{
  "type": "URL",
  "indicator": "https://nextcloud.delterserver.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://nextcloud.delterserver.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4136926947,
      "indicator": "https://nextcloud.delterserver.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68dda4bcade283258f6ed707",
          "name": "Delta Server - Phishing",
          "description": "Related to FBI.gov and maliciously coded image found on Google image search result on a fully updated yet hacked iOS device.",
          "modified": "2025-10-31T21:05:05.615000",
          "created": "2025-10-01T22:01:32.571000",
          "tags": [
            "related pulses",
            "delta server",
            "phishing",
            "fbi.gov?",
            "hacked images",
            "gogle",
            "google search",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "access att",
            "windows nt",
            "size",
            "mitre att",
            "path",
            "general",
            "local",
            "click",
            "strings",
            "dynamicloader",
            "eke eekeeeke",
            "eeye",
            "eekeee ee",
            "eekeeeke eekeee",
            "search",
            "delete",
            "yara detections",
            "eeeee e",
            "yara rule",
            "write",
            "trojan",
            "dynamic_loading_function",
            "command_and_control"
          ],
          "references": [
            "http://autoconfig.delterserver.org/",
            "https://hybrid-analysis.com/sample/904630d9e73c404a0581c822970935ae49940d09402a55d96712293baa5e8061/68dd9a7397836f17be0d1485",
            "Yara Detections: stack_string ,  case_4485_ekix4 Alerts: procmem_yara dynamic_function_loading",
            "Alerts: network_cnc_https_generic",
            "Alerts : dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Contacted  104.20.151.16",
            "Alerts: dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Domains Contacted : 104.20.151.16"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 463,
            "domain": 60,
            "hostname": 210,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 85,
            "FileHash-SHA256": 203,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 1073,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68dd9423f9208dcc8701e12e",
          "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
          "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
          "modified": "2025-10-31T19:03:21.338000",
          "created": "2025-10-01T20:50:43.002000",
          "tags": [
            "iocs",
            "logo",
            "passive dns",
            "related tags",
            "none google",
            "ipv4",
            "gogle",
            "twitter",
            "x.com",
            "ransomware",
            "fbi \u2019site\u2019",
            "python",
            "cloud",
            "regopenkeyexw",
            "read c",
            "port",
            "destination",
            "cryptexportkey",
            "count read",
            "tor get",
            "malware",
            "write",
            "format",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "country",
            "postal code",
            "organization",
            "date",
            "email",
            "code",
            "aaaa",
            "value a",
            "key identifier",
            "v3 serial",
            "number",
            "cus ogoogle",
            "trust",
            "cnwe1 validity",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "maktub",
            "cnc",
            "python-projekt",
            "x post",
            "link",
            "android",
            "iphone",
            "google",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "ssl certificate",
            "spawns",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "mitre att",
            "show technique",
            "ck matrix",
            "title",
            "path",
            "hybrid",
            "general",
            "local",
            "form",
            "click",
            "strings",
            "body"
          ],
          "references": [
            "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
            "Entity CLOUD14",
            "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
            "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
            "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
            "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
            "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
            "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
            "Yara Detections: stack_string Alerts: dead_host",
            "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
            "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
            "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Code Virus Ransomware",
              "display_name": "Code Virus Ransomware",
              "target": null
            },
            {
              "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "target": null
            },
            {
              "id": "CLAMAV - Win.Malware.Cabby-6803812",
              "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
              "target": null
            },
            {
              "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 574,
            "domain": 147,
            "FileHash-MD5": 156,
            "FileHash-SHA1": 130,
            "FileHash-SHA256": 539,
            "URL": 982,
            "SSLCertFingerprint": 4,
            "email": 2
          },
          "indicator_count": 2534,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Alerts : dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Contacted  104.20.151.16",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "Entity CLOUD14",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception",
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "https://hybrid-analysis.com/sample/904630d9e73c404a0581c822970935ae49940d09402a55d96712293baa5e8061/68dd9a7397836f17be0d1485",
        "Alerts: network_cnc_https_generic",
        "Yara Detections: stack_string ,  case_4485_ekix4 Alerts: procmem_yara dynamic_function_loading",
        "Alerts: dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Domains Contacted : 104.20.151.16",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
        "http://autoconfig.delterserver.org/",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "Yara Detections: stack_string Alerts: dead_host"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Clamav - win.malware.cabby-6803812",
            "Avast- win32:filecoder-ad\\ [trj]",
            "Ms defender - trojandownloader:win32/dalexis!rfn!rfn",
            "Code virus ransomware"
          ],
          "industries": [],
          "unique_indicators": 3488
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/delterserver.org",
    "whois": "http://whois.domaintools.com/delterserver.org",
    "domain": "delterserver.org",
    "hostname": "nextcloud.delterserver.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68dda4bcade283258f6ed707",
      "name": "Delta Server - Phishing",
      "description": "Related to FBI.gov and maliciously coded image found on Google image search result on a fully updated yet hacked iOS device.",
      "modified": "2025-10-31T21:05:05.615000",
      "created": "2025-10-01T22:01:32.571000",
      "tags": [
        "related pulses",
        "delta server",
        "phishing",
        "fbi.gov?",
        "hacked images",
        "gogle",
        "google search",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "access att",
        "windows nt",
        "size",
        "mitre att",
        "path",
        "general",
        "local",
        "click",
        "strings",
        "dynamicloader",
        "eke eekeeeke",
        "eeye",
        "eekeee ee",
        "eekeeeke eekeee",
        "search",
        "delete",
        "yara detections",
        "eeeee e",
        "yara rule",
        "write",
        "trojan",
        "dynamic_loading_function",
        "command_and_control"
      ],
      "references": [
        "http://autoconfig.delterserver.org/",
        "https://hybrid-analysis.com/sample/904630d9e73c404a0581c822970935ae49940d09402a55d96712293baa5e8061/68dd9a7397836f17be0d1485",
        "Yara Detections: stack_string ,  case_4485_ekix4 Alerts: procmem_yara dynamic_function_loading",
        "Alerts: network_cnc_https_generic",
        "Alerts : dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Contacted  104.20.151.16",
        "Alerts: dead_connect antidebug_setunhandledexceptionfilter exec_crash IP\u2019s Domains Contacted : 104.20.151.16"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 463,
        "domain": 60,
        "hostname": 210,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 85,
        "FileHash-SHA256": 203,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 1073,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68dd9423f9208dcc8701e12e",
      "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
      "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
      "modified": "2025-10-31T19:03:21.338000",
      "created": "2025-10-01T20:50:43.002000",
      "tags": [
        "iocs",
        "logo",
        "passive dns",
        "related tags",
        "none google",
        "ipv4",
        "gogle",
        "twitter",
        "x.com",
        "ransomware",
        "fbi \u2019site\u2019",
        "python",
        "cloud",
        "regopenkeyexw",
        "read c",
        "port",
        "destination",
        "cryptexportkey",
        "count read",
        "tor get",
        "malware",
        "write",
        "format",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "country",
        "postal code",
        "organization",
        "date",
        "email",
        "code",
        "aaaa",
        "value a",
        "key identifier",
        "v3 serial",
        "number",
        "cus ogoogle",
        "trust",
        "cnwe1 validity",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "maktub",
        "cnc",
        "python-projekt",
        "x post",
        "link",
        "android",
        "iphone",
        "google",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "ssl certificate",
        "spawns",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "mitre att",
        "show technique",
        "ck matrix",
        "title",
        "path",
        "hybrid",
        "general",
        "local",
        "form",
        "click",
        "strings",
        "body"
      ],
      "references": [
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "Entity CLOUD14",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "Yara Detections: stack_string Alerts: dead_host",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Code Virus Ransomware",
          "display_name": "Code Virus Ransomware",
          "target": null
        },
        {
          "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "target": null
        },
        {
          "id": "CLAMAV - Win.Malware.Cabby-6803812",
          "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
          "target": null
        },
        {
          "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 574,
        "domain": 147,
        "FileHash-MD5": 156,
        "FileHash-SHA1": 130,
        "FileHash-SHA256": 539,
        "URL": 982,
        "SSLCertFingerprint": 4,
        "email": 2
      },
      "indicator_count": 2534,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://nextcloud.delterserver.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://nextcloud.delterserver.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641059.5477593
}