{
  "type": "URL",
  "indicator": "https://mobqa03.botw.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mobqa03.botw.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3814648562,
      "indicator": "https://mobqa03.botw.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "665bb7679843a6dabe4560e3",
          "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
          "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
          "modified": "2024-09-05T06:11:17.325000",
          "created": "2024-06-02T00:05:59.160000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 2008,
            "URL": 11241,
            "domain": 1853,
            "hostname": 4198,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 19615,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f6738d3aa876f83738d0",
          "name": "USZoom [New York , USA] | iPostal1",
          "description": "",
          "modified": "2024-07-01T23:00:42.052000",
          "created": "2024-07-01T00:21:07.491000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": "665bb7679843a6dabe4560e3",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1890,
            "URL": 10360,
            "domain": 1799,
            "hostname": 3994,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 18358,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "656 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a2f9169d6996c1c928ac0b",
          "name": "Remote attack: Win32/Enosch.A gtalk connectivity check | High Priority",
          "description": "W32/Enosch.A!tr is classified as a Trojan. Trojan has the capabilities to remote access connection handling, perform Denial of Service (DoS) attacks. Worms automatically spread to other PCs. This threat can perform a number of actions of a malicious hacker's choice. This hacker is choosing to delete files, accounts, pulses, by graphs while acting as user.  An authenticated use in browser bar https://www.google.com/?authuser=0.\n\nAttempts to modify,delete graphs, pulses, accounts, passwords. Acting as user.",
          "modified": "2024-02-12T20:02:49.516000",
          "created": "2024-01-13T20:56:54.333000",
          "tags": [
            "default",
            "show",
            "regsetvalueexa",
            "search",
            "regdword",
            "medium",
            "settingswpad",
            "delete",
            "ids detections",
            "yara detections",
            "worm",
            "malware",
            "copy",
            "write",
            "win32",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "summary iocs",
            "graph community",
            "productidis",
            "urls",
            "mb iesettings",
            "related file",
            "cybersecurity",
            "agency",
            "csc corporate",
            "domains",
            "tucows domains",
            "nameweb bvba",
            "tucows",
            "google",
            "amazon02",
            "twitter",
            "ovh sas",
            "facebook",
            "incapsula",
            "optimizer",
            "activator",
            "kb program",
            "mb super",
            "kb acrotray",
            "1tzv",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "checks_debugger",
            "network_icmp",
            "network_smtp",
            "persistence_autorun",
            "modifies_proxy_wpad",
            "antivm_queries_computername",
            "dumped_buffer",
            "network_http",
            "antivm_network_adapters",
            "smtp_gmail",
            "attacking",
            "browser",
            "object",
            "deleted",
            "deleting",
            "deleted virustotal graphs",
            "corruption",
            "legal",
            "gvt",
            "adams co",
            "colorado",
            "law",
            "illegal practices",
            "hacking",
            "enter rexxfield",
            "roberts",
            "smith",
            "script urls",
            "as20940",
            "united",
            "a domains",
            "certificate",
            "showing",
            "entries",
            "entrust",
            "scan endpoints",
            "district",
            "as16625 akamai",
            "aaaa",
            "passive dns",
            "united kingdom",
            "whitelisted",
            "modification",
            "silence",
            "state",
            "hostname",
            "samples",
            "cover up",
            "silencing",
            "Iowa.gov",
            "dga",
            "fcc",
            "unsigned",
            "remote",
            "wiper",
            "nosy pega",
            "trojan",
            "unknown",
            "access denied",
            "servers",
            "creation date",
            "date",
            "next",
            "apple",
            "ssl certificate",
            "threat roundup",
            "march",
            "october",
            "july",
            "april",
            "whois record",
            "june",
            "roundup",
            "september",
            "august",
            "plugx",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "regsz",
            "english",
            "nsisinetc",
            "mozilla",
            "adobe air",
            "java",
            "http",
            "post http",
            "updater",
            "meta",
            "suspicious",
            "persistence",
            "execution",
            "referrer",
            "communicating",
            "skynet",
            "malicious",
            "gen.o",
            "dynamicloader",
            "cape",
            "enosch malware",
            "enosch",
            "music",
            "contacted",
            "pe resource",
            "resolutions",
            "siblings",
            "urls http"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/file/c98108ca8f4e0dd8a3f63d4ac490e115",
            "https://www.google.com/?authuser=0",
            "Wiper to Ransomware: The Evolution of Agrius - Sourced: ArcSight Threat Intelligence",
            "AS15133 MCI Communications Services Inc d b a Verizon Business, Loudon County, Va",
            "207 Iowa.gov domains and hosts acting as cyber security [cyberreason]",
            "iowa.gov, accidentreports.iowa.gov, beready.iowa.gov, affordableconnectivity.gov",
            "appanoosecounty.iowa.gov, bigben.iowa.gov [Ben Smith?]",
            "lacity.gov, auditortest.iowa.gov, broadband.iowa.gov, admin.auditor.iowa.gov,",
            "https://lacity.gov/san/index.htm, https://personnel.lacity.gov, https://lacity.gov/SAN,",
            "Domains Contacted: smtp.gmail.com www.google.com",
            "DGA Domain [affordableconnectivity.gov & GetInternet.gov]  Home ACP Universal Service Administrative Company",
            "www.fcc.gov? DGA Domains : Certificate Subject\tUS 443 Certificate Subject\tDistrict of Columbia 443 Certificate Subject\tWashington 443 Certificate Subject\tFederal Communications Commission 443 Certificate Subject\tGovernment Entity 443 Certificate Subject\t1934-06-19 443 Certificate Subject\taffordableconnectivity.gov 443 Certificate Issuer\tEntrust, Inc. 443 Certificate Issuer\tSee www.entrust.net/legal-terms 443 Certificate Issuer",
            "(c) 2014 Entrust, Inc. - for authorized use only 443 Certificate Issuer\tEntrust Certification Authority - L1M",
            "https://www.clear.com.br/site/DirectTalk/Filter?botopenned=3Dtrue [???]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Belgium",
            "Netherlands",
            "Spain",
            "Australia",
            "Korea, Republic of",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Nullsoft_NSIS",
              "display_name": "Nullsoft_NSIS",
              "target": null
            },
            {
              "id": "Win32:Agent-ASTI\\ [Trj]",
              "display_name": "Win32:Agent-ASTI\\ [Trj]",
              "target": null
            },
            {
              "id": "Worm:Win32/Enosch!atmn",
              "display_name": "Worm:Win32/Enosch!atmn",
              "target": "/malware/Worm:Win32/Enosch!atmn"
            },
            {
              "id": "Win.Trojan.Agent-357800",
              "display_name": "Win.Trojan.Agent-357800",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 1512,
            "FileHash-SHA256": 5351,
            "SSLCertFingerprint": 1,
            "URL": 1774,
            "email": 7,
            "hostname": 1170,
            "domain": 1209
          },
          "indicator_count": 13725,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "797 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a2f9200337f0d1fa195ada",
          "name": "Remote attack: Win32/Enosch.A gtalk connectivity check | High Priority",
          "description": "W32/Enosch.A!tr is classified as a Trojan. Trojan has the capabilities to remote access connection handling, perform Denial of Service (DoS) attacks. Worms automatically spread to other PCs. This threat can perform a number of actions of a malicious hacker's choice. This hacker is choosing to delete files, accounts, pulses, by graphs while acting as user.  An authenticated use in browser bar https://www.google.com/?authuser=0.\n\nAttempts to modify,delete graphs, pulses, accounts, passwords. Acting as user.",
          "modified": "2024-02-12T20:02:49.516000",
          "created": "2024-01-13T20:57:04.197000",
          "tags": [
            "default",
            "show",
            "regsetvalueexa",
            "search",
            "regdword",
            "medium",
            "settingswpad",
            "delete",
            "ids detections",
            "yara detections",
            "worm",
            "malware",
            "copy",
            "write",
            "win32",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "summary iocs",
            "graph community",
            "productidis",
            "urls",
            "mb iesettings",
            "related file",
            "cybersecurity",
            "agency",
            "csc corporate",
            "domains",
            "tucows domains",
            "nameweb bvba",
            "tucows",
            "google",
            "amazon02",
            "twitter",
            "ovh sas",
            "facebook",
            "incapsula",
            "optimizer",
            "activator",
            "kb program",
            "mb super",
            "kb acrotray",
            "1tzv",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "checks_debugger",
            "network_icmp",
            "network_smtp",
            "persistence_autorun",
            "modifies_proxy_wpad",
            "antivm_queries_computername",
            "dumped_buffer",
            "network_http",
            "antivm_network_adapters",
            "smtp_gmail",
            "attacking",
            "browser",
            "object",
            "deleted",
            "deleting",
            "deleted virustotal graphs",
            "corruption",
            "legal",
            "gvt",
            "adams co",
            "colorado",
            "law",
            "illegal practices",
            "hacking",
            "enter rexxfield",
            "roberts",
            "smith",
            "script urls",
            "as20940",
            "united",
            "a domains",
            "certificate",
            "showing",
            "entries",
            "entrust",
            "scan endpoints",
            "district",
            "as16625 akamai",
            "aaaa",
            "passive dns",
            "united kingdom",
            "whitelisted",
            "modification",
            "silence",
            "state",
            "hostname",
            "samples",
            "cover up",
            "silencing",
            "Iowa.gov",
            "dga",
            "fcc",
            "unsigned",
            "remote",
            "wiper",
            "nosy pega",
            "trojan",
            "unknown",
            "access denied",
            "servers",
            "creation date",
            "date",
            "next",
            "apple",
            "ssl certificate",
            "threat roundup",
            "march",
            "october",
            "july",
            "april",
            "whois record",
            "june",
            "roundup",
            "september",
            "august",
            "plugx",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "regsz",
            "english",
            "nsisinetc",
            "mozilla",
            "adobe air",
            "java",
            "http",
            "post http",
            "updater",
            "meta",
            "suspicious",
            "persistence",
            "execution",
            "referrer",
            "communicating",
            "skynet",
            "malicious",
            "gen.o",
            "dynamicloader",
            "cape",
            "enosch malware",
            "enosch",
            "music",
            "contacted",
            "pe resource",
            "resolutions",
            "siblings",
            "urls http"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/file/c98108ca8f4e0dd8a3f63d4ac490e115",
            "https://www.google.com/?authuser=0",
            "Wiper to Ransomware: The Evolution of Agrius - Sourced: ArcSight Threat Intelligence",
            "AS15133 MCI Communications Services Inc d b a Verizon Business, Loudon County, Va",
            "207 Iowa.gov domains and hosts acting as cyber security [cyberreason]",
            "iowa.gov, accidentreports.iowa.gov, beready.iowa.gov, affordableconnectivity.gov",
            "appanoosecounty.iowa.gov, bigben.iowa.gov [Ben Smith?]",
            "lacity.gov, auditortest.iowa.gov, broadband.iowa.gov, admin.auditor.iowa.gov,",
            "https://lacity.gov/san/index.htm, https://personnel.lacity.gov, https://lacity.gov/SAN,",
            "Domains Contacted: smtp.gmail.com www.google.com",
            "DGA Domain [affordableconnectivity.gov & GetInternet.gov]  Home ACP Universal Service Administrative Company",
            "www.fcc.gov? DGA Domains : Certificate Subject\tUS 443 Certificate Subject\tDistrict of Columbia 443 Certificate Subject\tWashington 443 Certificate Subject\tFederal Communications Commission 443 Certificate Subject\tGovernment Entity 443 Certificate Subject\t1934-06-19 443 Certificate Subject\taffordableconnectivity.gov 443 Certificate Issuer\tEntrust, Inc. 443 Certificate Issuer\tSee www.entrust.net/legal-terms 443 Certificate Issuer",
            "(c) 2014 Entrust, Inc. - for authorized use only 443 Certificate Issuer\tEntrust Certification Authority - L1M",
            "https://www.clear.com.br/site/DirectTalk/Filter?botopenned=3Dtrue [???]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Belgium",
            "Netherlands",
            "Spain",
            "Australia",
            "Korea, Republic of",
            "Hong Kong"
          ],
          "malware_families": [
            {
              "id": "Nullsoft_NSIS",
              "display_name": "Nullsoft_NSIS",
              "target": null
            },
            {
              "id": "Win32:Agent-ASTI\\ [Trj]",
              "display_name": "Win32:Agent-ASTI\\ [Trj]",
              "target": null
            },
            {
              "id": "Worm:Win32/Enosch!atmn",
              "display_name": "Worm:Win32/Enosch!atmn",
              "target": "/malware/Worm:Win32/Enosch!atmn"
            },
            {
              "id": "Win.Trojan.Agent-357800",
              "display_name": "Win.Trojan.Agent-357800",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 1512,
            "FileHash-SHA256": 5351,
            "SSLCertFingerprint": 1,
            "URL": 1774,
            "email": 7,
            "hostname": 1170,
            "domain": 1209
          },
          "indicator_count": 13725,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "797 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658dd276d03bca9b7a93b724",
          "name": "Makop | Lazarus | Spyware",
          "description": "Privilege abuse. Spyware and miscellaneous cyber attacks leveraged against various individuals using escalated privileges. Pegasus was found, not thoroughly explored.",
          "modified": "2024-01-27T18:02:23.517000",
          "created": "2023-12-28T19:54:30.287000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "iocs",
            "ipv4",
            "filehashmd5",
            "next",
            "scan endpoints",
            "all octoseek",
            "url http",
            "url https",
            "create new",
            "deptid24124",
            "deptid23922",
            "deptid23936",
            "sid339",
            "filehashsha256",
            "navmode3",
            "ommidsf3558",
            "usbuy no",
            "type33554433",
            "guid",
            "smauthreason0",
            "methodhead",
            "targetsmhttps",
            "exact",
            "a9 no",
            "langid1",
            "actmsgs1",
            "christmas",
            "pinlbtn",
            "pinl2",
            "uidtokenhttps",
            "pulse use",
            "pdf report",
            "pcap",
            "stix",
            "filehashsha1",
            "email",
            "contact",
            "contacted",
            "pegasus",
            "T1622 - Debugger Evasion",
            "wmi string",
            "windows nt",
            "request email",
            "apple",
            "search",
            "server",
            "resolutions",
            "san francisco",
            "route",
            "server ca",
            "sha2 secure",
            "show technique",
            "sign",
            "sprint personal",
            "status",
            "ssl certificate",
            "stateprovince",
            "text",
            "test",
            "subdomains",
            "surry hills",
            "teams api",
            "uknown",
            "threat analyzer",
            "threat",
            "target",
            "tsara brashears",
            "united",
            "urls",
            "win64",
            "windir",
            "urls http",
            "v3 serial",
            "validity",
            "referrer",
            "registrar abuse",
            "report",
            "report registrar abuse",
            "ransomware",
            "record value",
            "programfiles",
            "priority",
            "port scan",
            "pe32",
            "pegasus",
            "pe resource",
            "path",
            "paste",
            "passive dns",
            "password",
            "orgtechhandle",
            "orgtechphone",
            "orgtechref",
            "open",
            "orgabusehandle",
            "orgabuseref",
            "asn asn",
            "asn database",
            "bernhardplein",
            "big tech",
            "body xml",
            "body",
            "xml",
            "ck id",
            "cloudflare",
            "as8100",
            "akamai as36786",
            "as16625",
            "arin",
            "analyze",
            "api ip",
            "amazons3",
            "akamaias",
            "akamai",
            "aibv hostmaster",
            "access type",
            "abuse contact",
            "audiologist inc",
            "nothing number",
            "united",
            "brashears",
            "verdict",
            "net10464001",
            "new ioc",
            "next noc",
            "bv",
            "bv  orgid cambridge",
            "cambridge",
            "certificate",
            "certificate city",
            "ck id",
            "city",
            "brute force",
            "communicating",
            "copy core",
            "copy",
            "core",
            "cus",
            "cndigicert",
            "date",
            "detections",
            "detection type",
            "dhs discover",
            "dns",
            "discover",
            "hallrender",
            "briansabey",
            "brian sabey",
            "hall render",
            "dhs",
            "domain name",
            "download",
            "download sample",
            "email",
            "europeberlin",
            "execution",
            "falcon",
            "falcon sandbox",
            "false",
            "feeds",
            "feeds ioc",
            "first",
            "form",
            "frankfurt",
            "full name",
            "gameskinny",
            "gecko",
            "germany",
            "getprocaddress",
            "hacktool",
            "historical ssl",
            "hostnames",
            "hybrid",
            "ibm",
            "ibm business",
            "installer",
            "installer internet",
            "ioc search",
            "iocs",
            "ip address",
            "ip geolocation",
            "stealer",
            "ipinfo",
            "issuer",
            "javascript",
            "jb",
            "jb country",
            "khtml",
            "lazarus",
            "little",
            "lolkek",
            "main",
            "makop",
            "markmonitor",
            "microsoft",
            "mitre att",
            "ms windows",
            "name name"
          ],
          "references": [
            "uat.identityssl.newscdn.com.au",
            "gameskinny.com",
            "https://hybrid-analysis.com/sample/7ba985d328ac4d9be47826ae3f98b513ca00b1609d82fe1d4aa365e7cfb54f48",
            "https://hybrid-analysis.com/sample/55af17e7ea6e0884ed102bb2cb21844ab2bf3330dd46aace4c736be5c55b0257/658d97df7e57b7b66c00b342"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "BRASHEARS",
              "display_name": "BRASHEARS",
              "target": null
            },
            {
              "id": "Makop Ransomware",
              "display_name": "Makop Ransomware",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Lazarus",
              "display_name": "Lazarus",
              "target": null
            },
            {
              "id": "Little",
              "display_name": "Little",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1559",
              "name": "Inter-Process Communication",
              "display_name": "T1559 - Inter-Process Communication"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2108,
            "FileHash-SHA1": 1248,
            "domain": 668,
            "hostname": 1340,
            "URL": 2652,
            "FileHash-SHA256": 1070,
            "email": 25,
            "CIDR": 4
          },
          "indicator_count": 9115,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "813 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658ef84e3324dfdb9d16bd73",
          "name": "Makop | Lazarus | Spyware (if it looks like a Pegasus...)",
          "description": "",
          "modified": "2024-01-27T18:02:23.517000",
          "created": "2023-12-29T16:48:15",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "iocs",
            "ipv4",
            "filehashmd5",
            "next",
            "scan endpoints",
            "all octoseek",
            "url http",
            "url https",
            "create new",
            "deptid24124",
            "deptid23922",
            "deptid23936",
            "sid339",
            "filehashsha256",
            "navmode3",
            "ommidsf3558",
            "usbuy no",
            "type33554433",
            "guid",
            "smauthreason0",
            "methodhead",
            "targetsmhttps",
            "exact",
            "a9 no",
            "langid1",
            "actmsgs1",
            "christmas",
            "pinlbtn",
            "pinl2",
            "uidtokenhttps",
            "pulse use",
            "pdf report",
            "pcap",
            "stix",
            "filehashsha1",
            "email",
            "contact",
            "contacted",
            "pegasus",
            "T1622 - Debugger Evasion",
            "wmi string",
            "windows nt",
            "request email",
            "apple",
            "search",
            "server",
            "resolutions",
            "san francisco",
            "route",
            "server ca",
            "sha2 secure",
            "show technique",
            "sign",
            "sprint personal",
            "status",
            "ssl certificate",
            "stateprovince",
            "text",
            "test",
            "subdomains",
            "surry hills",
            "teams api",
            "uknown",
            "threat analyzer",
            "threat",
            "target",
            "tsara brashears",
            "united",
            "urls",
            "win64",
            "windir",
            "urls http",
            "v3 serial",
            "validity",
            "referrer",
            "registrar abuse",
            "report",
            "report registrar abuse",
            "ransomware",
            "record value",
            "programfiles",
            "priority",
            "port scan",
            "pe32",
            "pegasus",
            "pe resource",
            "path",
            "paste",
            "passive dns",
            "password",
            "orgtechhandle",
            "orgtechphone",
            "orgtechref",
            "open",
            "orgabusehandle",
            "orgabuseref",
            "asn asn",
            "asn database",
            "bernhardplein",
            "big tech",
            "body xml",
            "body",
            "xml",
            "ck id",
            "cloudflare",
            "as8100",
            "akamai as36786",
            "as16625",
            "arin",
            "analyze",
            "api ip",
            "amazons3",
            "akamaias",
            "akamai",
            "aibv hostmaster",
            "access type",
            "abuse contact",
            "audiologist inc",
            "nothing number",
            "united",
            "brashears",
            "verdict",
            "net10464001",
            "new ioc",
            "next noc",
            "bv",
            "bv  orgid cambridge",
            "cambridge",
            "certificate",
            "certificate city",
            "ck id",
            "city",
            "brute force",
            "communicating",
            "copy core",
            "copy",
            "core",
            "cus",
            "cndigicert",
            "date",
            "detections",
            "detection type",
            "dhs discover",
            "dns",
            "discover",
            "hallrender",
            "briansabey",
            "brian sabey",
            "hall render",
            "dhs",
            "domain name",
            "download",
            "download sample",
            "email",
            "europeberlin",
            "execution",
            "falcon",
            "falcon sandbox",
            "false",
            "feeds",
            "feeds ioc",
            "first",
            "form",
            "frankfurt",
            "full name",
            "gameskinny",
            "gecko",
            "germany",
            "getprocaddress",
            "hacktool",
            "historical ssl",
            "hostnames",
            "hybrid",
            "ibm",
            "ibm business",
            "installer",
            "installer internet",
            "ioc search",
            "iocs",
            "ip address",
            "ip geolocation",
            "stealer",
            "ipinfo",
            "issuer",
            "javascript",
            "jb",
            "jb country",
            "khtml",
            "lazarus",
            "little",
            "lolkek",
            "main",
            "makop",
            "markmonitor",
            "microsoft",
            "mitre att",
            "ms windows",
            "name name"
          ],
          "references": [
            "uat.identityssl.newscdn.com.au",
            "gameskinny.com",
            "https://hybrid-analysis.com/sample/7ba985d328ac4d9be47826ae3f98b513ca00b1609d82fe1d4aa365e7cfb54f48",
            "https://hybrid-analysis.com/sample/55af17e7ea6e0884ed102bb2cb21844ab2bf3330dd46aace4c736be5c55b0257/658d97df7e57b7b66c00b342"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "BRASHEARS",
              "display_name": "BRASHEARS",
              "target": null
            },
            {
              "id": "Makop Ransomware",
              "display_name": "Makop Ransomware",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Lazarus",
              "display_name": "Lazarus",
              "target": null
            },
            {
              "id": "Little",
              "display_name": "Little",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1559",
              "name": "Inter-Process Communication",
              "display_name": "T1559 - Inter-Process Communication"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "658dd276d03bca9b7a93b724",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2108,
            "FileHash-SHA1": 1248,
            "domain": 668,
            "hostname": 1340,
            "URL": 2652,
            "FileHash-SHA256": 1070,
            "email": 25,
            "CIDR": 4
          },
          "indicator_count": 9115,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "813 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/7ba985d328ac4d9be47826ae3f98b513ca00b1609d82fe1d4aa365e7cfb54f48",
        "https://www.google.com/?authuser=0",
        "gameskinny.com",
        "Domains Contacted: smtp.gmail.com www.google.com",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/c98108ca8f4e0dd8a3f63d4ac490e115",
        "https://lacity.gov/san/index.htm, https://personnel.lacity.gov, https://lacity.gov/SAN,",
        "(c) 2014 Entrust, Inc. - for authorized use only 443 Certificate Issuer\tEntrust Certification Authority - L1M",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |",
        "AS15133 MCI Communications Services Inc d b a Verizon Business, Loudon County, Va",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "appanoosecounty.iowa.gov, bigben.iowa.gov [Ben Smith?]",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Malicious Score: 10",
        "207 Iowa.gov domains and hosts acting as cyber security [cyberreason]",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "lacity.gov, auditortest.iowa.gov, broadband.iowa.gov, admin.auditor.iowa.gov,",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "iowa.gov, accidentreports.iowa.gov, beready.iowa.gov, affordableconnectivity.gov",
        "DGA Domain [affordableconnectivity.gov & GetInternet.gov]  Home ACP Universal Service Administrative Company",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "www.fcc.gov? DGA Domains : Certificate Subject\tUS 443 Certificate Subject\tDistrict of Columbia 443 Certificate Subject\tWashington 443 Certificate Subject\tFederal Communications Commission 443 Certificate Subject\tGovernment Entity 443 Certificate Subject\t1934-06-19 443 Certificate Subject\taffordableconnectivity.gov 443 Certificate Issuer\tEntrust, Inc. 443 Certificate Issuer\tSee www.entrust.net/legal-terms 443 Certificate Issuer",
        "Wiper to Ransomware: The Evolution of Agrius - Sourced: ArcSight Threat Intelligence",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "https://www.clear.com.br/site/DirectTalk/Filter?botopenned=3Dtrue [???]",
        "uat.identityssl.newscdn.com.au",
        "Yara Detections: DotNET_Reactor",
        "https://hybrid-analysis.com/sample/55af17e7ea6e0884ed102bb2cb21844ab2bf3330dd46aace4c736be5c55b0257/658d97df7e57b7b66c00b342",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "https://uszoom.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Brashears",
            "Win.keylogger.susppack-9876601-0",
            "Lazarus",
            "Little",
            "Win.trojan.sdum-9807706-0",
            "Pdf.phishing.ttraffrobotinstall-7605656-0",
            "Worm:win32/enosch!atmn",
            "Sabey",
            "#lowfi:hstr:trojanspy:win32/bancos",
            "Win32:agent-asti\\ [trj]",
            "Ransomware",
            "Makop ransomware",
            "Hallrender",
            "Win.trojan.agent-357800",
            "Nullsoft_nsis",
            "Hacktool",
            "Lolkek",
            "Win32.meredrop checkin"
          ],
          "industries": [
            "Civil society",
            "Technology",
            "Telecommunications"
          ],
          "unique_indicators": 43089
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/botw.com",
    "whois": "http://whois.domaintools.com/botw.com",
    "domain": "botw.com",
    "hostname": "mobqa03.botw.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "665bb7679843a6dabe4560e3",
      "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
      "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
      "modified": "2024-09-05T06:11:17.325000",
      "created": "2024-06-02T00:05:59.160000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 2008,
        "URL": 11241,
        "domain": 1853,
        "hostname": 4198,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 19615,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f6738d3aa876f83738d0",
      "name": "USZoom [New York , USA] | iPostal1",
      "description": "",
      "modified": "2024-07-01T23:00:42.052000",
      "created": "2024-07-01T00:21:07.491000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": "665bb7679843a6dabe4560e3",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1890,
        "URL": 10360,
        "domain": 1799,
        "hostname": 3994,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 18358,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "656 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a2f9169d6996c1c928ac0b",
      "name": "Remote attack: Win32/Enosch.A gtalk connectivity check | High Priority",
      "description": "W32/Enosch.A!tr is classified as a Trojan. Trojan has the capabilities to remote access connection handling, perform Denial of Service (DoS) attacks. Worms automatically spread to other PCs. This threat can perform a number of actions of a malicious hacker's choice. This hacker is choosing to delete files, accounts, pulses, by graphs while acting as user.  An authenticated use in browser bar https://www.google.com/?authuser=0.\n\nAttempts to modify,delete graphs, pulses, accounts, passwords. Acting as user.",
      "modified": "2024-02-12T20:02:49.516000",
      "created": "2024-01-13T20:56:54.333000",
      "tags": [
        "default",
        "show",
        "regsetvalueexa",
        "search",
        "regdword",
        "medium",
        "settingswpad",
        "delete",
        "ids detections",
        "yara detections",
        "worm",
        "malware",
        "copy",
        "write",
        "win32",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "summary iocs",
        "graph community",
        "productidis",
        "urls",
        "mb iesettings",
        "related file",
        "cybersecurity",
        "agency",
        "csc corporate",
        "domains",
        "tucows domains",
        "nameweb bvba",
        "tucows",
        "google",
        "amazon02",
        "twitter",
        "ovh sas",
        "facebook",
        "incapsula",
        "optimizer",
        "activator",
        "kb program",
        "mb super",
        "kb acrotray",
        "1tzv",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "checks_debugger",
        "network_icmp",
        "network_smtp",
        "persistence_autorun",
        "modifies_proxy_wpad",
        "antivm_queries_computername",
        "dumped_buffer",
        "network_http",
        "antivm_network_adapters",
        "smtp_gmail",
        "attacking",
        "browser",
        "object",
        "deleted",
        "deleting",
        "deleted virustotal graphs",
        "corruption",
        "legal",
        "gvt",
        "adams co",
        "colorado",
        "law",
        "illegal practices",
        "hacking",
        "enter rexxfield",
        "roberts",
        "smith",
        "script urls",
        "as20940",
        "united",
        "a domains",
        "certificate",
        "showing",
        "entries",
        "entrust",
        "scan endpoints",
        "district",
        "as16625 akamai",
        "aaaa",
        "passive dns",
        "united kingdom",
        "whitelisted",
        "modification",
        "silence",
        "state",
        "hostname",
        "samples",
        "cover up",
        "silencing",
        "Iowa.gov",
        "dga",
        "fcc",
        "unsigned",
        "remote",
        "wiper",
        "nosy pega",
        "trojan",
        "unknown",
        "access denied",
        "servers",
        "creation date",
        "date",
        "next",
        "apple",
        "ssl certificate",
        "threat roundup",
        "march",
        "october",
        "july",
        "april",
        "whois record",
        "june",
        "roundup",
        "september",
        "august",
        "plugx",
        "goldfinder",
        "sibot",
        "hacktool",
        "february",
        "regsz",
        "english",
        "nsisinetc",
        "mozilla",
        "adobe air",
        "java",
        "http",
        "post http",
        "updater",
        "meta",
        "suspicious",
        "persistence",
        "execution",
        "referrer",
        "communicating",
        "skynet",
        "malicious",
        "gen.o",
        "dynamicloader",
        "cape",
        "enosch malware",
        "enosch",
        "music",
        "contacted",
        "pe resource",
        "resolutions",
        "siblings",
        "urls http"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/file/c98108ca8f4e0dd8a3f63d4ac490e115",
        "https://www.google.com/?authuser=0",
        "Wiper to Ransomware: The Evolution of Agrius - Sourced: ArcSight Threat Intelligence",
        "AS15133 MCI Communications Services Inc d b a Verizon Business, Loudon County, Va",
        "207 Iowa.gov domains and hosts acting as cyber security [cyberreason]",
        "iowa.gov, accidentreports.iowa.gov, beready.iowa.gov, affordableconnectivity.gov",
        "appanoosecounty.iowa.gov, bigben.iowa.gov [Ben Smith?]",
        "lacity.gov, auditortest.iowa.gov, broadband.iowa.gov, admin.auditor.iowa.gov,",
        "https://lacity.gov/san/index.htm, https://personnel.lacity.gov, https://lacity.gov/SAN,",
        "Domains Contacted: smtp.gmail.com www.google.com",
        "DGA Domain [affordableconnectivity.gov & GetInternet.gov]  Home ACP Universal Service Administrative Company",
        "www.fcc.gov? DGA Domains : Certificate Subject\tUS 443 Certificate Subject\tDistrict of Columbia 443 Certificate Subject\tWashington 443 Certificate Subject\tFederal Communications Commission 443 Certificate Subject\tGovernment Entity 443 Certificate Subject\t1934-06-19 443 Certificate Subject\taffordableconnectivity.gov 443 Certificate Issuer\tEntrust, Inc. 443 Certificate Issuer\tSee www.entrust.net/legal-terms 443 Certificate Issuer",
        "(c) 2014 Entrust, Inc. - for authorized use only 443 Certificate Issuer\tEntrust Certification Authority - L1M",
        "https://www.clear.com.br/site/DirectTalk/Filter?botopenned=3Dtrue [???]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Belgium",
        "Netherlands",
        "Spain",
        "Australia",
        "Korea, Republic of",
        "Hong Kong"
      ],
      "malware_families": [
        {
          "id": "Nullsoft_NSIS",
          "display_name": "Nullsoft_NSIS",
          "target": null
        },
        {
          "id": "Win32:Agent-ASTI\\ [Trj]",
          "display_name": "Win32:Agent-ASTI\\ [Trj]",
          "target": null
        },
        {
          "id": "Worm:Win32/Enosch!atmn",
          "display_name": "Worm:Win32/Enosch!atmn",
          "target": "/malware/Worm:Win32/Enosch!atmn"
        },
        {
          "id": "Win.Trojan.Agent-357800",
          "display_name": "Win.Trojan.Agent-357800",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 1512,
        "FileHash-SHA256": 5351,
        "SSLCertFingerprint": 1,
        "URL": 1774,
        "email": 7,
        "hostname": 1170,
        "domain": 1209
      },
      "indicator_count": 13725,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "797 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a2f9200337f0d1fa195ada",
      "name": "Remote attack: Win32/Enosch.A gtalk connectivity check | High Priority",
      "description": "W32/Enosch.A!tr is classified as a Trojan. Trojan has the capabilities to remote access connection handling, perform Denial of Service (DoS) attacks. Worms automatically spread to other PCs. This threat can perform a number of actions of a malicious hacker's choice. This hacker is choosing to delete files, accounts, pulses, by graphs while acting as user.  An authenticated use in browser bar https://www.google.com/?authuser=0.\n\nAttempts to modify,delete graphs, pulses, accounts, passwords. Acting as user.",
      "modified": "2024-02-12T20:02:49.516000",
      "created": "2024-01-13T20:57:04.197000",
      "tags": [
        "default",
        "show",
        "regsetvalueexa",
        "search",
        "regdword",
        "medium",
        "settingswpad",
        "delete",
        "ids detections",
        "yara detections",
        "worm",
        "malware",
        "copy",
        "write",
        "win32",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "summary iocs",
        "graph community",
        "productidis",
        "urls",
        "mb iesettings",
        "related file",
        "cybersecurity",
        "agency",
        "csc corporate",
        "domains",
        "tucows domains",
        "nameweb bvba",
        "tucows",
        "google",
        "amazon02",
        "twitter",
        "ovh sas",
        "facebook",
        "incapsula",
        "optimizer",
        "activator",
        "kb program",
        "mb super",
        "kb acrotray",
        "1tzv",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "checks_debugger",
        "network_icmp",
        "network_smtp",
        "persistence_autorun",
        "modifies_proxy_wpad",
        "antivm_queries_computername",
        "dumped_buffer",
        "network_http",
        "antivm_network_adapters",
        "smtp_gmail",
        "attacking",
        "browser",
        "object",
        "deleted",
        "deleting",
        "deleted virustotal graphs",
        "corruption",
        "legal",
        "gvt",
        "adams co",
        "colorado",
        "law",
        "illegal practices",
        "hacking",
        "enter rexxfield",
        "roberts",
        "smith",
        "script urls",
        "as20940",
        "united",
        "a domains",
        "certificate",
        "showing",
        "entries",
        "entrust",
        "scan endpoints",
        "district",
        "as16625 akamai",
        "aaaa",
        "passive dns",
        "united kingdom",
        "whitelisted",
        "modification",
        "silence",
        "state",
        "hostname",
        "samples",
        "cover up",
        "silencing",
        "Iowa.gov",
        "dga",
        "fcc",
        "unsigned",
        "remote",
        "wiper",
        "nosy pega",
        "trojan",
        "unknown",
        "access denied",
        "servers",
        "creation date",
        "date",
        "next",
        "apple",
        "ssl certificate",
        "threat roundup",
        "march",
        "october",
        "july",
        "april",
        "whois record",
        "june",
        "roundup",
        "september",
        "august",
        "plugx",
        "goldfinder",
        "sibot",
        "hacktool",
        "february",
        "regsz",
        "english",
        "nsisinetc",
        "mozilla",
        "adobe air",
        "java",
        "http",
        "post http",
        "updater",
        "meta",
        "suspicious",
        "persistence",
        "execution",
        "referrer",
        "communicating",
        "skynet",
        "malicious",
        "gen.o",
        "dynamicloader",
        "cape",
        "enosch malware",
        "enosch",
        "music",
        "contacted",
        "pe resource",
        "resolutions",
        "siblings",
        "urls http"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/file/c98108ca8f4e0dd8a3f63d4ac490e115",
        "https://www.google.com/?authuser=0",
        "Wiper to Ransomware: The Evolution of Agrius - Sourced: ArcSight Threat Intelligence",
        "AS15133 MCI Communications Services Inc d b a Verizon Business, Loudon County, Va",
        "207 Iowa.gov domains and hosts acting as cyber security [cyberreason]",
        "iowa.gov, accidentreports.iowa.gov, beready.iowa.gov, affordableconnectivity.gov",
        "appanoosecounty.iowa.gov, bigben.iowa.gov [Ben Smith?]",
        "lacity.gov, auditortest.iowa.gov, broadband.iowa.gov, admin.auditor.iowa.gov,",
        "https://lacity.gov/san/index.htm, https://personnel.lacity.gov, https://lacity.gov/SAN,",
        "Domains Contacted: smtp.gmail.com www.google.com",
        "DGA Domain [affordableconnectivity.gov & GetInternet.gov]  Home ACP Universal Service Administrative Company",
        "www.fcc.gov? DGA Domains : Certificate Subject\tUS 443 Certificate Subject\tDistrict of Columbia 443 Certificate Subject\tWashington 443 Certificate Subject\tFederal Communications Commission 443 Certificate Subject\tGovernment Entity 443 Certificate Subject\t1934-06-19 443 Certificate Subject\taffordableconnectivity.gov 443 Certificate Issuer\tEntrust, Inc. 443 Certificate Issuer\tSee www.entrust.net/legal-terms 443 Certificate Issuer",
        "(c) 2014 Entrust, Inc. - for authorized use only 443 Certificate Issuer\tEntrust Certification Authority - L1M",
        "https://www.clear.com.br/site/DirectTalk/Filter?botopenned=3Dtrue [???]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Belgium",
        "Netherlands",
        "Spain",
        "Australia",
        "Korea, Republic of",
        "Hong Kong"
      ],
      "malware_families": [
        {
          "id": "Nullsoft_NSIS",
          "display_name": "Nullsoft_NSIS",
          "target": null
        },
        {
          "id": "Win32:Agent-ASTI\\ [Trj]",
          "display_name": "Win32:Agent-ASTI\\ [Trj]",
          "target": null
        },
        {
          "id": "Worm:Win32/Enosch!atmn",
          "display_name": "Worm:Win32/Enosch!atmn",
          "target": "/malware/Worm:Win32/Enosch!atmn"
        },
        {
          "id": "Win.Trojan.Agent-357800",
          "display_name": "Win.Trojan.Agent-357800",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 1512,
        "FileHash-SHA256": 5351,
        "SSLCertFingerprint": 1,
        "URL": 1774,
        "email": 7,
        "hostname": 1170,
        "domain": 1209
      },
      "indicator_count": 13725,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "797 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658dd276d03bca9b7a93b724",
      "name": "Makop | Lazarus | Spyware",
      "description": "Privilege abuse. Spyware and miscellaneous cyber attacks leveraged against various individuals using escalated privileges. Pegasus was found, not thoroughly explored.",
      "modified": "2024-01-27T18:02:23.517000",
      "created": "2023-12-28T19:54:30.287000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "iocs",
        "ipv4",
        "filehashmd5",
        "next",
        "scan endpoints",
        "all octoseek",
        "url http",
        "url https",
        "create new",
        "deptid24124",
        "deptid23922",
        "deptid23936",
        "sid339",
        "filehashsha256",
        "navmode3",
        "ommidsf3558",
        "usbuy no",
        "type33554433",
        "guid",
        "smauthreason0",
        "methodhead",
        "targetsmhttps",
        "exact",
        "a9 no",
        "langid1",
        "actmsgs1",
        "christmas",
        "pinlbtn",
        "pinl2",
        "uidtokenhttps",
        "pulse use",
        "pdf report",
        "pcap",
        "stix",
        "filehashsha1",
        "email",
        "contact",
        "contacted",
        "pegasus",
        "T1622 - Debugger Evasion",
        "wmi string",
        "windows nt",
        "request email",
        "apple",
        "search",
        "server",
        "resolutions",
        "san francisco",
        "route",
        "server ca",
        "sha2 secure",
        "show technique",
        "sign",
        "sprint personal",
        "status",
        "ssl certificate",
        "stateprovince",
        "text",
        "test",
        "subdomains",
        "surry hills",
        "teams api",
        "uknown",
        "threat analyzer",
        "threat",
        "target",
        "tsara brashears",
        "united",
        "urls",
        "win64",
        "windir",
        "urls http",
        "v3 serial",
        "validity",
        "referrer",
        "registrar abuse",
        "report",
        "report registrar abuse",
        "ransomware",
        "record value",
        "programfiles",
        "priority",
        "port scan",
        "pe32",
        "pegasus",
        "pe resource",
        "path",
        "paste",
        "passive dns",
        "password",
        "orgtechhandle",
        "orgtechphone",
        "orgtechref",
        "open",
        "orgabusehandle",
        "orgabuseref",
        "asn asn",
        "asn database",
        "bernhardplein",
        "big tech",
        "body xml",
        "body",
        "xml",
        "ck id",
        "cloudflare",
        "as8100",
        "akamai as36786",
        "as16625",
        "arin",
        "analyze",
        "api ip",
        "amazons3",
        "akamaias",
        "akamai",
        "aibv hostmaster",
        "access type",
        "abuse contact",
        "audiologist inc",
        "nothing number",
        "united",
        "brashears",
        "verdict",
        "net10464001",
        "new ioc",
        "next noc",
        "bv",
        "bv  orgid cambridge",
        "cambridge",
        "certificate",
        "certificate city",
        "ck id",
        "city",
        "brute force",
        "communicating",
        "copy core",
        "copy",
        "core",
        "cus",
        "cndigicert",
        "date",
        "detections",
        "detection type",
        "dhs discover",
        "dns",
        "discover",
        "hallrender",
        "briansabey",
        "brian sabey",
        "hall render",
        "dhs",
        "domain name",
        "download",
        "download sample",
        "email",
        "europeberlin",
        "execution",
        "falcon",
        "falcon sandbox",
        "false",
        "feeds",
        "feeds ioc",
        "first",
        "form",
        "frankfurt",
        "full name",
        "gameskinny",
        "gecko",
        "germany",
        "getprocaddress",
        "hacktool",
        "historical ssl",
        "hostnames",
        "hybrid",
        "ibm",
        "ibm business",
        "installer",
        "installer internet",
        "ioc search",
        "iocs",
        "ip address",
        "ip geolocation",
        "stealer",
        "ipinfo",
        "issuer",
        "javascript",
        "jb",
        "jb country",
        "khtml",
        "lazarus",
        "little",
        "lolkek",
        "main",
        "makop",
        "markmonitor",
        "microsoft",
        "mitre att",
        "ms windows",
        "name name"
      ],
      "references": [
        "uat.identityssl.newscdn.com.au",
        "gameskinny.com",
        "https://hybrid-analysis.com/sample/7ba985d328ac4d9be47826ae3f98b513ca00b1609d82fe1d4aa365e7cfb54f48",
        "https://hybrid-analysis.com/sample/55af17e7ea6e0884ed102bb2cb21844ab2bf3330dd46aace4c736be5c55b0257/658d97df7e57b7b66c00b342"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "BRASHEARS",
          "display_name": "BRASHEARS",
          "target": null
        },
        {
          "id": "Makop Ransomware",
          "display_name": "Makop Ransomware",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Lazarus",
          "display_name": "Lazarus",
          "target": null
        },
        {
          "id": "Little",
          "display_name": "Little",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1559",
          "name": "Inter-Process Communication",
          "display_name": "T1559 - Inter-Process Communication"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2108,
        "FileHash-SHA1": 1248,
        "domain": 668,
        "hostname": 1340,
        "URL": 2652,
        "FileHash-SHA256": 1070,
        "email": 25,
        "CIDR": 4
      },
      "indicator_count": 9115,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "813 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658ef84e3324dfdb9d16bd73",
      "name": "Makop | Lazarus | Spyware (if it looks like a Pegasus...)",
      "description": "",
      "modified": "2024-01-27T18:02:23.517000",
      "created": "2023-12-29T16:48:15",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "iocs",
        "ipv4",
        "filehashmd5",
        "next",
        "scan endpoints",
        "all octoseek",
        "url http",
        "url https",
        "create new",
        "deptid24124",
        "deptid23922",
        "deptid23936",
        "sid339",
        "filehashsha256",
        "navmode3",
        "ommidsf3558",
        "usbuy no",
        "type33554433",
        "guid",
        "smauthreason0",
        "methodhead",
        "targetsmhttps",
        "exact",
        "a9 no",
        "langid1",
        "actmsgs1",
        "christmas",
        "pinlbtn",
        "pinl2",
        "uidtokenhttps",
        "pulse use",
        "pdf report",
        "pcap",
        "stix",
        "filehashsha1",
        "email",
        "contact",
        "contacted",
        "pegasus",
        "T1622 - Debugger Evasion",
        "wmi string",
        "windows nt",
        "request email",
        "apple",
        "search",
        "server",
        "resolutions",
        "san francisco",
        "route",
        "server ca",
        "sha2 secure",
        "show technique",
        "sign",
        "sprint personal",
        "status",
        "ssl certificate",
        "stateprovince",
        "text",
        "test",
        "subdomains",
        "surry hills",
        "teams api",
        "uknown",
        "threat analyzer",
        "threat",
        "target",
        "tsara brashears",
        "united",
        "urls",
        "win64",
        "windir",
        "urls http",
        "v3 serial",
        "validity",
        "referrer",
        "registrar abuse",
        "report",
        "report registrar abuse",
        "ransomware",
        "record value",
        "programfiles",
        "priority",
        "port scan",
        "pe32",
        "pegasus",
        "pe resource",
        "path",
        "paste",
        "passive dns",
        "password",
        "orgtechhandle",
        "orgtechphone",
        "orgtechref",
        "open",
        "orgabusehandle",
        "orgabuseref",
        "asn asn",
        "asn database",
        "bernhardplein",
        "big tech",
        "body xml",
        "body",
        "xml",
        "ck id",
        "cloudflare",
        "as8100",
        "akamai as36786",
        "as16625",
        "arin",
        "analyze",
        "api ip",
        "amazons3",
        "akamaias",
        "akamai",
        "aibv hostmaster",
        "access type",
        "abuse contact",
        "audiologist inc",
        "nothing number",
        "united",
        "brashears",
        "verdict",
        "net10464001",
        "new ioc",
        "next noc",
        "bv",
        "bv  orgid cambridge",
        "cambridge",
        "certificate",
        "certificate city",
        "ck id",
        "city",
        "brute force",
        "communicating",
        "copy core",
        "copy",
        "core",
        "cus",
        "cndigicert",
        "date",
        "detections",
        "detection type",
        "dhs discover",
        "dns",
        "discover",
        "hallrender",
        "briansabey",
        "brian sabey",
        "hall render",
        "dhs",
        "domain name",
        "download",
        "download sample",
        "email",
        "europeberlin",
        "execution",
        "falcon",
        "falcon sandbox",
        "false",
        "feeds",
        "feeds ioc",
        "first",
        "form",
        "frankfurt",
        "full name",
        "gameskinny",
        "gecko",
        "germany",
        "getprocaddress",
        "hacktool",
        "historical ssl",
        "hostnames",
        "hybrid",
        "ibm",
        "ibm business",
        "installer",
        "installer internet",
        "ioc search",
        "iocs",
        "ip address",
        "ip geolocation",
        "stealer",
        "ipinfo",
        "issuer",
        "javascript",
        "jb",
        "jb country",
        "khtml",
        "lazarus",
        "little",
        "lolkek",
        "main",
        "makop",
        "markmonitor",
        "microsoft",
        "mitre att",
        "ms windows",
        "name name"
      ],
      "references": [
        "uat.identityssl.newscdn.com.au",
        "gameskinny.com",
        "https://hybrid-analysis.com/sample/7ba985d328ac4d9be47826ae3f98b513ca00b1609d82fe1d4aa365e7cfb54f48",
        "https://hybrid-analysis.com/sample/55af17e7ea6e0884ed102bb2cb21844ab2bf3330dd46aace4c736be5c55b0257/658d97df7e57b7b66c00b342"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "BRASHEARS",
          "display_name": "BRASHEARS",
          "target": null
        },
        {
          "id": "Makop Ransomware",
          "display_name": "Makop Ransomware",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Lazarus",
          "display_name": "Lazarus",
          "target": null
        },
        {
          "id": "Little",
          "display_name": "Little",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1559",
          "name": "Inter-Process Communication",
          "display_name": "T1559 - Inter-Process Communication"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "658dd276d03bca9b7a93b724",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2108,
        "FileHash-SHA1": 1248,
        "domain": 668,
        "hostname": 1340,
        "URL": 2652,
        "FileHash-SHA256": 1070,
        "email": 25,
        "CIDR": 4
      },
      "indicator_count": 9115,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "813 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mobqa03.botw.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mobqa03.botw.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631722.098146
}