{
  "type": "URL",
  "indicator": "https://ns-1024.awsdns-00.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns-1024.awsdns-00.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2905212382,
      "indicator": "https://ns-1024.awsdns-00.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "689cc89e77327602780be49e",
          "name": "Remotewd Devices \u2022 Spectrum / Charter Communications & AT&T",
          "description": "Remotewd Devices expanded \u2022 Spectrum / Charter Communications & AT&T.\nAdvesarial. Polymorphic.",
          "modified": "2025-09-12T16:05:33.542000",
          "created": "2025-08-13T17:17:18.456000",
          "tags": [
            "url https",
            "domain",
            "types of",
            "united kingdom",
            "sweden",
            "virgin islands",
            "china",
            "germany",
            "date",
            "status",
            "ip address",
            "search",
            "domain add",
            "passive dns",
            "urls",
            "files",
            "error sep",
            "present jul",
            "address google",
            "safe browsing",
            "united",
            "unknown ns",
            "moved",
            "body",
            "cloudfront x",
            "hio52 p1",
            "certificate",
            "win32",
            "trojan",
            "entries",
            "next associated",
            "title error",
            "ipv4",
            "host gh",
            "secure path",
            "httponly cache",
            "x github",
            "request id",
            "accept",
            "encrypt",
            "formbook cnc",
            "checkin",
            "a domains",
            "lowfi",
            "mtb jun",
            "github pages",
            "as11427",
            "us note",
            "route",
            "ptr record",
            "hostname add",
            "url analysis",
            "verdict",
            "general info",
            "geo mckinney",
            "texas",
            "spectrum",
            "charter communications",
            "charter collection",
            "auth",
            "files ip",
            "address",
            "asn as16509",
            "record value",
            "germany unknown",
            "meta",
            "gmt cache",
            "sans400",
            "condensed300",
            "feel lost",
            "h1 div",
            "server",
            "gmt connection",
            "keep alive",
            "pragma",
            "ipv4 add",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "unknown aaaa",
            "china unknown",
            "beijing",
            "unknown soa",
            "hostname",
            "present aug",
            "name servers",
            "aaaa",
            "windows nt",
            "dynamicloader",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "host",
            "medium",
            "write",
            "markus",
            "malware",
            "files domain",
            "files related",
            "related tags",
            "none google",
            "showing",
            "error",
            "extraction",
            "se enter",
            "sc type",
            "data upload",
            "failed",
            "extr data",
            "ox sunnort",
            "include review",
            "exclude data",
            "iocs",
            "pdf report",
            "pcap",
            "stix",
            "openloc",
            "pul data",
            "move",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "pattern match",
            "ascii text",
            "show technique",
            "null",
            "refresh",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "class",
            "adversaries",
            "defense evasion",
            "initial access",
            "msie",
            "chrome",
            "gmt content",
            "main",
            "virtool",
            "idran anv",
            "exti",
            "concor referen",
            "running webserver",
            "review iocs",
            "suggested iocs",
            "show",
            "http traffic",
            "intel",
            "ms windows",
            "pe32",
            "high",
            "write c",
            "explorer",
            "unknown",
            "worm",
            "next",
            "comman_and_control",
            "et",
            "vtapi",
            "dos",
            "persistence",
            "polymorphic",
            "virus",
            "device",
            "script",
            "style",
            "endcolorstr",
            "regexp",
            "link",
            "powershell",
            "form",
            "push",
            "active",
            "remote_access",
            "general full",
            "protocol h2",
            "security tls",
            "austin",
            "asn7018",
            "attinternet4",
            "reverse dns",
            "software",
            "domains",
            "hashes",
            "at&t",
            "injection",
            "rwx",
            "hackers",
            "attack",
            "cape",
            "stealth hidden extension",
            "antivm generic",
            "cape detected",
            "threat stealth",
            "public folder",
            "deletes",
            "files anomalous",
            "disables system",
            "restore dead",
            "mail procmem",
            "yara suricata",
            "queries user name"
          ],
          "references": [
            "Remotewd.com research - Devices under command and control. Malicious / adversarial | 3000 + devices in Pulse",
            "https://hybrid-analysis.com/sample/713944cb1accb541622bf99d55f34876b5ff13d042c6c203bab89632a15b9248/689c0eca8dd0033cbb064d12",
            "device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com TWC-11427-TEXAS, US \u2022 Spectrum",
            "Geo\tMcKinney, Texas, United States (US) \u2014  AS \u2022AS11427 - TWC-11427-TEXAS, US",
            "Note: An IP might be announced by multiple ASs.Spectrum | Charter Communications",
            "This is not shown. Route \u2022 184.92.0.0/16 (Route of ASN) PTR",
            "syn-184-092-221-096.res.spectrum.com(PTR record of primary IP) IPv4\t184.92.221.96",
            "https://urlscan.io/domain/device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com",
            "truist.palantirfoundry.com \u2022 nissansandbox.palantirfoundry.com",
            "device-7de2fab7-44a1-494e-8f36-8d135628c33a.remotewd.com 104.190.139.162 AT&T",
            "Stealth Hiddenreg Cape Detected Threat Stealth Timeout Accesses Public Folder Deletes",
            "Executed Files Anomalous Deletefile Dropper Disables System Restore Dead Connect",
            "Infostealer Cookies Infostealer Mail Procmem Yara Suricata Alert Modify Proxy Powershell",
            "Ransomware File Modifications Exec Crash",
            "Location Antisandbox Sleep Antidebug Setunhandledexceptionfilter Packer Unknown Pe Section Name Packer Entropy Network Bind Antivm Network Adapters Http Request Infostealer Browser Recon Fingerprint Antivm Checks Available Memory Antivm Generic Bios Reads Self Polymorphic Enumerates Physical Drives Network Http Network Cnc Http Antivm Bochs Keys",
            "Request Queries Keyboard Layout Antivm Generic Disk Resumethread",
            "Remote Process Static Pe Anomaly Https Urls Virus Process Creation Suspicious",
            "Contains Pe Overlay Queries Locale Api Language Check Registry"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Vflooder",
              "display_name": "Trojan:Win32/Vflooder",
              "target": "/malware/Trojan:Win32/Vflooder"
            },
            {
              "id": "Worm:Win32/Lightmoon.H",
              "display_name": "Worm:Win32/Lightmoon.H",
              "target": "/malware/Worm:Win32/Lightmoon.H"
            },
            {
              "id": "VirTool:Win32/Obfuscator.JM",
              "display_name": "VirTool:Win32/Obfuscator.JM",
              "target": "/malware/VirTool:Win32/Obfuscator.JM"
            },
            {
              "id": "Win.Trojan.Cycbot-1584",
              "display_name": "Win.Trojan.Cycbot-1584",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6171,
            "domain": 1823,
            "hostname": 3155,
            "email": 8,
            "FileHash-SHA256": 950,
            "FileHash-MD5": 345,
            "FileHash-SHA1": 317,
            "CVE": 1,
            "CIDR": 1,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 12772,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "218 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b2909ffdc623904cbfd91d",
          "name": "PEXE - DOS executable (COM)",
          "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-25T16:47:26.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757a662a146889c60b6c",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:10.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757d6dd7dae344aed3f5",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:13.209000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85dca7d8bf0aea33abc3a",
          "name": "PEXE - DOS executable ",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-30T02:24:10.454000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b4757a662a146889c60b6c",
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658303b7e2b4417d9e24a7cc",
          "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
          "description": "",
          "modified": "2024-01-19T12:02:13.495000",
          "created": "2023-12-20T15:09:43.783000",
          "tags": [
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha1",
            "sha256",
            "runtime process",
            "date",
            "unknown",
            "error",
            "path",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "accept",
            "url http",
            "filehashmd5",
            "url https",
            "search otx",
            "octoseek report",
            "spam author",
            "reddit",
            "tulach c2",
            "created",
            "minutes ago",
            "added active",
            "related pulses",
            "am",
            "no expiration",
            "indicator role",
            "pulses url",
            "showing",
            "entries",
            "dded active",
            "copyright",
            "reserved",
            "cve cve20170199",
            "win32 exe",
            "android",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "headers",
            "manager",
            "files",
            "detections type",
            "name",
            "lord krishna",
            "right",
            "tjprojmain",
            "windows",
            "secure",
            "headers nel",
            "ssl certificate",
            "whois whois",
            "historical ssl",
            "referrer",
            "logistics",
            "cyber defense",
            "firm collection",
            "ioc honeypot",
            "list for",
            "malware",
            "open",
            "attack",
            "contacted",
            "dropped",
            "bundled",
            "problems",
            "whois record",
            "domains",
            "execution",
            "agent tesla",
            "azorult",
            "project",
            "startpage",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "magic pe32",
            "installer",
            "compiler",
            "nsis",
            "serial number",
            "g4 code",
            "signing rsa4096",
            "sha384",
            "root g4",
            "valid from",
            "algorithm",
            "thumbprint",
            "fast corporate",
            "from",
            "pe resource",
            "collection",
            "vt graph",
            "paulsmith",
            "apple tv",
            "apple music",
            "$RTD4NQU.exe",
            "no data",
            "tag count",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "iocs",
            "summary",
            "nisis",
            "executable",
            "ms windows",
            "trid win64",
            "generic",
            "sections",
            "sha256 file",
            "type type",
            "chi2",
            "dkey english",
            "xml rtmanifest",
            "english us",
            "overlay",
            "learn",
            "botnet",
            "honeypot",
            "ejkaej saBey k7-^Oa"
          ],
          "references": [
            "https://www.reddit.com/user/",
            "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
            "Gowi Live Bot.exe",
            "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
            "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
            "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
            "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
            "tv.apple.com [Apple Backdoor| Attack | Hacking]",
            "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
            "browser.events.data.msn.com | events-sandbox.data.msn.com",
            "https://tulach.cc/ [phishing attacks]",
            "tulach.cc [AM | phishing]",
            "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
            "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
            "3.163.189.120    [Tracking]",
            "86.140.232.148  [scanning_host]",
            "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
            "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
            "checkip.dyndns.org    [command_and_control]",
            "104.86.182.8          [command_and_control]",
            "103.224.182.253    [command_and_control]",
            "103.224.182.246    [command_and_control]",
            "www.supernetforme.com    [command_and_control]",
            "rp.downloadastrocdn.com   [command_and_control]",
            "ddos.dnsnb8.net   [command_and_control]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "AM",
              "display_name": "AM",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "adware.pcappstore/veryfast",
              "display_name": "adware.pcappstore/veryfast",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Static AI - Malicious PE",
              "display_name": "Static AI - Malicious PE",
              "target": null
            },
            {
              "id": "HoneyPot",
              "display_name": "HoneyPot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 392,
            "FileHash-SHA1": 374,
            "FileHash-SHA256": 5560,
            "URL": 7433,
            "domain": 1461,
            "hostname": 2463,
            "CVE": 3,
            "email": 1
          },
          "indicator_count": 17687,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655dafbe9ac9ac786fde45ad",
          "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
          "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
          "modified": "2023-12-22T06:03:01.993000",
          "created": "2023-11-22T07:37:34.595000",
          "tags": [
            "united",
            "as22612",
            "as2637",
            "creation date",
            "search",
            "moved",
            "expiration date",
            "date",
            "showing",
            "as397240",
            "next",
            "entries",
            "scan endpoints",
            "all octoseek",
            "dns replication",
            "win32 exe",
            "network capture",
            "android",
            "android adaway",
            "html",
            "files",
            "detections type",
            "name",
            "office open",
            "xml document",
            "namecheap",
            "namecheap inc",
            "whois lookups",
            "win32 dll",
            "text",
            "wextract",
            "text htaccess",
            "powershell",
            "detection list",
            "blacklist",
            "first",
            "ssl certificate",
            "whois record",
            "contacted",
            "december",
            "whois whois",
            "threat roundup",
            "historical ssl",
            "problems",
            "referrer",
            "pe resource",
            "startpage",
            "cyber threat",
            "redline stealer",
            "mail spammer",
            "hostname",
            "phishing site",
            "malicious site",
            "installcore",
            "http spammer",
            "malware site",
            "malware",
            "generic malware",
            "heur",
            "generic",
            "alexa top",
            "million",
            "site",
            "cisco umbrella",
            "alexa",
            "ip address",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cat cnzerossl",
            "ecc domain",
            "secure site",
            "ca ozerossl",
            "validity",
            "subject public",
            "server",
            "email",
            "code",
            "registrar abuse",
            "country",
            "privacy service",
            "withheld",
            "privacy",
            "domain name",
            "pattern match",
            "ascii text",
            "appdata",
            "file",
            "windows nt",
            "svg scalable",
            "vector graphics",
            "indicator",
            "gif image",
            "accept",
            "hybrid",
            "general",
            "local",
            "pixel",
            "click",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "command_and_control",
            "spyware",
            "tracking",
            "voicemail access",
            "dga",
            "apple"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
            "\u2193Interesting\u2193",
            "IPv4 198.54.117.211 command_and_control",
            "IPv4 198.54.117.210 command_and_control",
            "IPv4 198.54.117.212 command_and_control",
            "IPv4 198.54.117.215 command_and_control",
            "IPv4 198.54.117.217 command_and_control",
            "IPv4 198.54.117.218 command_and_control",
            "apple-securityiphone-icloud.com",
            "tx-p2p-pull.video-voip.com.dorm.com",
            "http://updates.voicemailaccess.net/b0f6a00b15311023",
            "tvapp-server.de",
            "zeustracker.abuse.ch",
            "ransomwaretracker.abuse.ch",
            "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
            "louisianarooflawyers.com         [phishing]",
            "hasownproperty.call"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 105,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 3072,
            "domain": 1188,
            "email": 5,
            "URL": 7940,
            "hostname": 1925,
            "CVE": 1
          },
          "indicator_count": 14336,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "849 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "627dc2b351508c06ee07883d",
          "name": "BestCoinTrust@polybest.io",
          "description": "",
          "modified": "2022-05-13T02:57:10.184000",
          "created": "2022-05-13T02:30:11.080000",
          "tags": [
            "date",
            "status",
            "passive dns",
            "urls",
            "files ip",
            "address",
            "less whois",
            "registrar",
            "creation date",
            "pulses",
            "virustotal",
            "unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "61bae37ed6f0bec920be0668",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "BestCoinTrust0x",
            "id": "192725",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 598,
            "domain": 375,
            "URL": 563,
            "FileHash-SHA256": 5,
            "email": 1
          },
          "indicator_count": 1542,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1,
          "modified_text": "1437 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "checkip.dyndns.org    [command_and_control]",
        "Geo\tMcKinney, Texas, United States (US) \u2014  AS \u2022AS11427 - TWC-11427-TEXAS, US",
        "Note: An IP might be announced by multiple ASs.Spectrum | Charter Communications",
        "3.163.189.120    [Tracking]",
        "IPv4 198.54.117.218 command_and_control",
        "Request Queries Keyboard Layout Antivm Generic Disk Resumethread",
        "103.224.182.253    [command_and_control]",
        "IPv4 198.54.117.210 command_and_control",
        "Infostealer Cookies Infostealer Mail Procmem Yara Suricata Alert Modify Proxy Powershell",
        "IPv4 198.54.117.215 command_and_control",
        "http://sexkompas.xyz",
        "86.140.232.148  [scanning_host]",
        "\u2193Interesting\u2193",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "Stealth Hiddenreg Cape Detected Threat Stealth Timeout Accesses Public Folder Deletes",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "IPv4 198.54.117.217 command_and_control",
        "syn-184-092-221-096.res.spectrum.com(PTR record of primary IP) IPv4\t184.92.221.96",
        "device-7de2fab7-44a1-494e-8f36-8d135628c33a.remotewd.com 104.190.139.162 AT&T",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "Location Antisandbox Sleep Antidebug Setunhandledexceptionfilter Packer Unknown Pe Section Name Packer Entropy Network Bind Antivm Network Adapters Http Request Infostealer Browser Recon Fingerprint Antivm Checks Available Memory Antivm Generic Bios Reads Self Polymorphic Enumerates Physical Drives Network Http Network Cnc Http Antivm Bochs Keys",
        "https://www.reddit.com/user/",
        "apple-securityiphone-icloud.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg",
        "IPv4 198.54.117.211 command_and_control",
        "IPv4 198.54.117.212 command_and_control",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Ransomware File Modifications Exec Crash",
        "104.86.182.8          [command_and_control]",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "rp.downloadastrocdn.com   [command_and_control]",
        "https://urlscan.io/domain/device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com",
        "https://tulach.cc/ [phishing attacks]",
        "Remote Process Static Pe Anomaly Https Urls Virus Process Creation Suspicious",
        "ransomwaretracker.abuse.ch",
        "Found in: https://jbplegal.com",
        "https://hybrid-analysis.com/sample/713944cb1accb541622bf99d55f34876b5ff13d042c6c203bab89632a15b9248/689c0eca8dd0033cbb064d12",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com TWC-11427-TEXAS, US \u2022 Spectrum",
        "tvapp-server.de",
        "103.224.182.246    [command_and_control]",
        "zeustracker.abuse.ch",
        "Gowi Live Bot.exe",
        "This is not shown. Route \u2022 184.92.0.0/16 (Route of ASN) PTR",
        "ddos.dnsnb8.net   [command_and_control]",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "PEXE - DOS executable (COM)",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "Executed Files Anomalous Deletefile Dropper Disables System Restore Dead Connect",
        "Contains Pe Overlay Queries Locale Api Language Check Registry",
        "louisianarooflawyers.com         [phishing]",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "truist.palantirfoundry.com \u2022 nissansandbox.palantirfoundry.com",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "tulach.cc [AM | phishing]",
        "www.supernetforme.com    [command_and_control]",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "Remotewd.com research - Devices under command and control. Malicious / adversarial | 3000 + devices in Pulse",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "hasownproperty.call"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Installcore",
            "Win.trojan.cycbot-1584",
            "Adware.pcappstore/veryfast",
            "Etpro",
            "Virtool:win32/obfuscator.jm",
            "Generic",
            "Static ai - malicious pe",
            "Worm:win32/lightmoon.h",
            "Trojan:win32/glupteba.mt!mtb",
            "Am",
            "Win32:injector-cvf\\ [trj]\t\twin.mal",
            "Win32:pwsx-gen",
            "Win.malware.vtflooder-6260355-1",
            "Agent tesla",
            "Win32:malware-gen",
            "Malware",
            "Nsis",
            "Trojan:win32/vflooder",
            "Blacknet",
            "Tulach malware",
            "Honeypot",
            "Win.trojan.buzus-5453"
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil society",
            "Legal",
            "Healthcare"
          ],
          "unique_indicators": 69199
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/awsdns-00.org",
    "whois": "http://whois.domaintools.com/awsdns-00.org",
    "domain": "awsdns-00.org",
    "hostname": "ns-1024.awsdns-00.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "689cc89e77327602780be49e",
      "name": "Remotewd Devices \u2022 Spectrum / Charter Communications & AT&T",
      "description": "Remotewd Devices expanded \u2022 Spectrum / Charter Communications & AT&T.\nAdvesarial. Polymorphic.",
      "modified": "2025-09-12T16:05:33.542000",
      "created": "2025-08-13T17:17:18.456000",
      "tags": [
        "url https",
        "domain",
        "types of",
        "united kingdom",
        "sweden",
        "virgin islands",
        "china",
        "germany",
        "date",
        "status",
        "ip address",
        "search",
        "domain add",
        "passive dns",
        "urls",
        "files",
        "error sep",
        "present jul",
        "address google",
        "safe browsing",
        "united",
        "unknown ns",
        "moved",
        "body",
        "cloudfront x",
        "hio52 p1",
        "certificate",
        "win32",
        "trojan",
        "entries",
        "next associated",
        "title error",
        "ipv4",
        "host gh",
        "secure path",
        "httponly cache",
        "x github",
        "request id",
        "accept",
        "encrypt",
        "formbook cnc",
        "checkin",
        "a domains",
        "lowfi",
        "mtb jun",
        "github pages",
        "as11427",
        "us note",
        "route",
        "ptr record",
        "hostname add",
        "url analysis",
        "verdict",
        "general info",
        "geo mckinney",
        "texas",
        "spectrum",
        "charter communications",
        "charter collection",
        "auth",
        "files ip",
        "address",
        "asn as16509",
        "record value",
        "germany unknown",
        "meta",
        "gmt cache",
        "sans400",
        "condensed300",
        "feel lost",
        "h1 div",
        "server",
        "gmt connection",
        "keep alive",
        "pragma",
        "ipv4 add",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "unknown aaaa",
        "china unknown",
        "beijing",
        "unknown soa",
        "hostname",
        "present aug",
        "name servers",
        "aaaa",
        "windows nt",
        "dynamicloader",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "host",
        "medium",
        "write",
        "markus",
        "malware",
        "files domain",
        "files related",
        "related tags",
        "none google",
        "showing",
        "error",
        "extraction",
        "se enter",
        "sc type",
        "data upload",
        "failed",
        "extr data",
        "ox sunnort",
        "include review",
        "exclude data",
        "iocs",
        "pdf report",
        "pcap",
        "stix",
        "openloc",
        "pul data",
        "move",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "pattern match",
        "ascii text",
        "show technique",
        "null",
        "refresh",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "class",
        "adversaries",
        "defense evasion",
        "initial access",
        "msie",
        "chrome",
        "gmt content",
        "main",
        "virtool",
        "idran anv",
        "exti",
        "concor referen",
        "running webserver",
        "review iocs",
        "suggested iocs",
        "show",
        "http traffic",
        "intel",
        "ms windows",
        "pe32",
        "high",
        "write c",
        "explorer",
        "unknown",
        "worm",
        "next",
        "comman_and_control",
        "et",
        "vtapi",
        "dos",
        "persistence",
        "polymorphic",
        "virus",
        "device",
        "script",
        "style",
        "endcolorstr",
        "regexp",
        "link",
        "powershell",
        "form",
        "push",
        "active",
        "remote_access",
        "general full",
        "protocol h2",
        "security tls",
        "austin",
        "asn7018",
        "attinternet4",
        "reverse dns",
        "software",
        "domains",
        "hashes",
        "at&t",
        "injection",
        "rwx",
        "hackers",
        "attack",
        "cape",
        "stealth hidden extension",
        "antivm generic",
        "cape detected",
        "threat stealth",
        "public folder",
        "deletes",
        "files anomalous",
        "disables system",
        "restore dead",
        "mail procmem",
        "yara suricata",
        "queries user name"
      ],
      "references": [
        "Remotewd.com research - Devices under command and control. Malicious / adversarial | 3000 + devices in Pulse",
        "https://hybrid-analysis.com/sample/713944cb1accb541622bf99d55f34876b5ff13d042c6c203bab89632a15b9248/689c0eca8dd0033cbb064d12",
        "device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com TWC-11427-TEXAS, US \u2022 Spectrum",
        "Geo\tMcKinney, Texas, United States (US) \u2014  AS \u2022AS11427 - TWC-11427-TEXAS, US",
        "Note: An IP might be announced by multiple ASs.Spectrum | Charter Communications",
        "This is not shown. Route \u2022 184.92.0.0/16 (Route of ASN) PTR",
        "syn-184-092-221-096.res.spectrum.com(PTR record of primary IP) IPv4\t184.92.221.96",
        "https://urlscan.io/domain/device-f016b9a7-792b-4b35-a277-04a408ab1703.remotewd.com",
        "truist.palantirfoundry.com \u2022 nissansandbox.palantirfoundry.com",
        "device-7de2fab7-44a1-494e-8f36-8d135628c33a.remotewd.com 104.190.139.162 AT&T",
        "Stealth Hiddenreg Cape Detected Threat Stealth Timeout Accesses Public Folder Deletes",
        "Executed Files Anomalous Deletefile Dropper Disables System Restore Dead Connect",
        "Infostealer Cookies Infostealer Mail Procmem Yara Suricata Alert Modify Proxy Powershell",
        "Ransomware File Modifications Exec Crash",
        "Location Antisandbox Sleep Antidebug Setunhandledexceptionfilter Packer Unknown Pe Section Name Packer Entropy Network Bind Antivm Network Adapters Http Request Infostealer Browser Recon Fingerprint Antivm Checks Available Memory Antivm Generic Bios Reads Self Polymorphic Enumerates Physical Drives Network Http Network Cnc Http Antivm Bochs Keys",
        "Request Queries Keyboard Layout Antivm Generic Disk Resumethread",
        "Remote Process Static Pe Anomaly Https Urls Virus Process Creation Suspicious",
        "Contains Pe Overlay Queries Locale Api Language Check Registry"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Vflooder",
          "display_name": "Trojan:Win32/Vflooder",
          "target": "/malware/Trojan:Win32/Vflooder"
        },
        {
          "id": "Worm:Win32/Lightmoon.H",
          "display_name": "Worm:Win32/Lightmoon.H",
          "target": "/malware/Worm:Win32/Lightmoon.H"
        },
        {
          "id": "VirTool:Win32/Obfuscator.JM",
          "display_name": "VirTool:Win32/Obfuscator.JM",
          "target": "/malware/VirTool:Win32/Obfuscator.JM"
        },
        {
          "id": "Win.Trojan.Cycbot-1584",
          "display_name": "Win.Trojan.Cycbot-1584",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6171,
        "domain": 1823,
        "hostname": 3155,
        "email": 8,
        "FileHash-SHA256": 950,
        "FileHash-MD5": 345,
        "FileHash-SHA1": 317,
        "CVE": 1,
        "CIDR": 1,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 12772,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "218 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b2909ffdc623904cbfd91d",
      "name": "PEXE - DOS executable (COM)",
      "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-25T16:47:26.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757a662a146889c60b6c",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:10.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757d6dd7dae344aed3f5",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:13.209000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85dca7d8bf0aea33abc3a",
      "name": "PEXE - DOS executable ",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-30T02:24:10.454000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b4757a662a146889c60b6c",
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658303b7e2b4417d9e24a7cc",
      "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
      "description": "",
      "modified": "2024-01-19T12:02:13.495000",
      "created": "2023-12-20T15:09:43.783000",
      "tags": [
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha1",
        "sha256",
        "runtime process",
        "date",
        "unknown",
        "error",
        "path",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "accept",
        "url http",
        "filehashmd5",
        "url https",
        "search otx",
        "octoseek report",
        "spam author",
        "reddit",
        "tulach c2",
        "created",
        "minutes ago",
        "added active",
        "related pulses",
        "am",
        "no expiration",
        "indicator role",
        "pulses url",
        "showing",
        "entries",
        "dded active",
        "copyright",
        "reserved",
        "cve cve20170199",
        "win32 exe",
        "android",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "headers",
        "manager",
        "files",
        "detections type",
        "name",
        "lord krishna",
        "right",
        "tjprojmain",
        "windows",
        "secure",
        "headers nel",
        "ssl certificate",
        "whois whois",
        "historical ssl",
        "referrer",
        "logistics",
        "cyber defense",
        "firm collection",
        "ioc honeypot",
        "list for",
        "malware",
        "open",
        "attack",
        "contacted",
        "dropped",
        "bundled",
        "problems",
        "whois record",
        "domains",
        "execution",
        "agent tesla",
        "azorult",
        "project",
        "startpage",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "magic pe32",
        "installer",
        "compiler",
        "nsis",
        "serial number",
        "g4 code",
        "signing rsa4096",
        "sha384",
        "root g4",
        "valid from",
        "algorithm",
        "thumbprint",
        "fast corporate",
        "from",
        "pe resource",
        "collection",
        "vt graph",
        "paulsmith",
        "apple tv",
        "apple music",
        "$RTD4NQU.exe",
        "no data",
        "tag count",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "iocs",
        "summary",
        "nisis",
        "executable",
        "ms windows",
        "trid win64",
        "generic",
        "sections",
        "sha256 file",
        "type type",
        "chi2",
        "dkey english",
        "xml rtmanifest",
        "english us",
        "overlay",
        "learn",
        "botnet",
        "honeypot",
        "ejkaej saBey k7-^Oa"
      ],
      "references": [
        "https://www.reddit.com/user/",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "Gowi Live Bot.exe",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "https://tulach.cc/ [phishing attacks]",
        "tulach.cc [AM | phishing]",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "3.163.189.120    [Tracking]",
        "86.140.232.148  [scanning_host]",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "checkip.dyndns.org    [command_and_control]",
        "104.86.182.8          [command_and_control]",
        "103.224.182.253    [command_and_control]",
        "103.224.182.246    [command_and_control]",
        "www.supernetforme.com    [command_and_control]",
        "rp.downloadastrocdn.com   [command_and_control]",
        "ddos.dnsnb8.net   [command_and_control]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "AM",
          "display_name": "AM",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "adware.pcappstore/veryfast",
          "display_name": "adware.pcappstore/veryfast",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Static AI - Malicious PE",
          "display_name": "Static AI - Malicious PE",
          "target": null
        },
        {
          "id": "HoneyPot",
          "display_name": "HoneyPot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 392,
        "FileHash-SHA1": 374,
        "FileHash-SHA256": 5560,
        "URL": 7433,
        "domain": 1461,
        "hostname": 2463,
        "CVE": 3,
        "email": 1
      },
      "indicator_count": 17687,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655dafbe9ac9ac786fde45ad",
      "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
      "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
      "modified": "2023-12-22T06:03:01.993000",
      "created": "2023-11-22T07:37:34.595000",
      "tags": [
        "united",
        "as22612",
        "as2637",
        "creation date",
        "search",
        "moved",
        "expiration date",
        "date",
        "showing",
        "as397240",
        "next",
        "entries",
        "scan endpoints",
        "all octoseek",
        "dns replication",
        "win32 exe",
        "network capture",
        "android",
        "android adaway",
        "html",
        "files",
        "detections type",
        "name",
        "office open",
        "xml document",
        "namecheap",
        "namecheap inc",
        "whois lookups",
        "win32 dll",
        "text",
        "wextract",
        "text htaccess",
        "powershell",
        "detection list",
        "blacklist",
        "first",
        "ssl certificate",
        "whois record",
        "contacted",
        "december",
        "whois whois",
        "threat roundup",
        "historical ssl",
        "problems",
        "referrer",
        "pe resource",
        "startpage",
        "cyber threat",
        "redline stealer",
        "mail spammer",
        "hostname",
        "phishing site",
        "malicious site",
        "installcore",
        "http spammer",
        "malware site",
        "malware",
        "generic malware",
        "heur",
        "generic",
        "alexa top",
        "million",
        "site",
        "cisco umbrella",
        "alexa",
        "ip address",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cat cnzerossl",
        "ecc domain",
        "secure site",
        "ca ozerossl",
        "validity",
        "subject public",
        "server",
        "email",
        "code",
        "registrar abuse",
        "country",
        "privacy service",
        "withheld",
        "privacy",
        "domain name",
        "pattern match",
        "ascii text",
        "appdata",
        "file",
        "windows nt",
        "svg scalable",
        "vector graphics",
        "indicator",
        "gif image",
        "accept",
        "hybrid",
        "general",
        "local",
        "pixel",
        "click",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "command_and_control",
        "spyware",
        "tracking",
        "voicemail access",
        "dga",
        "apple"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "\u2193Interesting\u2193",
        "IPv4 198.54.117.211 command_and_control",
        "IPv4 198.54.117.210 command_and_control",
        "IPv4 198.54.117.212 command_and_control",
        "IPv4 198.54.117.215 command_and_control",
        "IPv4 198.54.117.217 command_and_control",
        "IPv4 198.54.117.218 command_and_control",
        "apple-securityiphone-icloud.com",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "tvapp-server.de",
        "zeustracker.abuse.ch",
        "ransomwaretracker.abuse.ch",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "louisianarooflawyers.com         [phishing]",
        "hasownproperty.call"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 105,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 3072,
        "domain": 1188,
        "email": 5,
        "URL": 7940,
        "hostname": 1925,
        "CVE": 1
      },
      "indicator_count": 14336,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "849 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "627dc2b351508c06ee07883d",
      "name": "BestCoinTrust@polybest.io",
      "description": "",
      "modified": "2022-05-13T02:57:10.184000",
      "created": "2022-05-13T02:30:11.080000",
      "tags": [
        "date",
        "status",
        "passive dns",
        "urls",
        "files ip",
        "address",
        "less whois",
        "registrar",
        "creation date",
        "pulses",
        "virustotal",
        "unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "61bae37ed6f0bec920be0668",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "BestCoinTrust0x",
        "id": "192725",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 598,
        "domain": 375,
        "URL": 563,
        "FileHash-SHA256": 5,
        "email": 1
      },
      "indicator_count": 1542,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1,
      "modified_text": "1437 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns-1024.awsdns-00.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns-1024.awsdns-00.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776598718.8647084
}