{
  "type": "URL",
  "indicator": "https://omnitool.anjaco.com.es",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://omnitool.anjaco.com.es",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4177870172,
      "indicator": "https://omnitool.anjaco.com.es",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69770bdfbdd845a3d5cb2484",
          "name": "Drive-by Compromise | Rootkit installed on Apple Device",
          "description": "Drive-by Compromise | Rootkit installed on Apple Device | The devices in this example are obviously compromised. We tested a device another Apple device by viewing a Sprouts Farmers Market E-commerce website. The App crashed revealing the source of the issue. I admit that even though device is HEAVILY compromised by threat actors; it continued to preform.\nThis week the Apple devices have  experienced a series of BLACK & PINK stutters One had the letter \u2018P\u2019. The most important part of the research is who & why someone  targets victims of crime who are either deceased or catastrophically injured. One victims \u2018voice\u2019 has been captured and is now calling people she knew and creeping them out. \n\nAlso curious about the \u2018Hello\u2019 api lineages. Malware packed. Check-ins & Bot Network found.\n\n[OTX auto populated- Here is the full list of URLs from the 20th anniversary of the birth of Daylin Olson, who was born and raised in New York in the US, and who he is now.]\n\n#stop",
          "modified": "2026-02-25T06:02:12.072000",
          "created": "2026-01-26T06:38:23.334000",
          "tags": [
            "url https",
            "url http",
            "netherlands",
            "france",
            "united",
            "canada",
            "spain",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "title",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "meta",
            "form",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "ck matrix",
            "href",
            "network traffic",
            "encrypt",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "ssl certificate",
            "initial access",
            "zerobits",
            "allocationtype",
            "protect",
            "programfiles",
            "processhandle",
            "commitsize",
            "viewsize",
            "regionsize",
            "viewsize d5000",
            "viewsize c9000",
            "phishing",
            "filehandle",
            "report uid",
            "handles modules",
            "files amsi",
            "streams",
            "path filehandle",
            "porthandle",
            "modules files",
            "amsi streams",
            "accept",
            "starfield",
            "onload",
            "root",
            "backdoor",
            "passive dns",
            "next associated",
            "gmt location",
            "ipv4 add",
            "urls",
            "files",
            "search",
            "domain address",
            "markmonitor",
            "name server",
            "se referen",
            "ntprotec",
            "data upload",
            "extraction",
            "country",
            "overview dns",
            "requests domain",
            "date",
            "contacted hosts",
            "ip address",
            "defense evasion",
            "found",
            "size",
            "mask",
            "enterprise",
            "trojanspy",
            "checkin",
            "gmt content",
            "vercel x",
            "twitter",
            "trojan",
            "malware",
            "for privacy",
            "servers",
            "domains ii",
            "record value",
            "ca issuers",
            "unknown aaaa",
            "status",
            "present jul",
            "moved",
            "present jan",
            "present oct",
            "present sep",
            "unknown ns",
            "present dec",
            "ipv4",
            "url analysis",
            "location united",
            "1.25.26",
            "q.vashti pulse",
            "cloud",
            "foundry",
            "process details",
            "formbook cnc",
            "cape",
            "autoit",
            "high",
            "formbook",
            "yara rule",
            "delete",
            "get na",
            "write",
            "unknown",
            "copy",
            "autoit error",
            "autoIt paused",
            "global",
            "div div",
            "script script",
            "h6 div",
            "p div",
            "registrar",
            "project",
            "showing",
            "emails",
            "name servers",
            "ids detec",
            "domain",
            "hostname",
            "hello",
            "spyware"
          ],
          "references": [
            "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU",
            "NtProtectVirtualMemory@NTDLL.DLL",
            "66.33.60.130 command_and_control",
            "76.76.21.61 command_and_control",
            "IDS Detections Trojan.Generic.KDV.545753 Checkin",
            "https://communityinviter.com/apps/cloudfoundry/cloud-foundry",
            "http://cve.chainguard.dev",
            "http://partners.spycloud.com",
            "https://signin-pro-azure.crayon.com/signin-oidc",
            "Invalid IP (052.105.023.053)",
            "https://codesearch.criteois.com/opengrok/search?q=",
            "https://grok-chatbot.tapnetic.pro/$",
            "spywarewatchdog.org",
            "http://git.spywarewatchdog.org",
            "https://bot.dev.talos-systems.io/",
            "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Dropper.Gh0stRAT-10028210-0",
              "display_name": "Win.Dropper.Gh0stRAT-10028210-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Kanav.A",
              "display_name": "Backdoor:Win32/Kanav.A",
              "target": "/malware/Backdoor:Win32/Kanav.A"
            },
            {
              "id": "Win.Trojan.Upatre-3371",
              "display_name": "Win.Trojan.Upatre-3371",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Upatre.A",
              "display_name": "TrojanDownloader:Win32/Upatre.A",
              "target": "/malware/TrojanDownloader:Win32/Upatre.A"
            },
            {
              "id": "Win.Trojan.Upatre-3371",
              "display_name": "Win.Trojan.Upatre-3371",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Upatre.A",
              "display_name": "TrojanDownloader:Win32/Upatre.A",
              "target": "/malware/TrojanDownloader:Win32/Upatre.A"
            },
            {
              "id": "Win.Dropper.LokiBot-10010685-0",
              "display_name": "Win.Dropper.LokiBot-10010685-0",
              "target": null
            },
            {
              "id": "Win.Packed.Dapato-10021645-0",
              "display_name": "Win.Packed.Dapato-10021645-0",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.CW",
              "display_name": "TrojanSpy:Win32/Nivdort.CW",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
            },
            {
              "id": "Win.Packed.Malwarex-9792170-0",
              "display_name": "Win.Packed.Malwarex-9792170-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "AutoIt",
              "display_name": "AutoIt",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1016.001",
              "name": "Internet Connection Discovery",
              "display_name": "T1016.001 - Internet Connection Discovery"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1583.004",
              "name": "Server",
              "display_name": "T1583.004 - Server"
            },
            {
              "id": "T1078.004",
              "name": "Cloud Accounts",
              "display_name": "T1078.004 - Cloud Accounts"
            },
            {
              "id": "T1584.003",
              "name": "Virtual Private Server",
              "display_name": "T1584.003 - Virtual Private Server"
            }
          ],
          "industries": [
            "Ecommerce",
            "Government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6777,
            "domain": 907,
            "hostname": 2070,
            "FileHash-SHA256": 1120,
            "FileHash-MD5": 202,
            "FileHash-SHA1": 184,
            "SSLCertFingerprint": 23,
            "email": 4
          },
          "indicator_count": 11287,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "53 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6975c5cd4db6104ea1a3d69b",
          "name": "The Blender Foundation BouncyCastle-Virut | Malware /Stealer Empty FileHash |  Eternal7  (Shadow Broker) Related",
          "description": "Empty FileHash isn\u2019t benign. Interesting relationships to the Eternal 7. Malware, Stealer and Suspicious History File Operation. BouncyCastle-Virut PublicKeyToken=cc7b13ffcd 2ddd51 1D11.tmp Ultimate-Chicken-Horse- T1O SteamRIP.com.rarys / Startul ErrorPageTemplate[1] netcore, BouncyCastle.",
          "modified": "2026-02-24T06:02:43.853000",
          "created": "2026-01-25T07:27:09.640000",
          "tags": [
            "empty",
            "blender",
            "eurostile",
            "augustin",
            "butterfield",
            "cook",
            "drummer",
            "erickson",
            "fjsv",
            "flynn",
            "gorman",
            "holmes",
            "easy",
            "rada",
            "xanadu",
            "config",
            "reboot",
            "screen",
            "microsoft",
            "commerce server",
            "edition",
            "draw",
            "exchange server",
            "tools",
            "linux",
            "ideal link",
            "nsrl test",
            "nist",
            "file",
            "cultureneutral",
            "fix pack",
            "free download",
            "bouncycastle",
            "read c",
            "search",
            "et trojan",
            "w32kegotip cnc",
            "whitelisted",
            "ids detections",
            "intel",
            "write",
            "trojan",
            "malware",
            "yara detections",
            "productversion",
            "fileversion",
            "av detections",
            "alerts",
            "analysis date",
            "file score",
            "united",
            "aaaa",
            "passive dns",
            "ip address",
            "present dec",
            "body html",
            "head meta",
            "title",
            "urls",
            "url https",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "beacon",
            "et",
            "ipv4",
            "files",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "related pulses",
            "show",
            "win32virut",
            "destination",
            "port",
            "ms windows",
            "pe32",
            "medium",
            "suspicious",
            "virustotal",
            "startul",
            "shadowbrokers",
            "total",
            "delete",
            "artemis",
            "win32.injector",
            "trendmicro",
            "data upload",
            "extraction",
            "included iocs"
          ],
          "references": [
            "The Blender Foundation",
            "website \u2022 http://oldapps.com/blender.php?old_blender=7584",
            "oldapps \u2022 http://oldapps.com/blender.php?old_blender=7584?download",
            "Google android-cts-7.1_r6-linux_x86-arm.zip",
            "Google android-cts-7.1_r6-linux_x86-arm.zip",
            "android-cts-7.1_r6-linux_x86-arm.zip  [e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855]",
            "Empty FileHash - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "Empty FileHash -Matches rule Suspicious History File Operations by Mikhail Larin, oscd.community",
            "Empty FileHash - Malware,Stealer, Related to ShadowBrokers EternalRocks",
            "ET TROJAN W32/Kegotip CnC Beacon",
            "IDS Detections ET POLICY Suspicious User-Agent Containing .exe",
            "Extensions,.Trojan Age Win Version=4.2.0.168 Win32/1 Culture=neutral, amnit",
            "Virut PublicKeyToken=cc7b13ffcd 2ddd51 1D11.tmp Ultimate-Chicken-Horse- T1O SteamRIP.com.rarys /",
            "Startul ErrorPageTemplate[1] netcore, BouncyCastle.",
            "Secure Protocols: Provides APIs for TLS 1.3, S/MIME, OpenPGP & CMS (Cryptographic Message Syntax)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "BouncyCastle",
              "display_name": "BouncyCastle",
              "target": null
            },
            {
              "id": "Sf:ShellCode-AU",
              "display_name": "Sf:ShellCode-AU",
              "target": null
            },
            {
              "id": "Win.Trojan.Fareit-82",
              "display_name": "Win.Trojan.Fareit-82",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-245901",
              "display_name": "Win.Trojan.Agent-245901",
              "target": null
            },
            {
              "id": "#LowFiEnableDTContinueAfterUnpacking",
              "display_name": "#LowFiEnableDTContinueAfterUnpacking",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "W32/Kegotip CnC",
              "display_name": "W32/Kegotip CnC",
              "target": null
            },
            {
              "id": "W32.Virut.ci",
              "display_name": "W32.Virut.ci",
              "target": null
            },
            {
              "id": "Downloader.Generic13.CMTW",
              "display_name": "Downloader.Generic13.CMTW",
              "target": null
            },
            {
              "id": "Downloader.Generic13.BOBZ",
              "display_name": "Downloader.Generic13.BOBZ",
              "target": null
            },
            {
              "id": "Win.Trojan.Injector-12138",
              "display_name": "Win.Trojan.Injector-12138",
              "target": null
            },
            {
              "id": "Generic36.ADTY",
              "display_name": "Generic36.ADTY",
              "target": null
            },
            {
              "id": "Generic36.AIAA.Dropper",
              "display_name": "Generic36.AIAA.Dropper",
              "target": null
            },
            {
              "id": "Generic36.AJSM",
              "display_name": "Generic36.AJSM",
              "target": null
            },
            {
              "id": "Win32/Virut",
              "display_name": "Win32/Virut",
              "target": null
            },
            {
              "id": "Win32/Ramnit.A",
              "display_name": "Win32/Ramnit.A",
              "target": null
            },
            {
              "id": "Worm.Autorun-6180",
              "display_name": "Worm.Autorun-6180",
              "target": null
            },
            {
              "id": "Hider.BIY",
              "display_name": "Hider.BIY",
              "target": null
            },
            {
              "id": "Win.Trojan.Rootkit-4532",
              "display_name": "Win.Trojan.Rootkit-4532",
              "target": null
            },
            {
              "id": "Win32/Blacked",
              "display_name": "Win32/Blacked",
              "target": null
            },
            {
              "id": "Win32.Injector",
              "display_name": "Win32.Injector",
              "target": null
            },
            {
              "id": "TrendMicro",
              "display_name": "TrendMicro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 853,
            "URL": 1639,
            "domain": 288,
            "FileHash-MD5": 78,
            "hostname": 545
          },
          "indicator_count": 3474,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "54 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "697488f095f69d392afd00fb",
          "name": "Fidelity Investments \u2022\u2019 EternalRocks | Financial Crimes",
          "description": "Fidelity Life and Guarantee defaults to Fidelity Investments. Long standing issue. Possible phishing email interception. Multiple accounts stolen at the time a man who presents himself as M. Brian Sabey Esq. Elder/Estate  attorney unable to\nsettle  life claim more action was requested.  Attorney repeatedly redirected to an investment team. We decided to use targets phone to\ntest results , payout is overdue. Illegal tactics were used to defraud victim/s..  Fraud operators  ask for SSN and later state they cannot help. L of Fraud phone , \u2018team\u2019 cannot complete internal phone transfers.,can conference you in to other people who act confused , disheveled who also\nask for SSN. \n\nSince victims experiences less\nthan covert interactions, I\u2019m unclear as to why there is a strong FBI, CIA , Palantir Foundry presence. It\u2019s rattling . \nReiterating : Entity steals financial products, health , life insurance policies, investment accounts, credit card frauds , bank accounts,intellectual property  anything of value.",
          "modified": "2026-02-23T07:04:04.285000",
          "created": "2026-01-24T08:55:12.845000",
          "tags": [
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "ck techniques",
            "evasion att",
            "t1480 execution",
            "href",
            "ascii text",
            "pattern match",
            "mitre att",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "form",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "active related",
            "url https",
            "related pulses",
            "url http",
            "united",
            "czechia",
            "hong kong",
            "ipv4",
            "indicators hong",
            "kong",
            "south korea",
            "netherlands",
            "germany",
            "ireland",
            "denmark",
            "sweden",
            "active",
            "government",
            "finance",
            "security",
            "type indicator",
            "yara detections",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "mcsf",
            "microsoft",
            "yara",
            "insurance",
            "fidelity investments",
            "description",
            "fidelity international",
            "ms windows",
            "pe32",
            "writeconsolew",
            "read c",
            "pe32 executable",
            "t1045",
            "susp",
            "write",
            "win64",
            "malware",
            "modified",
            "ck ids",
            "t1040",
            "sniffing",
            "packing",
            "t1112",
            "packing t1045",
            "icmp traffic",
            "memcommit",
            "pe section",
            "low software",
            "pe resource",
            "win32",
            "trojan",
            "april",
            "sara ligorria",
            "tramp advert",
            "black paper",
            "createdate",
            "subject laser",
            "title laser",
            "format",
            "types of",
            "japan",
            "regsetvalueexa",
            "regdword",
            "regbinary",
            "module download",
            "tls handshake",
            "high",
            "defense evasion",
            "discovery att",
            "adversaries",
            "title",
            "role",
            "flag",
            "name server",
            "server",
            "domain address",
            "markmonitor",
            "clicktale ltd",
            "enom",
            "whoisguard",
            "medium",
            "unicode",
            "rgba",
            "delete",
            "crlf line",
            "next",
            "dock",
            "execution",
            "date",
            "users",
            "tls sni",
            "total",
            "cnc domain",
            "search",
            "oamazon",
            "cnamazon rsa",
            "push",
            "failure yara",
            "contacted",
            "hours ago",
            "created",
            "cia",
            "fbi",
            "telegram",
            "tulach",
            "sabey",
            "state",
            "gov",
            "ahmann",
            "financial fraud",
            "t-mobile",
            "walmartmobile",
            "life insurance",
            "fidelity life",
            "guarantee",
            "team",
            "role title",
            "added active",
            "scan",
            "iocs",
            "learn more",
            "filehashsha1",
            "filehashmd5",
            "kw3recepten",
            "domainname0",
            "searchbox0",
            "kw1brinta",
            "kw2muesli",
            "indicator role",
            "title added",
            "pulses url",
            "cve cve20170147",
            "apple",
            "apple id"
          ],
          "references": [
            "https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226",
            "https://www.fidelity.com/ www.fidelity.com https://www.fidelity.com/ \u2022 www.fidelity.com",
            "http://neurosky.jp/ \u2022  https://tulach.cc/ \u2022 blackrock.com \u2022 vanguard-account.com",
            "https://bhive.nectar.social/rKvoMY",
            "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.exe",
            "ETERNALROCKS Detections: Win32:EternalRocks-B\\ [Trj] ,  Win.Trojan.EternalRocks1-6319293-0 ,",
            "TrojanDownloader:Win32/Eterock.A IDS Detections Possible ETERNALROCKS .Net161",
            "Module Download TLS Handshake Failure Yara Detections SUSP_NET_NAME_ConfuserEx , EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad network_http protection_rx antivm_network_adapters pe_unknown_resource_name raises_exception IP\u2019s Contacted  152.199.4.184  208.111.179.129  3.131.2.",
            "EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS",
            "Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad",
            "Alerts: networki_http protectionk_rx antivm_network_adapters pe_unknown_resource_name",
            "Alerts: raises_exception IP\u2019s Contacted:  152.199.4.184  208.111.179.129  3.131.2.",
            "Domains Contacted api.nuget.org",
            "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.exe",
            "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram",
            "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png",
            "https://cdn-cms-s.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png?v=r82934",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.fidelity.com/ https://www.fidelity.com/",
            "cia.gov FileHash-SHA256 3b55307785bdd903bc9183642bdfd8b5a8ee15b90a05b25acbcd477432d26d99",
            "cia.gov FileHash-SHA256 f0a2d463a40c5b02e4bf61fdd76892b8ed5a1dd7d4a305849e4ff8fba00735bf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/ hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl https://www.anyxxxtube.net/search-porn/ https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears fidelity-account.com MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann",
            "https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl. vgt.pl",
            "https://www.anyxxxtube.net/search-porn/",
            "https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
            "fidelity-account.com e http://fidelity-account.com/fidelity/code.html",
            "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.ex",
            "http://shared-work.com/fidelity2/login.html \u2022  https://fidelity-account.com/fidelity/otp.html",
            "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
            "https://www.fidelity-account.com/ https://www.fidelity-account.com/ \u2022 http://fidelity-account.com/cgi-sys https://fidelity-account.com/fidelity/login.html \u2022 https://www.fidelity.com/ https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226 https://www.fidelity.com/ \u2022 www.fidelity.com https://bhive.nectar.social/rKvoMY https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
            "http://www.fidelity-account.com/ https://fidelity-account.com/fidelity/code.html \u2022",
            "\"CIA\" most commonly refers to the Central Intelligence Agency, a premier U.S. government agency responsible for gathering and analyzing foreign intelligence.",
            "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai:",
            "https://bhive.nectar.social/rKvoMY",
            "apple.com \u2022 appleid.apple.com-elasticbeanstalk.ttfcuupdateaccount-loginpage.works.co",
            "http://appleid.app",
            "https://bounceme.netakamaipofcassandrvodd-krdddddddddddgaliapplepaysupplieseway.devrvodio-kr.zomato.tw\t d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win64:Trojan-gen",
              "display_name": "Win64:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:MSIL/Ursu.KP",
              "display_name": "Trojan:MSIL/Ursu.KP",
              "target": "/malware/Trojan:MSIL/Ursu.KP"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Eqtonex.F",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Eqtonex.F",
              "target": null
            },
            {
              "id": "Trojan:PDF/Phish.RR!MTB",
              "display_name": "Trojan:PDF/Phish.RR!MTB",
              "target": "/malware/Trojan:PDF/Phish.RR!MTB"
            },
            {
              "id": "Win32:TrojanX-gen\\ [Trj]",
              "display_name": "Win32:TrojanX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": ": ALF:Trojan:MSIL/Azorult.AC!",
              "display_name": ": ALF:Trojan:MSIL/Azorult.AC!",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/CryptWrapper.RT!MTB",
              "display_name": "ALF:Trojan:Win32/CryptWrapper.RT!MTB",
              "target": null
            },
            {
              "id": "Trojan:Win32/Conbea!rfn",
              "display_name": "Trojan:Win32/Conbea!rfn",
              "target": "/malware/Trojan:Win32/Conbea!rfn"
            },
            {
              "id": "Trojan:Win32/Ausiv!rfn",
              "display_name": "Trojan:Win32/Ausiv!rfn",
              "target": "/malware/Trojan:Win32/Ausiv!rfn"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat",
              "target": null
            },
            {
              "id": "Trojan:BAT/Musecador",
              "display_name": "Trojan:BAT/Musecador",
              "target": "/malware/Trojan:BAT/Musecador"
            },
            {
              "id": "TrojanDropper:Win32/Qhost",
              "display_name": "TrojanDropper:Win32/Qhost",
              "target": "/malware/TrojanDropper:Win32/Qhost"
            },
            {
              "id": "Trojan:Win32/Miner.KA!MTB",
              "display_name": "Trojan:Win32/Miner.KA!MTB",
              "target": "/malware/Trojan:Win32/Miner.KA!MTB"
            },
            {
              "id": "DNSTrojan",
              "display_name": "DNSTrojan",
              "target": null
            },
            {
              "id": "EternalRocks",
              "display_name": "EternalRocks",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            }
          ],
          "industries": [
            "Government",
            "Finance",
            "Insurance"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2793,
            "URL": 6639,
            "FileHash-SHA256": 2462,
            "domain": 1070,
            "FileHash-MD5": 307,
            "FileHash-SHA1": 186,
            "SSLCertFingerprint": 1,
            "email": 1,
            "CVE": 3
          },
          "indicator_count": 13462,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "55 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6964c08bf79bcb252eaa9e15",
          "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
          "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
          "modified": "2026-02-11T09:03:20.933000",
          "created": "2026-01-12T09:36:11.701000",
          "tags": [
            "google",
            "fastly",
            "googlecl",
            "january",
            "http",
            "domain",
            "akamaias",
            "cloudflar",
            "page url",
            "de summary",
            "april",
            "reverse dns",
            "url https",
            "general full",
            "software",
            "united",
            "resource hash",
            "protocol h3",
            "security quic",
            "protocol h2",
            "security tls",
            "main",
            "present jan",
            "title",
            "gmt max",
            "certificate",
            "moved",
            "lowfi",
            "gmt content",
            "meta",
            "present dec",
            "status",
            "aaaa",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "win32",
            "files",
            "verdict",
            "files ip",
            "address",
            "mtb jan",
            "trojandropper",
            "backdoor",
            "win32upatre jan",
            "origin trial",
            "gmt cache",
            "443 ma2592000",
            "possible",
            "worm",
            "trojan",
            "ip address",
            "record value",
            "dark",
            "found",
            "ipv4 add",
            "error",
            "trojanspy",
            "emails",
            "servers",
            "pegasus",
            "america flag",
            "america asn",
            "tlsv1",
            "read c",
            "show",
            "medium",
            "lstockholm",
            "ospotify ab",
            "odigicert inc",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "dynamicloader",
            "yara rule",
            "ms windows",
            "pe32",
            "named pipe",
            "smartassembly",
            "delphi",
            "malware",
            "united states",
            "pe file",
            "filehash",
            "md5 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "high",
            "write c",
            "tls sni",
            "tls handshake",
            "delete",
            "as15169",
            "stun binding",
            "request",
            "port",
            "win64",
            "themida",
            "guard",
            "risepro",
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "ck techniques",
            "evasion att",
            "t1480 execution",
            "directui",
            "element",
            "hwndhost",
            "classinfobase",
            "hwndelement",
            "value",
            "explorer",
            "insert",
            "movie",
            "hacktool",
            "showing",
            "entries http",
            "scans show",
            "california",
            "location united",
            "next associated",
            "pulse pulses",
            "name servers",
            "found request",
            "unique",
            "url add",
            "related nids",
            "files location",
            "expiration",
            "flag united",
            "present nov",
            "present sep",
            "href",
            "suricata stream",
            "command decode",
            "starfield",
            "encrypt",
            "iframe",
            "date",
            "title error",
            "hostname",
            "pulse submit",
            "memcommit",
            "checks",
            "windows",
            "capture",
            "cloudfront",
            "colorado",
            "creation date",
            "hostname add",
            "eset",
            "binary file",
            "pdb path",
            "internalname",
            "nod32",
            "amon"
          ],
          "references": [
            "open.spotify.com \u2022",
            "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
            "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
            "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
            "https://target.tccwest.www.littleswimmers.fr/",
            "www.onyx-ware.com \u2022 endgamesystems.com",
            "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Win.Packed.Stealerc-10017074-0",
              "display_name": "Win.Packed.Stealerc-10017074-0",
              "target": null
            },
            {
              "id": "#Lowfi:Win32/AutoIt",
              "display_name": "#Lowfi:Win32/AutoIt",
              "target": "/malware/#Lowfi:Win32/AutoIt"
            },
            {
              "id": "Win.Packed.Generic-9967832-0",
              "display_name": "Win.Packed.Generic-9967832-0",
              "target": null
            },
            {
              "id": "TrojanSpy:MSIL/Yakbeex.A",
              "display_name": "TrojanSpy:MSIL/Yakbeex.A",
              "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Win32:HacktoolX-gen\\ [Trj]",
              "display_name": "Win32:HacktoolX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "nUFS_unicode",
              "display_name": "nUFS_unicode",
              "target": null
            },
            {
              "id": "HackTool:Win32/CobaltStrike.A",
              "display_name": "HackTool:Win32/CobaltStrike.A",
              "target": "/malware/HackTool:Win32/CobaltStrike.A"
            },
            {
              "id": "Win.Dropper.PoisonIvy-9876745-0",
              "display_name": "Win.Dropper.PoisonIvy-9876745-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            }
          ],
          "industries": [
            "Entertainment",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1293,
            "URL": 3389,
            "FileHash-MD5": 635,
            "FileHash-SHA1": 531,
            "FileHash-SHA256": 2345,
            "domain": 501,
            "email": 12,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 8722,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "67 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS",
        "76.76.21.61 command_and_control",
        "Module Download TLS Handshake Failure Yara Detections SUSP_NET_NAME_ConfuserEx , EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad network_http protection_rx antivm_network_adapters pe_unknown_resource_name raises_exception IP\u2019s Contacted  152.199.4.184  208.111.179.129  3.131.2.",
        "\"CIA\" most commonly refers to the Central Intelligence Agency, a premier U.S. government agency responsible for gathering and analyzing foreign intelligence.",
        "Empty FileHash -Matches rule Suspicious History File Operations by Mikhail Larin, oscd.community",
        "Empty FileHash - Malware,Stealer, Related to ShadowBrokers EternalRocks",
        "open.spotify.com \u2022",
        "ETERNALROCKS Detections: Win32:EternalRocks-B\\ [Trj] ,  Win.Trojan.EternalRocks1-6319293-0 ,",
        "cia.gov FileHash-SHA256 f0a2d463a40c5b02e4bf61fdd76892b8ed5a1dd7d4a305849e4ff8fba00735bf",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "cia.gov FileHash-SHA256 3b55307785bdd903bc9183642bdfd8b5a8ee15b90a05b25acbcd477432d26d99",
        "http://git.spywarewatchdog.org",
        "http://neurosky.jp/ \u2022  https://tulach.cc/ \u2022 blackrock.com \u2022 vanguard-account.com",
        "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram",
        "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai:",
        "https://cdn-cms-s.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png?v=r82934",
        "http://appleid.app",
        "https://codesearch.criteois.com/opengrok/search?q=",
        "IDS Detections ET POLICY Suspicious User-Agent Containing .exe",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.exe",
        "Google android-cts-7.1_r6-linux_x86-arm.zip",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://communityinviter.com/apps/cloudfoundry/cloud-foundry",
        "https://target.tccwest.www.littleswimmers.fr/",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net",
        "https://www.fidelity.com/ www.fidelity.com https://www.fidelity.com/ \u2022 www.fidelity.com",
        "https://www.anyxxxtube.net/search-porn/",
        "66.33.60.130 command_and_control",
        "https://bhive.nectar.social/rKvoMY",
        "Alerts: raises_exception IP\u2019s Contacted:  152.199.4.184  208.111.179.129  3.131.2.",
        "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
        "Extensions,.Trojan Age Win Version=4.2.0.168 Win32/1 Culture=neutral, amnit",
        "http://cve.chainguard.dev",
        "android-cts-7.1_r6-linux_x86-arm.zip  [e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855]",
        "Domains Contacted api.nuget.org",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/ hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl https://www.anyxxxtube.net/search-porn/ https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears fidelity-account.com MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e",
        "hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann",
        "Secure Protocols: Provides APIs for TLS 1.3, S/MIME, OpenPGP & CMS (Cryptographic Message Syntax)",
        "NtProtectVirtualMemory@NTDLL.DLL",
        "Virut PublicKeyToken=cc7b13ffcd 2ddd51 1D11.tmp Ultimate-Chicken-Horse- T1O SteamRIP.com.rarys /",
        "Alerts: networki_http protectionk_rx antivm_network_adapters pe_unknown_resource_name",
        "https://bot.dev.talos-systems.io/",
        "http://partners.spycloud.com",
        "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e",
        "https://bounceme.netakamaipofcassandrvodd-krdddddddddddgaliapplepaysupplieseway.devrvodio-kr.zomato.tw\t d",
        "https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl. vgt.pl",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "Invalid IP (052.105.023.053)",
        "Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad",
        "oldapps \u2022 http://oldapps.com/blender.php?old_blender=7584?download",
        "TrojanDownloader:Win32/Eterock.A IDS Detections Possible ETERNALROCKS .Net161",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.fidelity-account.com/ https://www.fidelity-account.com/ \u2022 http://fidelity-account.com/cgi-sys https://fidelity-account.com/fidelity/login.html \u2022 https://www.fidelity.com/ https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226 https://www.fidelity.com/ \u2022 www.fidelity.com https://bhive.nectar.social/rKvoMY https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
        "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png",
        "http://shared-work.com/fidelity2/login.html \u2022  https://fidelity-account.com/fidelity/otp.html",
        "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU",
        "Empty FileHash - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "Startul ErrorPageTemplate[1] netcore, BouncyCastle.",
        "https://grok-chatbot.tapnetic.pro/$",
        "website \u2022 http://oldapps.com/blender.php?old_blender=7584",
        "https://www.fidelity.com/ https://www.fidelity.com/",
        "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.ex",
        "https://signin-pro-azure.crayon.com/signin-oidc",
        "http://www.fidelity-account.com/ https://fidelity-account.com/fidelity/code.html \u2022",
        "apple.com \u2022 appleid.apple.com-elasticbeanstalk.ttfcuupdateaccount-loginpage.works.co",
        "https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
        "https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226",
        "fidelity-account.com e http://fidelity-account.com/fidelity/code.html",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "IDS Detections Trojan.Generic.KDV.545753 Checkin",
        "ET TROJAN W32/Kegotip CnC Beacon",
        "spywarewatchdog.org",
        "The Blender Foundation"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Autoit",
            "Win.trojan.agent-245901",
            "Win.dropper.lokibot-10010685-0",
            "Alf:heraklezeval:trojan:win32/eqtonex.f",
            "Nufs_unicode",
            "W32.virut.ci",
            "Trojanspy:win32/nivdort.cw",
            "Formbook",
            "Win.trojan.upatre-3371",
            "W32/kegotip cnc",
            "Win.packed.malwarex-9792170-0",
            "Worm.autorun-6180",
            "Win.packed.dapato-10021645-0",
            "Trojan:win32/miner.ka!mtb",
            "Trojan:win32/conbea!rfn",
            "Trojan:win32/glupteba.mt!mtb",
            "Trojan:win32/ausiv!rfn",
            "Bouncycastle",
            "Hacktool:win32/cobaltstrike.a",
            "#lowfienabledtcontinueafterunpacking",
            "Win.dropper.gh0strat-10028210-0",
            "Win32/ramnit.a",
            "Win.trojan.rootkit-4532",
            "Win32/virut",
            "Win.trojan.fareit-82",
            "Eternalrocks",
            "Trojanspy:msil/yakbeex.a",
            "Generic36.aiaa.dropper",
            "Win.packed.stealerc-10017074-0",
            "Win.trojan.injector-12138",
            "Generic36.adty",
            "Generic36.ajsm",
            "Win32.injector",
            "Trojan:win32/zombie.a",
            "Hider.biy",
            "Pegasus",
            "Win64:trojan-gen",
            "Win32/blacked",
            "Trojan:msil/ursu.kp",
            "Win32:hacktoolx-gen\\ [trj]",
            "#lowfi:win32/autoit",
            "Trojan:pdf/phish.rr!mtb",
            "Trojanspy",
            "Trendmicro",
            "Alf:heraklezeval:trojan:msil/gravityrat",
            "Trojan:bat/musecador",
            ": alf:trojan:msil/azorult.ac!",
            "Win.dropper.poisonivy-9876745-0",
            "Sf:shellcode-au",
            "Win.trojan.barys-10005825-0",
            "Win.packed.generic-9967832-0",
            "Win32:trojanx-gen\\ [trj]",
            "Et",
            "Alf:trojan:win32/cryptwrapper.rt!mtb",
            "Trojandropper:win32/qhost",
            "Tofsee",
            "Downloader.generic13.cmtw",
            "Trojandownloader:win32/upatre.a",
            "Dnstrojan",
            "Downloader.generic13.bobz",
            "Backdoor:win32/kanav.a"
          ],
          "industries": [
            "Finance",
            "Entertainment",
            "Insurance",
            "Technology",
            "Ecommerce",
            "Government"
          ],
          "unique_indicators": 35141
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/anjaco.com.es",
    "whois": "http://whois.domaintools.com/anjaco.com.es",
    "domain": "anjaco.com.es",
    "hostname": "omnitool.anjaco.com.es"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69770bdfbdd845a3d5cb2484",
      "name": "Drive-by Compromise | Rootkit installed on Apple Device",
      "description": "Drive-by Compromise | Rootkit installed on Apple Device | The devices in this example are obviously compromised. We tested a device another Apple device by viewing a Sprouts Farmers Market E-commerce website. The App crashed revealing the source of the issue. I admit that even though device is HEAVILY compromised by threat actors; it continued to preform.\nThis week the Apple devices have  experienced a series of BLACK & PINK stutters One had the letter \u2018P\u2019. The most important part of the research is who & why someone  targets victims of crime who are either deceased or catastrophically injured. One victims \u2018voice\u2019 has been captured and is now calling people she knew and creeping them out. \n\nAlso curious about the \u2018Hello\u2019 api lineages. Malware packed. Check-ins & Bot Network found.\n\n[OTX auto populated- Here is the full list of URLs from the 20th anniversary of the birth of Daylin Olson, who was born and raised in New York in the US, and who he is now.]\n\n#stop",
      "modified": "2026-02-25T06:02:12.072000",
      "created": "2026-01-26T06:38:23.334000",
      "tags": [
        "url https",
        "url http",
        "netherlands",
        "france",
        "united",
        "canada",
        "spain",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "title",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "meta",
        "form",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "ck matrix",
        "href",
        "network traffic",
        "encrypt",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "ssl certificate",
        "initial access",
        "zerobits",
        "allocationtype",
        "protect",
        "programfiles",
        "processhandle",
        "commitsize",
        "viewsize",
        "regionsize",
        "viewsize d5000",
        "viewsize c9000",
        "phishing",
        "filehandle",
        "report uid",
        "handles modules",
        "files amsi",
        "streams",
        "path filehandle",
        "porthandle",
        "modules files",
        "amsi streams",
        "accept",
        "starfield",
        "onload",
        "root",
        "backdoor",
        "passive dns",
        "next associated",
        "gmt location",
        "ipv4 add",
        "urls",
        "files",
        "search",
        "domain address",
        "markmonitor",
        "name server",
        "se referen",
        "ntprotec",
        "data upload",
        "extraction",
        "country",
        "overview dns",
        "requests domain",
        "date",
        "contacted hosts",
        "ip address",
        "defense evasion",
        "found",
        "size",
        "mask",
        "enterprise",
        "trojanspy",
        "checkin",
        "gmt content",
        "vercel x",
        "twitter",
        "trojan",
        "malware",
        "for privacy",
        "servers",
        "domains ii",
        "record value",
        "ca issuers",
        "unknown aaaa",
        "status",
        "present jul",
        "moved",
        "present jan",
        "present oct",
        "present sep",
        "unknown ns",
        "present dec",
        "ipv4",
        "url analysis",
        "location united",
        "1.25.26",
        "q.vashti pulse",
        "cloud",
        "foundry",
        "process details",
        "formbook cnc",
        "cape",
        "autoit",
        "high",
        "formbook",
        "yara rule",
        "delete",
        "get na",
        "write",
        "unknown",
        "copy",
        "autoit error",
        "autoIt paused",
        "global",
        "div div",
        "script script",
        "h6 div",
        "p div",
        "registrar",
        "project",
        "showing",
        "emails",
        "name servers",
        "ids detec",
        "domain",
        "hostname",
        "hello",
        "spyware"
      ],
      "references": [
        "https://hello.extendedstay.com/api/mailings/unsubscribe/PMRGSZBCHIYTGOBWGYYTOLBCN5ZGOIR2EI2DGYZVMQ3DMNZNGY3GEYZNGQ2GIMBNMEYGENBNGQZDMMZYGA3DGZRZGI4SELBCOZSXE43JN5XCEORCGQRCYITTNFTSEORCHAZEKSCRNZ3UWTKHLA4US2BWNFVWK2SKKNXHAZTBO5RGOY2FGFYUOTTGNRJHQ5RZFU4TAPJCPU",
        "NtProtectVirtualMemory@NTDLL.DLL",
        "66.33.60.130 command_and_control",
        "76.76.21.61 command_and_control",
        "IDS Detections Trojan.Generic.KDV.545753 Checkin",
        "https://communityinviter.com/apps/cloudfoundry/cloud-foundry",
        "http://cve.chainguard.dev",
        "http://partners.spycloud.com",
        "https://signin-pro-azure.crayon.com/signin-oidc",
        "Invalid IP (052.105.023.053)",
        "https://codesearch.criteois.com/opengrok/search?q=",
        "https://grok-chatbot.tapnetic.pro/$",
        "spywarewatchdog.org",
        "http://git.spywarewatchdog.org",
        "https://bot.dev.talos-systems.io/",
        "https://otx.alienvault.com/pulse/6976d6afd744c55bd596ed6e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Dropper.Gh0stRAT-10028210-0",
          "display_name": "Win.Dropper.Gh0stRAT-10028210-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Kanav.A",
          "display_name": "Backdoor:Win32/Kanav.A",
          "target": "/malware/Backdoor:Win32/Kanav.A"
        },
        {
          "id": "Win.Trojan.Upatre-3371",
          "display_name": "Win.Trojan.Upatre-3371",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Upatre.A",
          "display_name": "TrojanDownloader:Win32/Upatre.A",
          "target": "/malware/TrojanDownloader:Win32/Upatre.A"
        },
        {
          "id": "Win.Trojan.Upatre-3371",
          "display_name": "Win.Trojan.Upatre-3371",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Upatre.A",
          "display_name": "TrojanDownloader:Win32/Upatre.A",
          "target": "/malware/TrojanDownloader:Win32/Upatre.A"
        },
        {
          "id": "Win.Dropper.LokiBot-10010685-0",
          "display_name": "Win.Dropper.LokiBot-10010685-0",
          "target": null
        },
        {
          "id": "Win.Packed.Dapato-10021645-0",
          "display_name": "Win.Packed.Dapato-10021645-0",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.CW",
          "display_name": "TrojanSpy:Win32/Nivdort.CW",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CW"
        },
        {
          "id": "Win.Packed.Malwarex-9792170-0",
          "display_name": "Win.Packed.Malwarex-9792170-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "AutoIt",
          "display_name": "AutoIt",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1016",
          "name": "System Network Configuration Discovery",
          "display_name": "T1016 - System Network Configuration Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1016.001",
          "name": "Internet Connection Discovery",
          "display_name": "T1016.001 - Internet Connection Discovery"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1583.004",
          "name": "Server",
          "display_name": "T1583.004 - Server"
        },
        {
          "id": "T1078.004",
          "name": "Cloud Accounts",
          "display_name": "T1078.004 - Cloud Accounts"
        },
        {
          "id": "T1584.003",
          "name": "Virtual Private Server",
          "display_name": "T1584.003 - Virtual Private Server"
        }
      ],
      "industries": [
        "Ecommerce",
        "Government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6777,
        "domain": 907,
        "hostname": 2070,
        "FileHash-SHA256": 1120,
        "FileHash-MD5": 202,
        "FileHash-SHA1": 184,
        "SSLCertFingerprint": 23,
        "email": 4
      },
      "indicator_count": 11287,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "53 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6975c5cd4db6104ea1a3d69b",
      "name": "The Blender Foundation BouncyCastle-Virut | Malware /Stealer Empty FileHash |  Eternal7  (Shadow Broker) Related",
      "description": "Empty FileHash isn\u2019t benign. Interesting relationships to the Eternal 7. Malware, Stealer and Suspicious History File Operation. BouncyCastle-Virut PublicKeyToken=cc7b13ffcd 2ddd51 1D11.tmp Ultimate-Chicken-Horse- T1O SteamRIP.com.rarys / Startul ErrorPageTemplate[1] netcore, BouncyCastle.",
      "modified": "2026-02-24T06:02:43.853000",
      "created": "2026-01-25T07:27:09.640000",
      "tags": [
        "empty",
        "blender",
        "eurostile",
        "augustin",
        "butterfield",
        "cook",
        "drummer",
        "erickson",
        "fjsv",
        "flynn",
        "gorman",
        "holmes",
        "easy",
        "rada",
        "xanadu",
        "config",
        "reboot",
        "screen",
        "microsoft",
        "commerce server",
        "edition",
        "draw",
        "exchange server",
        "tools",
        "linux",
        "ideal link",
        "nsrl test",
        "nist",
        "file",
        "cultureneutral",
        "fix pack",
        "free download",
        "bouncycastle",
        "read c",
        "search",
        "et trojan",
        "w32kegotip cnc",
        "whitelisted",
        "ids detections",
        "intel",
        "write",
        "trojan",
        "malware",
        "yara detections",
        "productversion",
        "fileversion",
        "av detections",
        "alerts",
        "analysis date",
        "file score",
        "united",
        "aaaa",
        "passive dns",
        "ip address",
        "present dec",
        "body html",
        "head meta",
        "title",
        "urls",
        "url https",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "beacon",
        "et",
        "ipv4",
        "files",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "related pulses",
        "show",
        "win32virut",
        "destination",
        "port",
        "ms windows",
        "pe32",
        "medium",
        "suspicious",
        "virustotal",
        "startul",
        "shadowbrokers",
        "total",
        "delete",
        "artemis",
        "win32.injector",
        "trendmicro",
        "data upload",
        "extraction",
        "included iocs"
      ],
      "references": [
        "The Blender Foundation",
        "website \u2022 http://oldapps.com/blender.php?old_blender=7584",
        "oldapps \u2022 http://oldapps.com/blender.php?old_blender=7584?download",
        "Google android-cts-7.1_r6-linux_x86-arm.zip",
        "Google android-cts-7.1_r6-linux_x86-arm.zip",
        "android-cts-7.1_r6-linux_x86-arm.zip  [e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855]",
        "Empty FileHash - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        "Empty FileHash -Matches rule Suspicious History File Operations by Mikhail Larin, oscd.community",
        "Empty FileHash - Malware,Stealer, Related to ShadowBrokers EternalRocks",
        "ET TROJAN W32/Kegotip CnC Beacon",
        "IDS Detections ET POLICY Suspicious User-Agent Containing .exe",
        "Extensions,.Trojan Age Win Version=4.2.0.168 Win32/1 Culture=neutral, amnit",
        "Virut PublicKeyToken=cc7b13ffcd 2ddd51 1D11.tmp Ultimate-Chicken-Horse- T1O SteamRIP.com.rarys /",
        "Startul ErrorPageTemplate[1] netcore, BouncyCastle.",
        "Secure Protocols: Provides APIs for TLS 1.3, S/MIME, OpenPGP & CMS (Cryptographic Message Syntax)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "BouncyCastle",
          "display_name": "BouncyCastle",
          "target": null
        },
        {
          "id": "Sf:ShellCode-AU",
          "display_name": "Sf:ShellCode-AU",
          "target": null
        },
        {
          "id": "Win.Trojan.Fareit-82",
          "display_name": "Win.Trojan.Fareit-82",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-245901",
          "display_name": "Win.Trojan.Agent-245901",
          "target": null
        },
        {
          "id": "#LowFiEnableDTContinueAfterUnpacking",
          "display_name": "#LowFiEnableDTContinueAfterUnpacking",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "W32/Kegotip CnC",
          "display_name": "W32/Kegotip CnC",
          "target": null
        },
        {
          "id": "W32.Virut.ci",
          "display_name": "W32.Virut.ci",
          "target": null
        },
        {
          "id": "Downloader.Generic13.CMTW",
          "display_name": "Downloader.Generic13.CMTW",
          "target": null
        },
        {
          "id": "Downloader.Generic13.BOBZ",
          "display_name": "Downloader.Generic13.BOBZ",
          "target": null
        },
        {
          "id": "Win.Trojan.Injector-12138",
          "display_name": "Win.Trojan.Injector-12138",
          "target": null
        },
        {
          "id": "Generic36.ADTY",
          "display_name": "Generic36.ADTY",
          "target": null
        },
        {
          "id": "Generic36.AIAA.Dropper",
          "display_name": "Generic36.AIAA.Dropper",
          "target": null
        },
        {
          "id": "Generic36.AJSM",
          "display_name": "Generic36.AJSM",
          "target": null
        },
        {
          "id": "Win32/Virut",
          "display_name": "Win32/Virut",
          "target": null
        },
        {
          "id": "Win32/Ramnit.A",
          "display_name": "Win32/Ramnit.A",
          "target": null
        },
        {
          "id": "Worm.Autorun-6180",
          "display_name": "Worm.Autorun-6180",
          "target": null
        },
        {
          "id": "Hider.BIY",
          "display_name": "Hider.BIY",
          "target": null
        },
        {
          "id": "Win.Trojan.Rootkit-4532",
          "display_name": "Win.Trojan.Rootkit-4532",
          "target": null
        },
        {
          "id": "Win32/Blacked",
          "display_name": "Win32/Blacked",
          "target": null
        },
        {
          "id": "Win32.Injector",
          "display_name": "Win32.Injector",
          "target": null
        },
        {
          "id": "TrendMicro",
          "display_name": "TrendMicro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 853,
        "URL": 1639,
        "domain": 288,
        "FileHash-MD5": 78,
        "hostname": 545
      },
      "indicator_count": 3474,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "54 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "697488f095f69d392afd00fb",
      "name": "Fidelity Investments \u2022\u2019 EternalRocks | Financial Crimes",
      "description": "Fidelity Life and Guarantee defaults to Fidelity Investments. Long standing issue. Possible phishing email interception. Multiple accounts stolen at the time a man who presents himself as M. Brian Sabey Esq. Elder/Estate  attorney unable to\nsettle  life claim more action was requested.  Attorney repeatedly redirected to an investment team. We decided to use targets phone to\ntest results , payout is overdue. Illegal tactics were used to defraud victim/s..  Fraud operators  ask for SSN and later state they cannot help. L of Fraud phone , \u2018team\u2019 cannot complete internal phone transfers.,can conference you in to other people who act confused , disheveled who also\nask for SSN. \n\nSince victims experiences less\nthan covert interactions, I\u2019m unclear as to why there is a strong FBI, CIA , Palantir Foundry presence. It\u2019s rattling . \nReiterating : Entity steals financial products, health , life insurance policies, investment accounts, credit card frauds , bank accounts,intellectual property  anything of value.",
      "modified": "2026-02-23T07:04:04.285000",
      "created": "2026-01-24T08:55:12.845000",
      "tags": [
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "ck techniques",
        "evasion att",
        "t1480 execution",
        "href",
        "ascii text",
        "pattern match",
        "mitre att",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "form",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "active related",
        "url https",
        "related pulses",
        "url http",
        "united",
        "czechia",
        "hong kong",
        "ipv4",
        "indicators hong",
        "kong",
        "south korea",
        "netherlands",
        "germany",
        "ireland",
        "denmark",
        "sweden",
        "active",
        "government",
        "finance",
        "security",
        "type indicator",
        "yara detections",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "mcsf",
        "microsoft",
        "yara",
        "insurance",
        "fidelity investments",
        "description",
        "fidelity international",
        "ms windows",
        "pe32",
        "writeconsolew",
        "read c",
        "pe32 executable",
        "t1045",
        "susp",
        "write",
        "win64",
        "malware",
        "modified",
        "ck ids",
        "t1040",
        "sniffing",
        "packing",
        "t1112",
        "packing t1045",
        "icmp traffic",
        "memcommit",
        "pe section",
        "low software",
        "pe resource",
        "win32",
        "trojan",
        "april",
        "sara ligorria",
        "tramp advert",
        "black paper",
        "createdate",
        "subject laser",
        "title laser",
        "format",
        "types of",
        "japan",
        "regsetvalueexa",
        "regdword",
        "regbinary",
        "module download",
        "tls handshake",
        "high",
        "defense evasion",
        "discovery att",
        "adversaries",
        "title",
        "role",
        "flag",
        "name server",
        "server",
        "domain address",
        "markmonitor",
        "clicktale ltd",
        "enom",
        "whoisguard",
        "medium",
        "unicode",
        "rgba",
        "delete",
        "crlf line",
        "next",
        "dock",
        "execution",
        "date",
        "users",
        "tls sni",
        "total",
        "cnc domain",
        "search",
        "oamazon",
        "cnamazon rsa",
        "push",
        "failure yara",
        "contacted",
        "hours ago",
        "created",
        "cia",
        "fbi",
        "telegram",
        "tulach",
        "sabey",
        "state",
        "gov",
        "ahmann",
        "financial fraud",
        "t-mobile",
        "walmartmobile",
        "life insurance",
        "fidelity life",
        "guarantee",
        "team",
        "role title",
        "added active",
        "scan",
        "iocs",
        "learn more",
        "filehashsha1",
        "filehashmd5",
        "kw3recepten",
        "domainname0",
        "searchbox0",
        "kw1brinta",
        "kw2muesli",
        "indicator role",
        "title added",
        "pulses url",
        "cve cve20170147",
        "apple",
        "apple id"
      ],
      "references": [
        "https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226",
        "https://www.fidelity.com/ www.fidelity.com https://www.fidelity.com/ \u2022 www.fidelity.com",
        "http://neurosky.jp/ \u2022  https://tulach.cc/ \u2022 blackrock.com \u2022 vanguard-account.com",
        "https://bhive.nectar.social/rKvoMY",
        "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.exe",
        "ETERNALROCKS Detections: Win32:EternalRocks-B\\ [Trj] ,  Win.Trojan.EternalRocks1-6319293-0 ,",
        "TrojanDownloader:Win32/Eterock.A IDS Detections Possible ETERNALROCKS .Net161",
        "Module Download TLS Handshake Failure Yara Detections SUSP_NET_NAME_ConfuserEx , EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad network_http protection_rx antivm_network_adapters pe_unknown_resource_name raises_exception IP\u2019s Contacted  152.199.4.184  208.111.179.129  3.131.2.",
        "EternalRocks_svchost ,  EternalRocks_UpdateInstaller ,  ProtectSharewareV11eCompservCMS",
        "Alerts dead_host network_icmp nolookup_communication modifies_proxy_wpad",
        "Alerts: networki_http protectionk_rx antivm_network_adapters pe_unknown_resource_name",
        "Alerts: raises_exception IP\u2019s Contacted:  152.199.4.184  208.111.179.129  3.131.2.",
        "Domains Contacted api.nuget.org",
        "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.exe",
        "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram",
        "https://cdn-cms-s-8-4.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png",
        "https://cdn-cms-s.f-static.net/files/icons/socialNetworksBrands/telegram-icon.png?v=r82934",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.fidelity.com/ https://www.fidelity.com/",
        "cia.gov FileHash-SHA256 3b55307785bdd903bc9183642bdfd8b5a8ee15b90a05b25acbcd477432d26d99",
        "cia.gov FileHash-SHA256 f0a2d463a40c5b02e4bf61fdd76892b8ed5a1dd7d4a305849e4ff8fba00735bf",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/ hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl https://www.anyxxxtube.net/search-porn/ https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears fidelity-account.com MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "hallrender.com/attorney/brian-sabey hallrender.com/attorney/b-sabey Christopher Ahmann",
        "https://www.anyxxxtube.net/search-porn/a-m-c-ate-xxx-videos/ pornokind.vgt.pl. vgt.pl",
        "https://www.anyxxxtube.net/search-porn/",
        "https://hallrender.com/attorney/brian-sabey/anyxxxtube.net/search-porn/tsara-brashears",
        "fidelity-account.com e http://fidelity-account.com/fidelity/code.html",
        "MC nosnoop.exe: a44812b44591121f3e711223db099043d4d72288e4f436dba2fb935b6d888d40.ex",
        "http://shared-work.com/fidelity2/login.html \u2022  https://fidelity-account.com/fidelity/otp.html",
        "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
        "https://www.fidelity-account.com/ https://www.fidelity-account.com/ \u2022 http://fidelity-account.com/cgi-sys https://fidelity-account.com/fidelity/login.html \u2022 https://www.fidelity.com/ https://www.fidelity.com/branches/investor-center-denver-west-s-teller-colorado-80226 https://www.fidelity.com/ \u2022 www.fidelity.com https://bhive.nectar.social/rKvoMY https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai :",
        "http://www.fidelity-account.com/ https://fidelity-account.com/fidelity/code.html \u2022",
        "\"CIA\" most commonly refers to the Central Intelligence Agency, a premier U.S. government agency responsible for gathering and analyzing foreign intelligence.",
        "https://booking.nmc.ae/en-ae/doctor/physician/abu-dhabi/sreehari-karunakaran-pillai:",
        "https://bhive.nectar.social/rKvoMY",
        "apple.com \u2022 appleid.apple.com-elasticbeanstalk.ttfcuupdateaccount-loginpage.works.co",
        "http://appleid.app",
        "https://bounceme.netakamaipofcassandrvodd-krdddddddddddgaliapplepaysupplieseway.devrvodio-kr.zomato.tw\t d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win64:Trojan-gen",
          "display_name": "Win64:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:MSIL/Ursu.KP",
          "display_name": "Trojan:MSIL/Ursu.KP",
          "target": "/malware/Trojan:MSIL/Ursu.KP"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Eqtonex.F",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Eqtonex.F",
          "target": null
        },
        {
          "id": "Trojan:PDF/Phish.RR!MTB",
          "display_name": "Trojan:PDF/Phish.RR!MTB",
          "target": "/malware/Trojan:PDF/Phish.RR!MTB"
        },
        {
          "id": "Win32:TrojanX-gen\\ [Trj]",
          "display_name": "Win32:TrojanX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": ": ALF:Trojan:MSIL/Azorult.AC!",
          "display_name": ": ALF:Trojan:MSIL/Azorult.AC!",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/CryptWrapper.RT!MTB",
          "display_name": "ALF:Trojan:Win32/CryptWrapper.RT!MTB",
          "target": null
        },
        {
          "id": "Trojan:Win32/Conbea!rfn",
          "display_name": "Trojan:Win32/Conbea!rfn",
          "target": "/malware/Trojan:Win32/Conbea!rfn"
        },
        {
          "id": "Trojan:Win32/Ausiv!rfn",
          "display_name": "Trojan:Win32/Ausiv!rfn",
          "target": "/malware/Trojan:Win32/Ausiv!rfn"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat",
          "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat",
          "target": null
        },
        {
          "id": "Trojan:BAT/Musecador",
          "display_name": "Trojan:BAT/Musecador",
          "target": "/malware/Trojan:BAT/Musecador"
        },
        {
          "id": "TrojanDropper:Win32/Qhost",
          "display_name": "TrojanDropper:Win32/Qhost",
          "target": "/malware/TrojanDropper:Win32/Qhost"
        },
        {
          "id": "Trojan:Win32/Miner.KA!MTB",
          "display_name": "Trojan:Win32/Miner.KA!MTB",
          "target": "/malware/Trojan:Win32/Miner.KA!MTB"
        },
        {
          "id": "DNSTrojan",
          "display_name": "DNSTrojan",
          "target": null
        },
        {
          "id": "EternalRocks",
          "display_name": "EternalRocks",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        }
      ],
      "industries": [
        "Government",
        "Finance",
        "Insurance"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2793,
        "URL": 6639,
        "FileHash-SHA256": 2462,
        "domain": 1070,
        "FileHash-MD5": 307,
        "FileHash-SHA1": 186,
        "SSLCertFingerprint": 1,
        "email": 1,
        "CVE": 3
      },
      "indicator_count": 13462,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "55 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6964c08bf79bcb252eaa9e15",
      "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
      "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
      "modified": "2026-02-11T09:03:20.933000",
      "created": "2026-01-12T09:36:11.701000",
      "tags": [
        "google",
        "fastly",
        "googlecl",
        "january",
        "http",
        "domain",
        "akamaias",
        "cloudflar",
        "page url",
        "de summary",
        "april",
        "reverse dns",
        "url https",
        "general full",
        "software",
        "united",
        "resource hash",
        "protocol h3",
        "security quic",
        "protocol h2",
        "security tls",
        "main",
        "present jan",
        "title",
        "gmt max",
        "certificate",
        "moved",
        "lowfi",
        "gmt content",
        "meta",
        "present dec",
        "status",
        "aaaa",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "win32",
        "files",
        "verdict",
        "files ip",
        "address",
        "mtb jan",
        "trojandropper",
        "backdoor",
        "win32upatre jan",
        "origin trial",
        "gmt cache",
        "443 ma2592000",
        "possible",
        "worm",
        "trojan",
        "ip address",
        "record value",
        "dark",
        "found",
        "ipv4 add",
        "error",
        "trojanspy",
        "emails",
        "servers",
        "pegasus",
        "america flag",
        "america asn",
        "tlsv1",
        "read c",
        "show",
        "medium",
        "lstockholm",
        "ospotify ab",
        "odigicert inc",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "dynamicloader",
        "yara rule",
        "ms windows",
        "pe32",
        "named pipe",
        "smartassembly",
        "delphi",
        "malware",
        "united states",
        "pe file",
        "filehash",
        "md5 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "high",
        "write c",
        "tls sni",
        "tls handshake",
        "delete",
        "as15169",
        "stun binding",
        "request",
        "port",
        "win64",
        "themida",
        "guard",
        "risepro",
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "ck techniques",
        "evasion att",
        "t1480 execution",
        "directui",
        "element",
        "hwndhost",
        "classinfobase",
        "hwndelement",
        "value",
        "explorer",
        "insert",
        "movie",
        "hacktool",
        "showing",
        "entries http",
        "scans show",
        "california",
        "location united",
        "next associated",
        "pulse pulses",
        "name servers",
        "found request",
        "unique",
        "url add",
        "related nids",
        "files location",
        "expiration",
        "flag united",
        "present nov",
        "present sep",
        "href",
        "suricata stream",
        "command decode",
        "starfield",
        "encrypt",
        "iframe",
        "date",
        "title error",
        "hostname",
        "pulse submit",
        "memcommit",
        "checks",
        "windows",
        "capture",
        "cloudfront",
        "colorado",
        "creation date",
        "hostname add",
        "eset",
        "binary file",
        "pdb path",
        "internalname",
        "nod32",
        "amon"
      ],
      "references": [
        "open.spotify.com \u2022",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://target.tccwest.www.littleswimmers.fr/",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Win.Packed.Stealerc-10017074-0",
          "display_name": "Win.Packed.Stealerc-10017074-0",
          "target": null
        },
        {
          "id": "#Lowfi:Win32/AutoIt",
          "display_name": "#Lowfi:Win32/AutoIt",
          "target": "/malware/#Lowfi:Win32/AutoIt"
        },
        {
          "id": "Win.Packed.Generic-9967832-0",
          "display_name": "Win.Packed.Generic-9967832-0",
          "target": null
        },
        {
          "id": "TrojanSpy:MSIL/Yakbeex.A",
          "display_name": "TrojanSpy:MSIL/Yakbeex.A",
          "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Win32:HacktoolX-gen\\ [Trj]",
          "display_name": "Win32:HacktoolX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "nUFS_unicode",
          "display_name": "nUFS_unicode",
          "target": null
        },
        {
          "id": "HackTool:Win32/CobaltStrike.A",
          "display_name": "HackTool:Win32/CobaltStrike.A",
          "target": "/malware/HackTool:Win32/CobaltStrike.A"
        },
        {
          "id": "Win.Dropper.PoisonIvy-9876745-0",
          "display_name": "Win.Dropper.PoisonIvy-9876745-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        }
      ],
      "industries": [
        "Entertainment",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1293,
        "URL": 3389,
        "FileHash-MD5": 635,
        "FileHash-SHA1": 531,
        "FileHash-SHA256": 2345,
        "domain": 501,
        "email": 12,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 8722,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "67 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://omnitool.anjaco.com.es",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://omnitool.anjaco.com.es",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776622268.9167643
}