{
  "type": "URL",
  "indicator": "https://planning.constructng.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://planning.constructng.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3779081852,
      "indicator": "https://planning.constructng.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "666d1488316880c73e04054e",
          "name": "Prorat.19.i | Backdoor:Win32/Tofsee.T - Amazon.com | iOS  | Denver",
          "description": "Targets family members device attacked while shopping on Amazon.com using an obviously device compromised, newer, fully updated iOS device. \nAmazon legal? [legal-choice.ru, youla.legal, https://www.effectv.com/legal/advertiser-terms-and-conditions]\n[applehealthcare.com apple-rehab.com: Backdoor:Win32/Tofsee.T]\nAdversarial CnC over devices and networks.\nRelentless attacks.",
          "modified": "2024-07-15T03:03:34.888000",
          "created": "2024-06-15T04:11:52.737000",
          "tags": [
            "server",
            "hostmaster",
            "amazon legal",
            "dept",
            "amazon",
            "street",
            "stateprovince",
            "postal code",
            "view whois",
            "whois record",
            "date",
            "contact",
            "threat roundup",
            "november",
            "march",
            "december",
            "february",
            "october",
            "january",
            "highly targeted",
            "data",
            "boost mobile",
            "formbook",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "ord52c2 via",
            "cloudfront",
            "sha1",
            "pattern match",
            "ascii text",
            "document file",
            "v2 document",
            "crlf line",
            "size",
            "unicode",
            "beginstring",
            "null",
            "hybrid",
            "refresh",
            "body",
            "span",
            "june",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "unknown",
            "embeddedwb",
            "windows",
            "search",
            "medium",
            "united",
            "show",
            "whitelisted",
            "shellexecuteexw",
            "msie",
            "tofsee",
            "service",
            "write",
            "win32",
            "malware",
            "copy",
            "a nxdomain",
            "passive dns",
            "domain",
            "scan endpoints",
            "all scoreblue",
            "pulse pulses",
            "urls",
            "files",
            "ip related",
            "process32nextw",
            "components",
            "writeconsolew",
            "copy c",
            "delete c",
            "query",
            "useruin",
            "delphi",
            "capture",
            "install",
            "prorat",
            "url http",
            "http",
            "related nids",
            "files location",
            "regsetvalueexa",
            "hx88x89",
            "regbinary",
            "x95xd3xa4",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "x93xaf",
            "stream",
            "persistence",
            "execution",
            "creation date",
            "entries",
            "as44273 host",
            "record value",
            "status",
            "nxdomain",
            "content type",
            "accept",
            "gmt server",
            "gmt etag",
            "accept encoding",
            "ipv4",
            "path",
            "pragma",
            "name servers",
            "west domains",
            "hostname",
            "next",
            "asnone germany",
            "as21499 host",
            "singapore",
            "france",
            "object",
            "com cnt",
            "dem fin",
            "found",
            "as16276",
            "spain unknown",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "encrypt",
            "levelblue",
            "open threat",
            "meta",
            "a div",
            "div div",
            "france unknown",
            "ok server",
            "type",
            "seychelles",
            "whitesky",
            "as29182 jsc",
            "showing",
            "as24940 hetzner",
            "moved",
            "expiration date",
            "aaaa",
            "russia",
            "as15169 google",
            "germany",
            "emails",
            "germany unknown",
            "a domains",
            "body doctype",
            "html public",
            "ietfdtd html",
            "finland",
            "asnone iran",
            "iran",
            "td tr",
            "td td",
            "tbody",
            "tr tr",
            "domains",
            "backdoor",
            "apple",
            "radio hacking",
            "voicestram",
            "listening",
            "trojan",
            "twitter",
            "servers",
            "vbs",
            "data center",
            "avg clamav",
            "msdefender sep",
            "vitro mar",
            "Win32:Vitro",
            "target: tsara brashears",
            "target: brashears personal devices",
            "target: whitesky communication network",
            "target: accounting firm devices",
            "targets: intellectual property",
            "redrum",
            "open",
            "tr tbody",
            "rsa ca",
            "apache",
            "as7922 comcast",
            "pulse submit",
            "url analysis",
            "epss",
            "impact",
            "cve cve20178977",
            "exploits",
            "targeted",
            "cve overview",
            "media"
          ],
          "references": [
            "Targets Apple iPad /iOS | www.amazon.com/ref=ap_frn_logo [embedded] | www.amazon.com  ns1.amzndns.co.uk , ns1.amzndns.com",
            "cory@whiteskycommunications.com IP: 137.83.95.132 targets victims associates Amazon account and all devices. CnC target Network",
            "High Priority Alerts: dead_host network_icmp nolookup_communication persistence_autorun bypass_firewall",
            "Win32/Tofsee.AX - https://otx.alienvault.com/indicator/file/47565f3a809e997530e8b0d1602a39cb9cc3dd9e1361db2f9dd5891dfd444383",
            "network_http suspicious_tld allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process stealth_window packer_entropy uses_windows_utilities console_output pe_features",
            "Prorat.19.i: https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
            "IDS: Prorat.19.i Checkin | DYNAMIC_DNS Query to a Suspicious no-ip Domain | CP Email Send via HTTP - Often Trojan Install Reports",
            "Domains Contacted: you.no-ip.com smtp.secureserver.net www.icq.com www.yoursite.com gmali.com",
            "message.htm.com | Ransomware",
            "www.test_ico355_subsequent_invoices.htm.com\tA NXDOMAIN",
            "htm.com: htm | prod.phx3.secureserver.net | unknown.ip.secureserver.net",
            "https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
            "Win.Trojan.Tofsee-6840338-0 | https://otx.alienvault.com/indicator/domain/applehealthcare.com",
            "applegatecode.com, applehealthcare.com, nord-com.it, mail.apple-rehab.com, msa-smtp-mx1.hinet.net, https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-114x114.png No Expiration\t0\t  Domain itae-innova.com No Expiration\t0\t  URL https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-152x152.png, 50.205.3.1 2024-07-14T22:00:00\t0\t  Domain apple-rehab.com No Expiration\t0\t  Domain applegatecode.com",
            "Some items found relates to research exploited against or researched by target: disabled_duck",
            "Crypt_r.AWJ: FileHash-SHA256 cc83b186700b21e5c4cae0f8236ae3e50ab47c2c21a3987ea00463056cbd1c26",
            "Crypt_r.BCM: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
            "Crypt_r.BCM: FileHash-SHA256 cc83b186700b21e5c4cae",
            "Crypt_r.BDI: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
            "Crypt_r.BDI: FileHash-SHA256 71906e67e75f832dfbd2c63fde953d76b6502e48e78badd3ef6fe30d02390268",
            "3.33.152.147: Trojan:Win32/Dursg.K | Verdict External> IP Lookup Service Classification Cloud provider Reverse DNS a4ec4c6ea1c92e2e6.awsglobalaccelerator.com",
            "3.33.152.147: https://otx.alienvault.com/indicator/ip/3.33.152.147",
            "3.33.152.147 - High Priority IDS Detections: Worm.Win32/Chiviper.C Checkin Possible Fake AV Checkin Kazy/Kryptor/Cycbot",
            "3.33.152.147 - High Priority IDS Detections: Trojan Checkin Win32.Meredrop Checkin CryptoWall Check-in Net-Worm.Win32.Koobface.jxs",
            "3.33.152.147 - High Priority IDS Detections: Checkin Virut Counter/Check-in Backdoor.Win32.Polybot.A Checkin 3 Koobface HTTP Request (2) Win32.Sality-GR Checkin",
            "3.33.152.147 - ALF:HSTR:Trojan:Win32/StartPage.ZS!bit ,  ALF:HeraklezEval:PUA:Win32/InstallCore.R ,  ALF:HeraklezEval:Ransom:Win32/Tescrypt!rfn",
            "3.33.152.147 - Antivirus Detections: !#AddsCopyToStartup ,  !#HSTR:SigGen0136cb6c ,  ALF:AGGR:OpcCl:99!ml , ALF:Exploit:O97M/CVE-2017-8977",
            "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/Startpage!rfn ,  ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
            "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/SpyNoon!rfn ,",
            "85.10.215.232 - Classification Datacenter / Hosting / VPS Reverse DNS dediextern.your-server.de Location: Munich,  Germany | konsoleH :: Login",
            "87.98.231.87 - Classification Datacenter / Hosting / VPS Reverse DNS cluster014.ovh.net Location;  Spain | AVD:: TrojanDownloader:JS/Nemucod.QJ",
            "87.98.231.87 - IDS Detections: MalDoc Request for Payload, Unsupported/Fake Windows NT Version 5.0",
            "CVE-2017-8977 - https://otx.alienvault.com/indicator/cve/CVE-2017-8977",
            "CVE-2017-11882 - https://otx.alienvault.com/indicator/cve/CVE-2017-11882"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Seychelles",
            "Netherlands",
            "France",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Win32:BackdoorX-gen\\ [Trj]",
              "display_name": "Win32:BackdoorX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-6840338-0",
              "display_name": "Win.Trojan.Tofsee-6840338-0",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Dursg.K",
              "display_name": "Trojan:Win32/Dursg.K",
              "target": "/malware/Trojan:Win32/Dursg.K"
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Downloader-42770",
              "display_name": "Win.Trojan.Downloader-42770",
              "target": null
            },
            {
              "id": "TrojanDownloader:JS/Nemucod.QJ",
              "display_name": "TrojanDownloader:JS/Nemucod.QJ",
              "target": "/malware/TrojanDownloader:JS/Nemucod.QJ"
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32:Kamso",
              "display_name": "Win32:Kamso",
              "target": null
            },
            {
              "id": "Win.Trojan.Magania-13720",
              "display_name": "Win.Trojan.Magania-13720",
              "target": null
            },
            {
              "id": "Win32:Sality",
              "display_name": "Win32:Sality",
              "target": null
            },
            {
              "id": "Win.Trojan.Swisyn-6819",
              "display_name": "Win.Trojan.Swisyn-6819",
              "target": null
            },
            {
              "id": "Win32:SaliCode",
              "display_name": "Win32:SaliCode",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1313630",
              "display_name": "Win.Trojan.Agent-1313630",
              "target": null
            },
            {
              "id": "Crypt_r.BCM",
              "display_name": "Crypt_r.BCM",
              "target": null
            },
            {
              "id": "ALF:AGGR:Exploit:O97M/CVE-2017-11882",
              "display_name": "ALF:AGGR:Exploit:O97M/CVE-2017-11882",
              "target": null
            },
            {
              "id": "ALF:Exploit:O97M/CVE-2017-8977",
              "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1003.005",
              "name": "Cached Domain Credentials",
              "display_name": "T1003.005 - Cached Domain Credentials"
            },
            {
              "id": "T1212",
              "name": "Exploitation for Credential Access",
              "display_name": "T1212 - Exploitation for Credential Access"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [
            "Retail",
            "Technology",
            "Telecommunications",
            "Civil Society",
            "Online Shopping",
            "Legal"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1965,
            "hostname": 1378,
            "domain": 1922,
            "FileHash-SHA256": 2639,
            "FileHash-MD5": 386,
            "FileHash-SHA1": 377,
            "email": 11,
            "CVE": 2
          },
          "indicator_count": 8680,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "643 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f55ed2015e05ffbc2b72a8",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-16T08:56:50.387000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980471600645142bcd924",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-19T12:08:39.100000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65f55ed2015e05ffbc2b72a8",
          "export_count": 186972,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a20ff8db3854e863dca324",
          "name": "Shared Modules | Hijacker | Masquerading",
          "description": "",
          "modified": "2024-02-12T04:01:56.040000",
          "created": "2024-01-13T04:22:16.961000",
          "tags": [
            "filehashmd5",
            "no expiration",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "hostname",
            "expiration",
            "domain",
            "url https",
            "url http",
            "source",
            "stix",
            "email",
            "email abuse",
            "goreasonlimited",
            "cc no",
            "tompc",
            "sum35",
            "domain xn",
            "searchbox0",
            "domainname0",
            "view",
            "apple",
            "apple id",
            "hijacking",
            "masquerading",
            "exploit",
            "cams",
            "monitoring",
            "loki bot",
            "dns",
            "open ports",
            "malvertizing",
            "malware hosting",
            "apple script",
            "js user",
            "dga",
            "dga domains",
            "malware",
            "multiple_versions",
            "wagersta",
            "decode",
            "system information discovery",
            "decrypt",
            "evasion",
            "defense evasion",
            "emotet",
            "android",
            "ios",
            "wannacry",
            "trojan",
            "worm",
            "cyber threat",
            "benjamin",
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "contacted urls",
            "execution",
            "whois whois",
            "whois sslcert",
            "and china",
            "drop",
            "uchealth",
            "university of cincinnati health"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 2296,
            "FileHash-SHA256": 3362,
            "URL": 6191,
            "domain": 2033,
            "hostname": 3097,
            "email": 37,
            "CVE": 2
          },
          "indicator_count": 19719,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "797 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546cf78627adef6562a97aa",
          "name": "Browser Malware Attack",
          "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:10:48.676000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "867 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546d0120a7e479fecffe2b1",
          "name": "Browser Malware Attack",
          "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:13:21.883000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "867 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "htm.com: htm | prod.phx3.secureserver.net | unknown.ip.secureserver.net",
        "3.33.152.147 - High Priority IDS Detections: Trojan Checkin Win32.Meredrop Checkin CryptoWall Check-in Net-Worm.Win32.Koobface.jxs",
        "Crypt_r.BDI: FileHash-SHA256 71906e67e75f832dfbd2c63fde953d76b6502e48e78badd3ef6fe30d02390268",
        "1080p-torrent.ml",
        "3.33.152.147 - ALF:HSTR:Trojan:Win32/StartPage.ZS!bit ,  ALF:HeraklezEval:PUA:Win32/InstallCore.R ,  ALF:HeraklezEval:Ransom:Win32/Tescrypt!rfn",
        "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/Startpage!rfn ,  ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
        "http://decafsmob.this.id",
        "Targets Apple iPad /iOS | www.amazon.com/ref=ap_frn_logo [embedded] | www.amazon.com  ns1.amzndns.co.uk , ns1.amzndns.com",
        "Crypt_r.AWJ: FileHash-SHA256 cc83b186700b21e5c4cae0f8236ae3e50ab47c2c21a3987ea00463056cbd1c26",
        "3.33.152.147: https://otx.alienvault.com/indicator/ip/3.33.152.147",
        "https://api.wavebrowserbase.com",
        "dev-2.ernestatech.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "IDS: Prorat.19.i Checkin | DYNAMIC_DNS Query to a Suspicious no-ip Domain | CP Email Send via HTTP - Often Trojan Install Reports",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "3.33.152.147 - High Priority IDS Detections: Checkin Virut Counter/Check-in Backdoor.Win32.Polybot.A Checkin 3 Koobface HTTP Request (2) Win32.Sality-GR Checkin",
        "www.search.app.goo.gl",
        "Ryuk: http://kramtechnology.com/",
        "apps.apple.com",
        "Win32/Tofsee.AX - https://otx.alienvault.com/indicator/file/47565f3a809e997530e8b0d1602a39cb9cc3dd9e1361db2f9dd5891dfd444383",
        "newrelic.se",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "3.33.152.147: Trojan:Win32/Dursg.K | Verdict External> IP Lookup Service Classification Cloud provider Reverse DNS a4ec4c6ea1c92e2e6.awsglobalaccelerator.com",
        "http://tracking.3061331.corn10wuk.club",
        "t.name",
        "Crypt_r.BCM: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
        "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/SpyNoon!rfn ,",
        "applestore.id",
        "3.33.152.147 - Antivirus Detections: !#AddsCopyToStartup ,  !#HSTR:SigGen0136cb6c ,  ALF:AGGR:OpcCl:99!ml , ALF:Exploit:O97M/CVE-2017-8977",
        "https://dnsorangetel.dn2.n-helix.com",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "Prorat.19.i: https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
        "a.default.meta.applestore.id",
        "3.33.152.147 - High Priority IDS Detections: Worm.Win32/Chiviper.C Checkin Possible Fake AV Checkin Kazy/Kryptor/Cycbot",
        "87.98.231.87 - Classification Datacenter / Hosting / VPS Reverse DNS cluster014.ovh.net Location;  Spain | AVD:: TrojanDownloader:JS/Nemucod.QJ",
        "Crypt_r.BDI: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
        "Win.Trojan.Tofsee-6840338-0 | https://otx.alienvault.com/indicator/domain/applehealthcare.com",
        "85.10.215.232 - Classification Datacenter / Hosting / VPS Reverse DNS dediextern.your-server.de Location: Munich,  Germany | konsoleH :: Login",
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "www.test_ico355_subsequent_invoices.htm.com\tA NXDOMAIN",
        "cory@whiteskycommunications.com IP: 137.83.95.132 targets victims associates Amazon account and all devices. CnC target Network",
        "Crypt_r.BCM: FileHash-SHA256 cc83b186700b21e5c4cae",
        "states.app",
        "http://e.id?e.id:e.id.getAttribute",
        "object.prototype.hasownproperty.call",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "worker-m-tlcus1.sol.us",
        "network_http suspicious_tld allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process stealth_window packer_entropy uses_windows_utilities console_output pe_features",
        "http://git.io/yBU2rg",
        "apps.apple.com/us/app/id$",
        "location.search",
        "globalworker1.sol.us",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "87.98.231.87 - IDS Detections: MalDoc Request for Payload, Unsupported/Fake Windows NT Version 5.0",
        "CVE-2017-8977 - https://otx.alienvault.com/indicator/cve/CVE-2017-8977",
        "https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
        "applegatecode.com, applehealthcare.com, nord-com.it, mail.apple-rehab.com, msa-smtp-mx1.hinet.net, https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-114x114.png No Expiration\t0\t  Domain itae-innova.com No Expiration\t0\t  URL https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-152x152.png, 50.205.3.1 2024-07-14T22:00:00\t0\t  Domain apple-rehab.com No Expiration\t0\t  Domain applegatecode.com",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "message.htm.com | Ransomware",
        "Domains Contacted: you.no-ip.com smtp.secureserver.net www.icq.com www.yoursite.com gmali.com",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Botnet Server IP: 141.226.230.48",
        "hasownproperty.call",
        "Ransom: message.htm.com",
        "Some items found relates to research exploited against or researched by target: disabled_duck",
        "High Priority Alerts: dead_host network_icmp nolookup_communication persistence_autorun bypass_firewall",
        "CVE-2017-11882 - https://otx.alienvault.com/indicator/cve/CVE-2017-11882",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "id.google.com",
        "Ryuk: kramtechnology.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.trojan.swisyn-6819",
            "Gamehack",
            "Alf:exploit:o97m/cve-2017-8977",
            "Win.trojan.tofsee-6840338-0",
            "Generic",
            "Win32:kamso",
            "Maltiverse",
            "Win32:trojan-gen",
            "Win.trojan.agent-1313630",
            "Trojanspy",
            "Win32:salicode",
            "Hsbc",
            "Trojandownloader:js/nemucod.qj",
            "Backdoor:win32/tofsee.t",
            "Cl0p",
            "Webtoolbar",
            "Alf:aggr:exploit:o97m/cve-2017-11882",
            "Win.packer.pkr_ce1a-9980177-0",
            "Trojan:win32/dursg.k",
            "Win32:backdoorx-gen\\ [trj]",
            "Win.trojan.magania-13720",
            "Win32:sality",
            "Win.trojan.downloader-42770",
            "Crypt_r.bcm"
          ],
          "industries": [
            "Telecommunications",
            "Online shopping",
            "Retail",
            "Civil society",
            "Technology",
            "Legal"
          ],
          "unique_indicators": 59394
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/constructng.net",
    "whois": "http://whois.domaintools.com/constructng.net",
    "domain": "constructng.net",
    "hostname": "planning.constructng.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "666d1488316880c73e04054e",
      "name": "Prorat.19.i | Backdoor:Win32/Tofsee.T - Amazon.com | iOS  | Denver",
      "description": "Targets family members device attacked while shopping on Amazon.com using an obviously device compromised, newer, fully updated iOS device. \nAmazon legal? [legal-choice.ru, youla.legal, https://www.effectv.com/legal/advertiser-terms-and-conditions]\n[applehealthcare.com apple-rehab.com: Backdoor:Win32/Tofsee.T]\nAdversarial CnC over devices and networks.\nRelentless attacks.",
      "modified": "2024-07-15T03:03:34.888000",
      "created": "2024-06-15T04:11:52.737000",
      "tags": [
        "server",
        "hostmaster",
        "amazon legal",
        "dept",
        "amazon",
        "street",
        "stateprovince",
        "postal code",
        "view whois",
        "whois record",
        "date",
        "contact",
        "threat roundup",
        "november",
        "march",
        "december",
        "february",
        "october",
        "january",
        "highly targeted",
        "data",
        "boost mobile",
        "formbook",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "ord52c2 via",
        "cloudfront",
        "sha1",
        "pattern match",
        "ascii text",
        "document file",
        "v2 document",
        "crlf line",
        "size",
        "unicode",
        "beginstring",
        "null",
        "hybrid",
        "refresh",
        "body",
        "span",
        "june",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "unknown",
        "embeddedwb",
        "windows",
        "search",
        "medium",
        "united",
        "show",
        "whitelisted",
        "shellexecuteexw",
        "msie",
        "tofsee",
        "service",
        "write",
        "win32",
        "malware",
        "copy",
        "a nxdomain",
        "passive dns",
        "domain",
        "scan endpoints",
        "all scoreblue",
        "pulse pulses",
        "urls",
        "files",
        "ip related",
        "process32nextw",
        "components",
        "writeconsolew",
        "copy c",
        "delete c",
        "query",
        "useruin",
        "delphi",
        "capture",
        "install",
        "prorat",
        "url http",
        "http",
        "related nids",
        "files location",
        "regsetvalueexa",
        "hx88x89",
        "regbinary",
        "x95xd3xa4",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "x93xaf",
        "stream",
        "persistence",
        "execution",
        "creation date",
        "entries",
        "as44273 host",
        "record value",
        "status",
        "nxdomain",
        "content type",
        "accept",
        "gmt server",
        "gmt etag",
        "accept encoding",
        "ipv4",
        "path",
        "pragma",
        "name servers",
        "west domains",
        "hostname",
        "next",
        "asnone germany",
        "as21499 host",
        "singapore",
        "france",
        "object",
        "com cnt",
        "dem fin",
        "found",
        "as16276",
        "spain unknown",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "encrypt",
        "levelblue",
        "open threat",
        "meta",
        "a div",
        "div div",
        "france unknown",
        "ok server",
        "type",
        "seychelles",
        "whitesky",
        "as29182 jsc",
        "showing",
        "as24940 hetzner",
        "moved",
        "expiration date",
        "aaaa",
        "russia",
        "as15169 google",
        "germany",
        "emails",
        "germany unknown",
        "a domains",
        "body doctype",
        "html public",
        "ietfdtd html",
        "finland",
        "asnone iran",
        "iran",
        "td tr",
        "td td",
        "tbody",
        "tr tr",
        "domains",
        "backdoor",
        "apple",
        "radio hacking",
        "voicestram",
        "listening",
        "trojan",
        "twitter",
        "servers",
        "vbs",
        "data center",
        "avg clamav",
        "msdefender sep",
        "vitro mar",
        "Win32:Vitro",
        "target: tsara brashears",
        "target: brashears personal devices",
        "target: whitesky communication network",
        "target: accounting firm devices",
        "targets: intellectual property",
        "redrum",
        "open",
        "tr tbody",
        "rsa ca",
        "apache",
        "as7922 comcast",
        "pulse submit",
        "url analysis",
        "epss",
        "impact",
        "cve cve20178977",
        "exploits",
        "targeted",
        "cve overview",
        "media"
      ],
      "references": [
        "Targets Apple iPad /iOS | www.amazon.com/ref=ap_frn_logo [embedded] | www.amazon.com  ns1.amzndns.co.uk , ns1.amzndns.com",
        "cory@whiteskycommunications.com IP: 137.83.95.132 targets victims associates Amazon account and all devices. CnC target Network",
        "High Priority Alerts: dead_host network_icmp nolookup_communication persistence_autorun bypass_firewall",
        "Win32/Tofsee.AX - https://otx.alienvault.com/indicator/file/47565f3a809e997530e8b0d1602a39cb9cc3dd9e1361db2f9dd5891dfd444383",
        "network_http suspicious_tld allocates_rwx antivm_disk_size creates_exe creates_service suspicious_process stealth_window packer_entropy uses_windows_utilities console_output pe_features",
        "Prorat.19.i: https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
        "IDS: Prorat.19.i Checkin | DYNAMIC_DNS Query to a Suspicious no-ip Domain | CP Email Send via HTTP - Often Trojan Install Reports",
        "Domains Contacted: you.no-ip.com smtp.secureserver.net www.icq.com www.yoursite.com gmali.com",
        "message.htm.com | Ransomware",
        "www.test_ico355_subsequent_invoices.htm.com\tA NXDOMAIN",
        "htm.com: htm | prod.phx3.secureserver.net | unknown.ip.secureserver.net",
        "https://otx.alienvault.com/indicator/file/03f92e83f56ad2d687ee2fb7ab21b7fea0bebc1abc82d387a52510b61506e68f",
        "Win.Trojan.Tofsee-6840338-0 | https://otx.alienvault.com/indicator/domain/applehealthcare.com",
        "applegatecode.com, applehealthcare.com, nord-com.it, mail.apple-rehab.com, msa-smtp-mx1.hinet.net, https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-114x114.png No Expiration\t0\t  Domain itae-innova.com No Expiration\t0\t  URL https://itae-innova.com/wp-content/themes/itaeinnova/images/apple-touch-icon-152x152.png, 50.205.3.1 2024-07-14T22:00:00\t0\t  Domain apple-rehab.com No Expiration\t0\t  Domain applegatecode.com",
        "Some items found relates to research exploited against or researched by target: disabled_duck",
        "Crypt_r.AWJ: FileHash-SHA256 cc83b186700b21e5c4cae0f8236ae3e50ab47c2c21a3987ea00463056cbd1c26",
        "Crypt_r.BCM: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
        "Crypt_r.BCM: FileHash-SHA256 cc83b186700b21e5c4cae",
        "Crypt_r.BDI: FileHash-SHA256 1e0449b5a573e08289ba8de12b70410abfb021f81819b462cd7659fbcb361b11",
        "Crypt_r.BDI: FileHash-SHA256 71906e67e75f832dfbd2c63fde953d76b6502e48e78badd3ef6fe30d02390268",
        "3.33.152.147: Trojan:Win32/Dursg.K | Verdict External> IP Lookup Service Classification Cloud provider Reverse DNS a4ec4c6ea1c92e2e6.awsglobalaccelerator.com",
        "3.33.152.147: https://otx.alienvault.com/indicator/ip/3.33.152.147",
        "3.33.152.147 - High Priority IDS Detections: Worm.Win32/Chiviper.C Checkin Possible Fake AV Checkin Kazy/Kryptor/Cycbot",
        "3.33.152.147 - High Priority IDS Detections: Trojan Checkin Win32.Meredrop Checkin CryptoWall Check-in Net-Worm.Win32.Koobface.jxs",
        "3.33.152.147 - High Priority IDS Detections: Checkin Virut Counter/Check-in Backdoor.Win32.Polybot.A Checkin 3 Koobface HTTP Request (2) Win32.Sality-GR Checkin",
        "3.33.152.147 - ALF:HSTR:Trojan:Win32/StartPage.ZS!bit ,  ALF:HeraklezEval:PUA:Win32/InstallCore.R ,  ALF:HeraklezEval:Ransom:Win32/Tescrypt!rfn",
        "3.33.152.147 - Antivirus Detections: !#AddsCopyToStartup ,  !#HSTR:SigGen0136cb6c ,  ALF:AGGR:OpcCl:99!ml , ALF:Exploit:O97M/CVE-2017-8977",
        "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/Startpage!rfn ,  ALF:HeraklezEval:Trojan:Win32/Ymacco.AA47",
        "3.33.152.147 - Antivirus Detections:  ALF:HeraklezEval:Trojan:Win32/SpyNoon!rfn ,",
        "85.10.215.232 - Classification Datacenter / Hosting / VPS Reverse DNS dediextern.your-server.de Location: Munich,  Germany | konsoleH :: Login",
        "87.98.231.87 - Classification Datacenter / Hosting / VPS Reverse DNS cluster014.ovh.net Location;  Spain | AVD:: TrojanDownloader:JS/Nemucod.QJ",
        "87.98.231.87 - IDS Detections: MalDoc Request for Payload, Unsupported/Fake Windows NT Version 5.0",
        "CVE-2017-8977 - https://otx.alienvault.com/indicator/cve/CVE-2017-8977",
        "CVE-2017-11882 - https://otx.alienvault.com/indicator/cve/CVE-2017-11882"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Seychelles",
        "Netherlands",
        "France",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Win32:BackdoorX-gen\\ [Trj]",
          "display_name": "Win32:BackdoorX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-6840338-0",
          "display_name": "Win.Trojan.Tofsee-6840338-0",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Dursg.K",
          "display_name": "Trojan:Win32/Dursg.K",
          "target": "/malware/Trojan:Win32/Dursg.K"
        },
        {
          "id": "Win.Packer.pkr_ce1a-9980177-0",
          "display_name": "Win.Packer.pkr_ce1a-9980177-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Downloader-42770",
          "display_name": "Win.Trojan.Downloader-42770",
          "target": null
        },
        {
          "id": "TrojanDownloader:JS/Nemucod.QJ",
          "display_name": "TrojanDownloader:JS/Nemucod.QJ",
          "target": "/malware/TrojanDownloader:JS/Nemucod.QJ"
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32:Kamso",
          "display_name": "Win32:Kamso",
          "target": null
        },
        {
          "id": "Win.Trojan.Magania-13720",
          "display_name": "Win.Trojan.Magania-13720",
          "target": null
        },
        {
          "id": "Win32:Sality",
          "display_name": "Win32:Sality",
          "target": null
        },
        {
          "id": "Win.Trojan.Swisyn-6819",
          "display_name": "Win.Trojan.Swisyn-6819",
          "target": null
        },
        {
          "id": "Win32:SaliCode",
          "display_name": "Win32:SaliCode",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1313630",
          "display_name": "Win.Trojan.Agent-1313630",
          "target": null
        },
        {
          "id": "Crypt_r.BCM",
          "display_name": "Crypt_r.BCM",
          "target": null
        },
        {
          "id": "ALF:AGGR:Exploit:O97M/CVE-2017-11882",
          "display_name": "ALF:AGGR:Exploit:O97M/CVE-2017-11882",
          "target": null
        },
        {
          "id": "ALF:Exploit:O97M/CVE-2017-8977",
          "display_name": "ALF:Exploit:O97M/CVE-2017-8977",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1003.005",
          "name": "Cached Domain Credentials",
          "display_name": "T1003.005 - Cached Domain Credentials"
        },
        {
          "id": "T1212",
          "name": "Exploitation for Credential Access",
          "display_name": "T1212 - Exploitation for Credential Access"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [
        "Retail",
        "Technology",
        "Telecommunications",
        "Civil Society",
        "Online Shopping",
        "Legal"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1965,
        "hostname": 1378,
        "domain": 1922,
        "FileHash-SHA256": 2639,
        "FileHash-MD5": 386,
        "FileHash-SHA1": 377,
        "email": 11,
        "CVE": 2
      },
      "indicator_count": 8680,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "643 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f55ed2015e05ffbc2b72a8",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-16T08:56:50.387000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980471600645142bcd924",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-19T12:08:39.100000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65f55ed2015e05ffbc2b72a8",
      "export_count": 186972,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a20ff8db3854e863dca324",
      "name": "Shared Modules | Hijacker | Masquerading",
      "description": "",
      "modified": "2024-02-12T04:01:56.040000",
      "created": "2024-01-13T04:22:16.961000",
      "tags": [
        "filehashmd5",
        "no expiration",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "hostname",
        "expiration",
        "domain",
        "url https",
        "url http",
        "source",
        "stix",
        "email",
        "email abuse",
        "goreasonlimited",
        "cc no",
        "tompc",
        "sum35",
        "domain xn",
        "searchbox0",
        "domainname0",
        "view",
        "apple",
        "apple id",
        "hijacking",
        "masquerading",
        "exploit",
        "cams",
        "monitoring",
        "loki bot",
        "dns",
        "open ports",
        "malvertizing",
        "malware hosting",
        "apple script",
        "js user",
        "dga",
        "dga domains",
        "malware",
        "multiple_versions",
        "wagersta",
        "decode",
        "system information discovery",
        "decrypt",
        "evasion",
        "defense evasion",
        "emotet",
        "android",
        "ios",
        "wannacry",
        "trojan",
        "worm",
        "cyber threat",
        "benjamin",
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "contacted urls",
        "execution",
        "whois whois",
        "whois sslcert",
        "and china",
        "drop",
        "uchealth",
        "university of cincinnati health"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 2296,
        "FileHash-SHA256": 3362,
        "URL": 6191,
        "domain": 2033,
        "hostname": 3097,
        "email": 37,
        "CVE": 2
      },
      "indicator_count": 19719,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "797 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546cf78627adef6562a97aa",
      "name": "Browser Malware Attack",
      "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:10:48.676000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "867 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546d0120a7e479fecffe2b1",
      "name": "Browser Malware Attack",
      "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:13:21.883000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "867 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://planning.constructng.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://planning.constructng.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639181.0045385
}