otx.alienvault.com/pulse/669e42fea462f0c8f8db32a1",
        "AbuseIPDB https://www.abuseipdb.com \u203a whois WHOIS 114.114.114.114 | Nanjing Xinfeng Information Technologies Inc. 114.114.114.114",
        "IP Address Information. ISP, Nanjing Xinfeng Information Technologies Inc. Usage Type, Data Center/Web Hosting/Transit. Hostname",
        "IPV4 114.114.114.114: Verdict Suspicious Reverse DNS public1.114dns.com Location China flag China ASN AS174 cogent communications",
        "Historical OTX telemetry IP mentioned on Twitter 11 domains resolved in last 7 days 21 domains resolved in last 30 days",
        "500+ domains resolved in all time 47 top-level domains | Exploited CVEs All Time: 2017-0144 2002-0013",
        "Antivirus Detections: !#SIGATTR:IEProxyChange , ALF:Backdoor:Win64/Meterpreter.AB!MTB , ALF:HeraklezEval:Trojan:Win32/AutoItDownloader.J!ibt",
        "Antivirus Detections: !ALF:PUA:Block:VrBrothers.R!MTB ,  ALF:Trojan:Win32/Cassini_6d4ebdc9!ibt ,  ALFPER:RefLoadApiHash ,",
        "Antivirus Detections: Backdoor:Linux/Dofloo.A!MTB ,  Backdoor:Linux/Gafgyt.AF!MTB ,  Backdoor:Win32/PcClient.ZR ,  Can't access file",
        "DYNAMIC_DNS Query to a *.ns1.name  Domain Query to a *.top domain - Likely Hostile Observed DNS Query to .work TLD Query for .cc TLD"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Magania.DSK!MTB",
          "display_name": "Trojan:Win32/Magania.DSK!MTB",
          "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [
        "Healthcare",
        "Technology",
        "Media"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 94,
        "URL": 336,
        "FileHash-SHA256": 159,
        "domain": 128,
        "hostname": 117,
        "FileHash-SHA1": 91
      },
      "indicator_count": 925,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "650 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657098ff4c59f8ac3f86f613",
      "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link",
      "description": "",
      "modified": "2023-12-06T15:53:35.032000",
      "created": "2023-12-06T15:53:35.032000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1168,
        "hostname": 1366,
        "domain": 412,
        "URL": 3576,
        "email": 2,
        "FileHash-MD5": 61,
        "FileHash-SHA1": 54
      },
      "indicator_count": 6639,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657098f7a0c84c2c55585e87",
      "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
      "description": "",
      "modified": "2023-12-06T15:53:27.118000",
      "created": "2023-12-06T15:53:27.118000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 279,
        "FileHash-SHA256": 1027,
        "hostname": 933,
        "URL": 2201,
        "FileHash-MD5": 56,
        "FileHash-SHA1": 51,
        "email": 2
      },
      "indicator_count": 4549,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657098f2c33d291538754bc7",
      "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
      "description": "",
      "modified": "2023-12-06T15:53:22.011000",
      "created": "2023-12-06T15:53:22.011000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 279,
        "FileHash-SHA256": 1027,
        "hostname": 933,
        "URL": 2201,
        "FileHash-MD5": 56,
        "FileHash-SHA1": 51,
        "email": 2
      },
      "indicator_count": 4549,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709510e5b078aa5f09ca51",
      "name": "widevinecdm.dll seemingly problematic - supply chain holy god mother of fu.k",
      "description": "",
      "modified": "2023-12-06T15:36:48.409000",
      "created": "2023-12-06T15:36:48.409000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1447,
        "FileHash-MD5": 199,
        "FileHash-SHA1": 197,
        "domain": 267,
        "hostname": 871,
        "URL": 1930,
        "email": 2
      },
      "indicator_count": 4913,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64261bcb2ab0c762de1f196d",
      "name": "FWBG|BRIT",
      "description": "Tickets for the Fort Worth Botanic Garden open to the public on Saturday, 3 December 2022 can now be purchased online for $28.00 (\u00c2\u00a318.50) and will be used for free on the day of the event.",
      "modified": "2023-04-30T00:06:00.439000",
      "created": "2023-03-30T23:31:23.838000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "runtime data",
        "ansi",
        "unicode",
        "localappdata",
        "temp",
        "hash seen",
        "size",
        "runtime process",
        "sha256",
        "sha1",
        "date",
        "hybrid",
        "suspicious",
        "close",
        "click",
        "hosts",
        "general",
        "strings",
        "qakbot",
        "all risk",
        "and danger",
        "incidental to",
        "event",
        "the management",
        "fees",
        "fort worth",
        "refunds or",
        "exchanges",
        "the exhibition"
      ],
      "references": [
        "Part RU .js - daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789",
        "https://14237.blackbaudhosting.com/14237/page.aspx?pid=219&soid=d1dcf3df-5ff2-481a-a362-1ccca0335ec4&theme=1ab45469-962b-4350-801e-b092a27c0f86",
        "https://hybrid-analysis.com/sample/23bbbdfa4fc5c6edd70eabff3e290ef044f1547c46844ffa1279f9870567949d/635027bac5962a2ef5103714"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 212,
        "hostname": 96,
        "domain": 32,
        "FileHash-SHA256": 103,
        "email": 3,
        "FileHash-MD5": 56,
        "FileHash-SHA1": 55
      },
      "indicator_count": 557,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "1129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6425a2f9c155fd53b9922bcd",
      "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link",
      "description": "hope peeps are gona learn from 3cx that false positives are in fact often not false",
      "modified": "2023-04-29T13:05:05.409000",
      "created": "2023-03-30T14:55:53.652000",
      "tags": [
        "trojan",
        "apt",
        "ansi",
        "dropped file",
        "runtime data",
        "chromeua",
        "optout",
        "programfiles",
        "typeof e",
        "localappdata",
        "error",
        "date",
        "generator",
        "path",
        "null",
        "void",
        "win64",
        "twitter",
        "this",
        "critical",
        "desktop",
        "dark",
        "light",
        "meta",
        "roboto",
        "span",
        "class",
        "template",
        "blink",
        "suspicious",
        "facebook",
        "mexico",
        "malicious",
        "mozilla",
        "strings",
        "qakbot",
        "://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9",
        "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661",
        "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 412,
        "FileHash-SHA256": 1168,
        "URL": 3576,
        "hostname": 1366,
        "email": 2,
        "FileHash-MD5": 61,
        "FileHash-SHA1": 54
      },
      "indicator_count": 6639,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "1129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "641e0e3da4fbafac633c0124",
      "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
      "description": "email confirmation link sent for blockchain wallet on iphone",
      "modified": "2023-04-23T19:00:53.967000",
      "created": "2023-03-24T20:55:25.579000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "chromeua",
        "dropped file",
        "ansi",
        "optout",
        "license",
        "runtime data",
        "drmedgeua",
        "localappdata",
        "edgeua",
        "optin",
        "error",
        "span",
        "template",
        "unknown",
        "class",
        "window",
        "legend",
        "mexico",
        "hybrid",
        "suspicious",
        "general",
        "malicious",
        "close",
        "click",
        "date",
        "hosts",
        "express",
        "strings",
        "format",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e",
        "Full URL from email",
        "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2201,
        "hostname": 933,
        "domain": 279,
        "FileHash-SHA256": 1027,
        "email": 2,
        "FileHash-MD5": 56,
        "FileHash-SHA1": 51
      },
      "indicator_count": 4549,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1135 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "641e0e41b1efe6e622d75902",
      "name": "https://login.blockchain.com/?#%2Fverify-email                                        ->",
      "description": "email confirmation link sent for blockchain wallet on iphone",
      "modified": "2023-04-23T19:00:53.967000",
      "created": "2023-03-24T20:55:29.514000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "chromeua",
        "dropped file",
        "ansi",
        "optout",
        "license",
        "runtime data",
        "drmedgeua",
        "localappdata",
        "edgeua",
        "optin",
        "error",
        "span",
        "template",
        "unknown",
        "class",
        "window",
        "legend",
        "mexico",
        "hybrid",
        "suspicious",
        "general",
        "malicious",
        "close",
        "click",
        "date",
        "hosts",
        "express",
        "strings",
        "format",
        "qakbot"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/b324856ed3acdd48a6d7583e9ae0f36a110c28e6b1b185c231129dd4f88049af/640f60d8e122e6ac3a0f1d7e",
        "Full URL from email",
        "https://login.blockchain.com/?#%2Fverify-email%2FLIhC1RPA4qIlUzBPvep8xn5FkBPW4XQlsbo7MBIxQcqfNxPUykgf2GINwzEeUKYkJMV6FJbewOlqaND96%2BR7de%2Bja2BIbLW6E6ZF2zbr05wOyVqAHx7gtq6Y4bhqFinCB3PIOH%2BlVxnfVwrzIbISyMnp7mdw%2FQU5LKoGTTnPq4v1W1uPN7iQcBlIhnNQ6QwO%3Fcontext%3DSETTINGS'"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2201,
        "hostname": 933,
        "domain": 279,
        "FileHash-SHA256": 1027,
        "email": 2,
        "FileHash-MD5": 56,
        "FileHash-SHA1": 51
      },
      "indicator_count": 4549,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "1135 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "63f0d59458c28085290bf985",
      "name": "http://time-osx.g.aaplimg.com/",
      "description": "Hybrid ambigious",
      "modified": "2023-03-20T13:02:37.822000",
      "created": "2023-02-18T13:41:39.996000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "runtime data",
        "ansi",
        "unicode",
        "programfiles",
        "localappdata",
        "hash seen",
        "size",
        "runtime process",
        "sha256",
        "prefetch8 ansi",
        "date",
        "hybrid",
        "close",
        "click",
        "hosts",
        "ransomware",
        "february",
        "general",
        "strings",
        "suspicious"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/14eb31210220475b60801afeae9b6979ecaf76e9fce07f41f05cb4c2d63a3b70/63f0231ad6cbe30d2e28363e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 190,
        "hostname": 103,
        "domain": 37,
        "FileHash-SHA256": 96,
        "email": 1,
        "FileHash-MD5": 52,
        "FileHash-SHA1": 52
      },
      "indicator_count": 531,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "1169 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://m.sgsck.top",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://m.sgsck.top",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780398738.9347668
}