{
  "type": "URL",
  "indicator": "https://mail.helioverse.top",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mail.helioverse.top",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3819187672,
      "indicator": "https://mail.helioverse.top",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "65aab954f5f03a1f2906b39c",
          "name": "Zerobot",
          "description": "",
          "modified": "2024-10-12T07:01:26.973000",
          "created": "2024-01-19T18:03:00.966000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65aa168aeddea4851fc47cc3",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 123,
            "FileHash-SHA1": 123,
            "FileHash-SHA256": 2498,
            "domain": 1600,
            "hostname": 2749,
            "URL": 6303,
            "CVE": 1
          },
          "indicator_count": 13397,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "554 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aa168aeddea4851fc47cc3",
          "name": "Zerobot & Skynet",
          "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
          "modified": "2024-03-23T01:01:38.014000",
          "created": "2024-01-19T06:28:26.343000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 78,
            "FileHash-SHA1": 78,
            "FileHash-SHA256": 2290,
            "domain": 1491,
            "hostname": 2611,
            "URL": 5879,
            "CVE": 8
          },
          "indicator_count": 12435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "757 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e576b3cbdf2f86a32acc",
          "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
          "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
          "modified": "2024-02-16T13:04:46.804000",
          "created": "2024-01-17T14:34:30.204000",
          "tags": [
            "whois record",
            "historical ssl",
            "ssl certificate",
            "april",
            "referrer",
            "threat roundup",
            "communicating",
            "whois",
            "rwi dtools",
            "jekyll",
            "metro",
            "skynet",
            "identity theft",
            "parking crew",
            "whois whois",
            "resolutions",
            "october",
            "august",
            "march",
            "june",
            "attack",
            "goldfinder",
            "sibot",
            "hacktool",
            "remote attack",
            "social engineering",
            "read c",
            "get autoit",
            "search",
            "regsetvalueexa",
            "show",
            "entries",
            "regdword",
            "intel",
            "ms windows",
            "showing",
            "autoit",
            "write",
            "worm",
            "copy",
            "unknown",
            "win32",
            "persistence",
            "execution",
            "malware",
            "autorun",
            "redacted for",
            "for privacy",
            "name servers",
            "date",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse submit",
            "url analysis",
            "encrypt",
            "next",
            "sabey",
            "no expiration",
            "filehashsha256",
            "filehashsha1",
            "filehashmd5",
            "iocs",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "malware beacon",
            "useragent",
            "http request",
            "hostile",
            "autoit windows",
            "automation tool",
            "forbidden",
            "algorithm",
            "full name",
            "v3 serial",
            "number",
            "issuer",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "info",
            "first",
            "detections type",
            "name",
            "javascript",
            "pdf community",
            "office open",
            "xml spreadsheet",
            "text",
            "siblings",
            "process32nextw",
            "fjlsedauv",
            "writeconsolea",
            "medium",
            "discovery",
            "high",
            "module load",
            "t1129",
            "united",
            "as63949 linode",
            "mtb jan",
            "passive dns",
            "backdoor",
            "mtb dec",
            "open",
            "body",
            "artro",
            "creation date",
            "servers",
            "urls",
            "record value",
            "expiration date",
            "vt graph",
            "parent referrer",
            "apple private",
            "data collection",
            "hidden privacy",
            "malicious",
            "verified",
            "utc submissions",
            "submitters",
            "summary iocs",
            "graph community",
            "tucows",
            "amazonaes",
            "china telecom",
            "group",
            "cloudflarenet",
            "akamaias",
            "pty ltd",
            "argon data",
            "communication",
            "limited",
            "digitaloceanasn",
            "twitter",
            "dropbox",
            "domainsite",
            "alibaba cloud",
            "computing",
            "beijing",
            "service",
            "ip address",
            "latest",
            "virustotal",
            "unclejohn",
            "us autonomous",
            "system46606",
            "unified layer",
            "urls latest",
            "contacted",
            "historical",
            "subdomains",
            "gootloader",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "binary",
            "sameorigin",
            "scammer",
            "spammer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "GoldFinder",
              "display_name": "GoldFinder",
              "target": null
            },
            {
              "id": "Sibot - S0589",
              "display_name": "Sibot - S0589",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
              "target": null
            },
            {
              "id": "W32/Expiro.fam",
              "display_name": "W32/Expiro.fam",
              "target": null
            },
            {
              "id": "Kimsuky",
              "display_name": "Kimsuky",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1460",
              "name": "Biometric Spoofing",
              "display_name": "T1460 - Biometric Spoofing"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            }
          ],
          "industries": [
            "Healthcare",
            "Insurance",
            "Finance",
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 515,
            "FileHash-SHA1": 504,
            "FileHash-SHA256": 3557,
            "URL": 5450,
            "domain": 1842,
            "hostname": 2221,
            "CVE": 2,
            "email": 6
          },
          "indicator_count": 14097,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "793 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597f9c7542ffc6fffaecb30",
          "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
          "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:44:55.030000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4d4b5e060fb8a606a8",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.403000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4da16bd99cc5c02528",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.406000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Goldfinder",
            "Verified",
            "Skynet",
            "Zerobot",
            "Et",
            "Sibot - s0589",
            "Downloader.cerber/js!1.a59c (classic)",
            "Kimsuky",
            "Artro",
            "Content reputation",
            "Hacktool",
            "W32/expiro.fam"
          ],
          "industries": [
            "Government",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Finance",
            "Insurance"
          ],
          "unique_indicators": 44713
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/helioverse.top",
    "whois": "http://whois.domaintools.com/helioverse.top",
    "domain": "helioverse.top",
    "hostname": "mail.helioverse.top"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "65aab954f5f03a1f2906b39c",
      "name": "Zerobot",
      "description": "",
      "modified": "2024-10-12T07:01:26.973000",
      "created": "2024-01-19T18:03:00.966000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65aa168aeddea4851fc47cc3",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 123,
        "FileHash-SHA1": 123,
        "FileHash-SHA256": 2498,
        "domain": 1600,
        "hostname": 2749,
        "URL": 6303,
        "CVE": 1
      },
      "indicator_count": 13397,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "554 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65aa168aeddea4851fc47cc3",
      "name": "Zerobot & Skynet",
      "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
      "modified": "2024-03-23T01:01:38.014000",
      "created": "2024-01-19T06:28:26.343000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 78,
        "FileHash-SHA1": 78,
        "FileHash-SHA256": 2290,
        "domain": 1491,
        "hostname": 2611,
        "URL": 5879,
        "CVE": 8
      },
      "indicator_count": 12435,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "757 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e576b3cbdf2f86a32acc",
      "name": "Skynet | prd.connectforhealthco.com | Identity theft |",
      "description": "Remote interception of health insurance applicants call.  Social engineering - threat actor will walk target through process beginning with; verification of phone model, browser used, phone number, email, ssn# entered in staged health insurance enrollment application. Auto forwards ssn#  to Experian, locking consumer from of all accounts, credit information is stolen, consumer identity theft. New accounts cannot be created, a password reset is required for scam, all emails requested,  bad actor will ask for entire households email accounts, device use, etc.  Sends malicious forms to devices. Takes consumer through a lengthy phone transfer scheme  +++",
      "modified": "2024-02-16T13:04:46.804000",
      "created": "2024-01-17T14:34:30.204000",
      "tags": [
        "whois record",
        "historical ssl",
        "ssl certificate",
        "april",
        "referrer",
        "threat roundup",
        "communicating",
        "whois",
        "rwi dtools",
        "jekyll",
        "metro",
        "skynet",
        "identity theft",
        "parking crew",
        "whois whois",
        "resolutions",
        "october",
        "august",
        "march",
        "june",
        "attack",
        "goldfinder",
        "sibot",
        "hacktool",
        "remote attack",
        "social engineering",
        "read c",
        "get autoit",
        "search",
        "regsetvalueexa",
        "show",
        "entries",
        "regdword",
        "intel",
        "ms windows",
        "showing",
        "autoit",
        "write",
        "worm",
        "copy",
        "unknown",
        "win32",
        "persistence",
        "execution",
        "malware",
        "autorun",
        "redacted for",
        "for privacy",
        "name servers",
        "date",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "pulse submit",
        "url analysis",
        "encrypt",
        "next",
        "sabey",
        "no expiration",
        "filehashsha256",
        "filehashsha1",
        "filehashmd5",
        "iocs",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "malware beacon",
        "useragent",
        "http request",
        "hostile",
        "autoit windows",
        "automation tool",
        "forbidden",
        "algorithm",
        "full name",
        "v3 serial",
        "number",
        "issuer",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "info",
        "first",
        "detections type",
        "name",
        "javascript",
        "pdf community",
        "office open",
        "xml spreadsheet",
        "text",
        "siblings",
        "process32nextw",
        "fjlsedauv",
        "writeconsolea",
        "medium",
        "discovery",
        "high",
        "module load",
        "t1129",
        "united",
        "as63949 linode",
        "mtb jan",
        "passive dns",
        "backdoor",
        "mtb dec",
        "open",
        "body",
        "artro",
        "creation date",
        "servers",
        "urls",
        "record value",
        "expiration date",
        "vt graph",
        "parent referrer",
        "apple private",
        "data collection",
        "hidden privacy",
        "malicious",
        "verified",
        "utc submissions",
        "submitters",
        "summary iocs",
        "graph community",
        "tucows",
        "amazonaes",
        "china telecom",
        "group",
        "cloudflarenet",
        "akamaias",
        "pty ltd",
        "argon data",
        "communication",
        "limited",
        "digitaloceanasn",
        "twitter",
        "dropbox",
        "domainsite",
        "alibaba cloud",
        "computing",
        "beijing",
        "service",
        "ip address",
        "latest",
        "virustotal",
        "unclejohn",
        "us autonomous",
        "system46606",
        "unified layer",
        "urls latest",
        "contacted",
        "historical",
        "subdomains",
        "gootloader",
        "http response",
        "final url",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "binary",
        "sameorigin",
        "scammer",
        "spammer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        },
        {
          "id": "GoldFinder",
          "display_name": "GoldFinder",
          "target": null
        },
        {
          "id": "Sibot - S0589",
          "display_name": "Sibot - S0589",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Verified",
          "display_name": "Verified",
          "target": null
        },
        {
          "id": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "display_name": "Downloader.Cerber/JS!1.A59C (CLASSIC)",
          "target": null
        },
        {
          "id": "W32/Expiro.fam",
          "display_name": "W32/Expiro.fam",
          "target": null
        },
        {
          "id": "Kimsuky",
          "display_name": "Kimsuky",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1460",
          "name": "Biometric Spoofing",
          "display_name": "T1460 - Biometric Spoofing"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        }
      ],
      "industries": [
        "Healthcare",
        "Insurance",
        "Finance",
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 515,
        "FileHash-SHA1": 504,
        "FileHash-SHA256": 3557,
        "URL": 5450,
        "domain": 1842,
        "hostname": 2221,
        "CVE": 2,
        "email": 6
      },
      "indicator_count": 14097,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "793 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597f9c7542ffc6fffaecb30",
      "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
      "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:44:55.030000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4d4b5e060fb8a606a8",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.403000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4da16bd99cc5c02528",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.406000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mail.helioverse.top",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mail.helioverse.top",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643182.328563
}