{
  "type": "URL",
  "indicator": "https://prodapi.flashpetrol.am",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://prodapi.flashpetrol.am",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4155105820,
      "indicator": "https://prodapi.flashpetrol.am",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "698037098c99c37cb91037c2",
          "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
          "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
          "modified": "2026-03-04T04:07:14.513000",
          "created": "2026-02-02T05:32:57.303000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "domain",
            "hostname",
            "filehashmd5",
            "filehashsha1",
            "iocs",
            "url https",
            "search",
            "type indicator",
            "review iocs",
            "role title",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "extraction",
            "sc data",
            "extre data",
            "include review",
            "exclude sugges",
            "data upload",
            "failed",
            "find s",
            "oo data",
            "enter source",
            "url or",
            "text drag",
            "expiration",
            "showing",
            "entries",
            "protect",
            "pulse show",
            "email abuse",
            "related pulses",
            "indicator role",
            "returnurl no",
            "drop",
            "pulse provide",
            "public tlp",
            "green",
            "adversary tags",
            "buzz",
            "x8664",
            "add tag",
            "groups add",
            "add industry",
            "trojan",
            "tags"
          ],
          "references": [
            "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
            "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
            "Antivirus Detections: Trojan:Win32/Dorv.A",
            "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
            "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
            "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
            "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
            "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
            "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
            "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
            "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
            "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
            "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
            "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
            "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
            "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
            "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
            "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
            "Antivirus Detections: Win.Malware.Pits-10035540-0",
            "Yara: Detections Delphi",
            "Alerts: infostealer_cookies antiav_detectfile",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
            "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
            "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
            "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
            "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
            "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
            "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
            "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
            "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
            "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
            "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
            "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
            "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
            "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
            "https://cpcontacts.apple4you.it",
            "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
            "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
            "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
            "https://fs25.mygamesteam.com/download/underground-parking/",
            "http://spiritzuridgerunelahubcloudgusparkx.rest/",
            "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
            "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
            "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
            "IDS Detections: Suspicious Activity potential UPnProxy",
            "Yara Detections: is__elf ,  ECHOBOT",
            "Alerts: dead_host network_icmp tcp_by",
            "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
            "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
            "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
            "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
            "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
            "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
            "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
            "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
            "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
            "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
            "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
            "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
            "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
            "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
            "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
            "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
            "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
            "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
            "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
            "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
            "TAGS: sample analysis se domains search security quic add source level span spawns spy",
            "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
            "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
            "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Hungary"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "DDos:Linux/Gafgyt.YA!MTB",
              "display_name": "DDos:Linux/Gafgyt.YA!MTB",
              "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
            },
            {
              "id": "ELF:DDoS-S\\ [Trj]",
              "display_name": "ELF:DDoS-S\\ [Trj]",
              "target": null
            },
            {
              "id": "Pykspa.C",
              "display_name": "Pykspa.C",
              "target": null
            },
            {
              "id": "Trojan:Win32/Dorv.A",
              "display_name": "Trojan:Win32/Dorv.A",
              "target": "/malware/Trojan:Win32/Dorv.A"
            },
            {
              "id": "Unix.Trojan.Gafgyt-698115",
              "display_name": "Unix.Trojan.Gafgyt-698115",
              "target": null
            },
            {
              "id": "4-0 Win.Malware.Pits-10035540-0",
              "display_name": "4-0 Win.Malware.Pits-10035540-0",
              "target": null
            },
            {
              "id": "Win.Packed.Usteal-7531303-0",
              "display_name": "Win.Packed.Usteal-7531303-0",
              "target": null
            },
            {
              "id": "tR",
              "display_name": "tR",
              "target": null
            },
            {
              "id": "DeathHiddenTear (Large&Small HT)   >",
              "display_name": "DeathHiddenTear (Large&Small HT)   >",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1456",
              "name": "Drive-by Compromise",
              "display_name": "T1456 - Drive-by Compromise"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1608",
              "name": "Stage Capabilities",
              "display_name": "T1608 - Stage Capabilities"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1586,
            "FileHash-SHA1": 1479,
            "FileHash-SHA256": 1938,
            "URL": 4548,
            "domain": 1052,
            "hostname": 2501,
            "email": 9,
            "SSLCertFingerprint": 7,
            "CIDR": 2
          },
          "indicator_count": 13122,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "46 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692f04e9fa3d782118e94aac",
          "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
          "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
          "modified": "2026-01-01T15:04:20.907000",
          "created": "2025-12-02T15:25:29.158000",
          "tags": [
            "levelblue",
            "open threat",
            "dynamicloader",
            "tlsv1",
            "high",
            "msie",
            "windows nt",
            "delete c",
            "fwlink",
            "stream",
            "powershell",
            "write",
            "malware",
            "local",
            "united",
            "flag",
            "date",
            "server",
            "crazy egg",
            "name server",
            "gmt flag",
            "domain address",
            "markmonitor",
            "enom",
            "sugges",
            "onv incude",
            "data upload",
            "find s",
            "extraction",
            "types",
            "type",
            "indicator",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "contacted hosts",
            "search",
            "entries",
            "read c",
            "medium",
            "memcommit",
            "tls handshake",
            "failure",
            "module load",
            "next",
            "execution",
            "dock",
            "capture",
            "persistence",
            "copy",
            "unknown",
            "suricata alert",
            "et info",
            "bad traffic",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "t1480 execution",
            "file defense",
            "write c",
            "x02x82",
            "xe6x15c6",
            "x16f",
            "xc0xc0xc0",
            "revengerat",
            "guard",
            "service",
            "encrypt",
            "entries yara",
            "delphi",
            "win32",
            "jordan",
            "delete app"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
            "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
            "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Vmprotect-9880726-0",
              "display_name": "Win.Malware.Vmprotect-9880726-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4624,
            "FileHash-SHA256": 2021,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 20,
            "SSLCertFingerprint": 10,
            "hostname": 1433,
            "domain": 728
          },
          "indicator_count": 8887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e2d950ac7d1e2a3454a4f",
          "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack",
          "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers",
          "modified": "2025-12-31T23:04:59.378000",
          "created": "2025-12-02T00:06:45.807000",
          "tags": [
            "iocs",
            "drop",
            "network traffic",
            "ck id",
            "mitre att",
            "ck matrix",
            "network related",
            "detected",
            "t1566",
            "t1204",
            "united",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "tor analysis",
            "dns requests",
            "learn",
            "suspicious",
            "informative",
            "name tactics",
            "adversaries",
            "command",
            "initial access",
            "spawns",
            "found",
            "binary file",
            "t1189",
            "regsetvalueexa",
            "regdword",
            "post http",
            "medium",
            "high",
            "regbinary",
            "loader",
            "dock",
            "write",
            "malware",
            "unknown",
            "romania unknown",
            "present may",
            "msie",
            "chrome",
            "body",
            "passive dns",
            "ip address",
            "present jun",
            "welcome",
            "accept",
            "encrypt",
            "gmt content",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "reverse dns",
            "unknown aaaa",
            "certificate",
            "hostname add",
            "error",
            "flag",
            "domain address",
            "contacted hosts",
            "type",
            "india unknown",
            "record value",
            "body html",
            "head title",
            "title",
            "entries",
            "read c",
            "high defense",
            "evasion",
            "yara detections",
            "virtool",
            "win32",
            "ahmann",
            "hacker group",
            "law firm",
            "order",
            "google",
            "smart assembly"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "VirTool:MSIL/Injector.BF",
              "display_name": "VirTool:MSIL/Injector.BF",
              "target": "/malware/VirTool:MSIL/Injector.BF"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1087.003",
              "name": "Email Account",
              "display_name": "T1087.003 - Email Account"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 115,
            "FileHash-SHA1": 112,
            "FileHash-SHA256": 589,
            "URL": 1795,
            "SSLCertFingerprint": 3,
            "domain": 319,
            "hostname": 847,
            "email": 1
          },
          "indicator_count": 3781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e1b4122a419384f1add7f",
          "name": "Cutwail Trojan DownLoader | Driveby compromises | Redirect",
          "description": "Cutwail Trojan DownLoader | Driveby comprises | Malicious Redirects.\n\nSuspicious redirects from Google homepage to \u2018Doodle\u2019s\nHeavy , ongoing cyber attack. Affects, iOS, Android, Cellular networks (global)\n\nI\u2019m hoping OTX will fully pulse. Indicators will be pulsed fully relying on OTX auto\npulse alone. No references or input from me.",
          "modified": "2025-12-31T22:02:44.679000",
          "created": "2025-12-01T22:48:33.510000",
          "tags": [
            "filehashmd5",
            "filehashsha256",
            "sha256",
            "filehashsha1",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "dynamicloader",
            "medium",
            "show",
            "entries",
            "dynamic",
            "pe section",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "copy",
            "write",
            "flag",
            "misc activity",
            "et info",
            "cloudflare dns",
            "over https",
            "windir",
            "openurl c",
            "prefetch2",
            "dns requests",
            "domain address",
            "google homepage",
            "html",
            "binary file",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "matched",
            "redirect",
            "t1189",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "ck techniques",
            "alert",
            "potential ip",
            "general",
            "click",
            "united",
            "analysis tip",
            "analysis",
            "tor analysis",
            "date",
            "c pe",
            "data upload",
            "extraction",
            "iocs",
            "manually add",
            "network traffic",
            "detected",
            "t1566",
            "submitted url",
            "t1204"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 95,
            "FileHash-SHA1": 95,
            "FileHash-SHA256": 183,
            "hostname": 227,
            "domain": 83,
            "URL": 575
          },
          "indicator_count": 1258,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6928f8d9e4222a6a219d785e",
          "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
          "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
          "modified": "2025-12-28T00:04:06.179000",
          "created": "2025-11-28T01:20:25.401000",
          "tags": [
            "dynamicloader",
            "json",
            "ascii text",
            "high",
            "data",
            "x90uxa4xf8",
            "cape",
            "stream",
            "guard",
            "write",
            "trojan",
            "redline",
            "malware",
            "push",
            "local",
            "injection_inter_process",
            "recon_fingerprint",
            "persistence_ads",
            "process_creation_suspicious_location",
            "infostealer_browser",
            "infostealer_cookies",
            "stealth_file",
            "cape_detected_threat",
            "antivm_generic_bios",
            "cape_extracted_content",
            "united",
            "mtb jul",
            "a domains",
            "aaaa",
            "443 ma86400",
            "servers",
            "win32upatre jul",
            "virtool",
            "b778b1",
            "div div",
            "d9e4f4",
            "edf2f8",
            "present mar",
            "fastest privacy",
            "first dns",
            "win32",
            "trojandropper",
            "passive dns",
            "mtb nov",
            "ipv4 add",
            "asn as13335",
            "dns resolutions",
            "domain",
            "data upload",
            "extraction",
            "yara",
            "troja yara",
            "trojar data",
            "virto",
            "worn data",
            "included iocs",
            "manually add",
            "resolved ips",
            "ta0002",
            "evasion ta0005",
            "tr shared",
            "modules",
            "files",
            "infor",
            "t1027",
            "process t1057",
            "community score",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "defense evasion",
            "spawns",
            "flag",
            "name server",
            "date",
            "cloudflare",
            "data protected",
            "misc activity",
            "et info",
            "dns requests",
            "domain address",
            "gmt flag",
            "techtarget",
            "server",
            "et policy",
            "prefetch2",
            "t1179 hooking",
            "access windows",
            "installs",
            "mitre att",
            "ck techniques",
            "click",
            "windir",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "contacted",
            "http traffic",
            "suricata alerts",
            "event category",
            "found"
          ],
          "references": [
            "Malware : ClipBanker Entity: Crazy Frost",
            "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
            "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
            "Services : GoogleChromeElevationService = Delete",
            "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
            "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
            "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
            "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
            "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
            "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
            "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
            "CS IDS: Matches rule (http_inspect) invalid status line",
            "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
            "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube/"
          ],
          "public": 1,
          "adversary": "Crazy Frost",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Trojan.Disfa/downloader10",
              "display_name": "Trojan.Disfa/downloader10",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "Rozena",
              "display_name": "Rozena",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1464",
              "name": "Jamming or Denial of Service",
              "display_name": "T1464 - Jamming or Denial of Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 295,
            "FileHash-SHA1": 217,
            "FileHash-SHA256": 1887,
            "URL": 3263,
            "domain": 597,
            "hostname": 1085,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 7347,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "112 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "Malware : ClipBanker Entity: Crazy Frost",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Alerts: infostealer_cookies antiav_detectfile",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule",
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "Alerts: dead_host network_icmp tcp_by",
        "https://cpcontacts.apple4you.it",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "Yara: Detections Delphi",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "http://www.anyxxxtube/",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "Services : GoogleChromeElevationService = Delete",
        "Yara Detections: is__elf ,  ECHOBOT",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "https://fs25.mygamesteam.com/download/underground-parking/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Crazy Frost"
          ],
          "malware_families": [
            "Trojan:win32/zusy",
            "Virtool:msil/injector.bf",
            "Trojan:win32/dorv.a",
            "Ddos:linux/gafgyt.ya!mtb",
            "Ransomware",
            "Win.malware.vmprotect-9880726-0",
            "Rozena",
            "4-0 win.malware.pits-10035540-0",
            "Trojan.disfa/downloader10",
            "Pykspa.c",
            "Other malware",
            "Elf:ddos-s\\ [trj]",
            "Tr",
            "Deathhiddentear (large&small ht)   >",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Unix.trojan.gafgyt-698115",
            "Win.packed.usteal-7531303-0"
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "unique_indicators": 31020
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/flashpetrol.am",
    "whois": "http://whois.domaintools.com/flashpetrol.am",
    "domain": "flashpetrol.am",
    "hostname": "prodapi.flashpetrol.am"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "698037098c99c37cb91037c2",
      "name": "Busy Box MITM Attacks via Drive-by-Compromise | Facebook | Apple",
      "description": "Busy Box - MITM Attack\n\nDrive-by-Compromise | Facebook | Jamie Oliver Recipes | My sister-in-law made this once and I couldn\u2019t stop eating it. \nAdversarial Facebook pop up posts. .\n\n|| Pykspa.C Check in. \"Pykspa is a type of Remote Access Trojan (RAT). A powerful  a worm that spreads via social media or via DGA algorithms. Parking crews are fond of these types of attacks. Christopher Ahmann",
      "modified": "2026-03-04T04:07:14.513000",
      "created": "2026-02-02T05:32:57.303000",
      "tags": [
        "no expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "domain",
        "hostname",
        "filehashmd5",
        "filehashsha1",
        "iocs",
        "url https",
        "search",
        "type indicator",
        "review iocs",
        "role title",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "extraction",
        "sc data",
        "extre data",
        "include review",
        "exclude sugges",
        "data upload",
        "failed",
        "find s",
        "oo data",
        "enter source",
        "url or",
        "text drag",
        "expiration",
        "showing",
        "entries",
        "protect",
        "pulse show",
        "email abuse",
        "related pulses",
        "indicator role",
        "returnurl no",
        "drop",
        "pulse provide",
        "public tlp",
        "green",
        "adversary tags",
        "buzz",
        "x8664",
        "add tag",
        "groups add",
        "add industry",
        "trojan",
        "tags"
      ],
      "references": [
        "https://www.facebook.com/groups/378607181955796/posts/773093455840498/?hpir=1&http_ref=eyJ0cyI6MTc2OTk2MDkxOTAwMCwiciI6IiJ9",
        "www.crazyfrost.com IPv4 104.21.5.49 IPv4 172.67.132.250",
        "Antivirus Detections: Trojan:Win32/Dorv.A",
        "IDS Detections: Win32/Pykspa.C Public IP Check IP Check Domain (whatismyip in HTTP Host)",
        "IDS Detections: IP Check Domain (showmyipaddress .com in HTTP Host) External IP Lookup",
        "IDS Detections: Domain in DNS Lookup (whatismyipaddress .com) IP Check",
        "IDS Detections: Domain (whatismyipaddress .com in HTTP Host)",
        "Yara Detections XOR_embeded_exefile_xored_with_round_256_bytes_key",
        "Alerts: antiav_servicestop antisandbox_sleep process_creation_suspicious_location",
        "Alerts: network_bind persistence_autorun binary_yara procmem_yara suricata_alert",
        "Alerts: disables_uac infostealer_keylog modify_uac_prompt anomalous_deletefile",
        "Alerts: mouse_movement_detect dead_connect  enumerates_running_processes process_needed",
        "Alerts: dynamic_function_loading reads_memory_remote_process packer_entropy network_http",
        "IP\u2019s Contacted: 188.223.42.134 78.57.88.30  84.73.234.83  78.84.44.225  89.252.203.80",
        "IP\u2019s Contacted: 77.76.39.110 104.156.155.94  77.77.13.89  78.61.87.173  78.63.104.75",
        "Domains Contacted: www.whatismyip.com www.showmyipaddress.com www.whatismyip.ca",
        "Domains Contacted: whatismyipaddress.com whatismyip.everdot.org www.facebook.com",
        "Domains Contacted: fexexwjehud.org lxclombt.net jpnzlsaqogv.com esccuyigsy.org",
        "Antivirus Detections: Win.Malware.Pits-10035540-0",
        "Yara: Detections Delphi",
        "Alerts: infostealer_cookies antiav_detectfile",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "nigger.cat \u2022 http://a.nigger.cat/ \u2022 http://a.nigger.cat/imrred.exe \u2022 http://a.nigger.cat/iwzptk.pdf \u2022",
        "http://a.nigger.cat/ltbexb.jpg \u2022 http://a.nigger.cat/ocnxdv.exe \u2022 http://a.nigger.cat/ocnxdv.exe/",
        "http://a.nigger.cat/ovefvy.html \u2022 http://a.nigger.cat/snkikb.rar \u2022 http://a.nigger.cat/unipms.exe",
        "http://a.nigger.cat/ypphgg.exe \u2022 http://u.nigger.cat/ \u2022 https://a.nigger.cat/",
        "http://www.a.nigger.cat/ocnxdv.exe \u2022 https://a.nigger.cat/pwzbrt.txt",
        "output.228572717.txt [fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f]",
        "https://www.virustotal.com/gui/file/fb970a4bffed1d606a8d90369d43e3a73ea9c8dbcf1394745f1568500e918e1f/summary",
        "https://hybrid-analysis.com/sample/3aaca21b3918eecd127867bdd724611398cf897a0686fedfde1d424b7ad6130a",
        "https://hybrid-analysis.com/sample/e4999984a69a65a69bec9fef1200f7ec36a10bc401cdd15db3510fdc87ec5008/697fb0fec4a9bda3410454cf",
        "https://hybrid-analysis.com/sample/f6ccff8dec08334fab98d4f6cb9b2774acd00e98d1afabd219c2634d5b3e2147/697faa178cc598cfb90b0423",
        "https://hybrid-analysis.com/sample/01a1a2106bcddc591cab08d31c13966bd0413fe312bce9be396e964e114631a6/697f8c04475b90e7fb0d7ff9",
        "apple4you.it \u2022 https://www.apple4you.it/ \u2022 cpcalendars.apple4you.it \u2022 ftp.apple4you.it \u2022",
        "https://ftp.apple4you.it \u2022 http://cpcalendars.apple4you.it \u2022 http://cpcontacts.apple4you.it \u2022",
        "http://ftp.apple4you.it \u2022 http://www.apple4you.it/ \u2022https://cpcalendars.apple4you.it \u2022",
        "https://cpcontacts.apple4you.it",
        "AppleWebKit Christopher P. \u2018BUZZ\u2019 Ahmann interference",
        "adsparkahz.shop \u2022 https://adsparkahz.shop/ \u2022 parkedbits.com",
        "https://parkedbits.com \u2022 spiritzuridgerunelahubcloudgusparkx.rest",
        "https://fs25.mygamesteam.com/download/underground-parking/",
        "http://spiritzuridgerunelahubcloudgusparkx.rest/",
        "127.0.0.1 Private IP Address  \u2022  http://facebook.com/iWebTechnologies",
        "9e8c2f9e77b4b6a7538e4136d3bda379c560dc1a5931643da119da2f28881e4d\tELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0\tDDoS:Linux/Gafgyt.YA!MTB",
        "ELF:DDoS-S\\ [Trj] ,  Unix.Trojan.Gafgyt-6981154-0 ,  DDoS:Linux/Gafgyt.YA!MTB",
        "IDS Detections: Suspicious Activity potential UPnProxy",
        "Yara Detections: is__elf ,  ECHOBOT",
        "Alerts: dead_host network_icmp tcp_by",
        "Unix.Dropper.Mirai-7135925-0 ,  DDoS:Linux/Gafgyt.YA!MTB Yara Detections is__elf ,  ECHOBOT",
        "TAGS: aaaa accept activity address adversaries aes128gcm ahmann all hostname all ipv4 as15169",
        "TAGS: as29278 deninet as29728 cottage as47325 ascii text asn as29278 asn as29728 asn13335",
        "TAGS: av detections av exploit belgium belgium unknown binbusybox bits body canada unknown",
        "TAGS: christopher p christopher p. \u2018buzz\u2019 ahmann ck id ck matrix ck techniques clare click cloud",
        "TAGS: cloudflare cloudflarenet command config connection copy crazyfrost cyber attacks",
        "TAGS: data upload date date hash ddos dead connection default defense evasion delphi destination",
        "TAGS:  detection detections detections name development att direct dirty dns resolutions domain",
        "TAGS: add dynamicloader ecdsa echobot echobot related encrypt entries error evasion att",
        "TAGS: expiration date explorer extraction facebook facebook failed february filehash files files ip",
        "TAGS: flag gecko general general full general info generator geo hungary guard hackers hash hide",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passiv",
        "TAGS: samples high host hover httpsupgrades hu note hu seen hungary hungary asn hybrid ids detections",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec mtb yara name servers name tactics network traffic new browser next associated next yara niggercat none file null object os x outbound passive dns path pattern match pink screen port possible prefetch8 present dec present feb present jan",
        "TAGS: ilwysowa text informative intel mac ip address ip check ipv4 ipv4 add is__elf jamie oliver",
        "TAGS: json khtml launcher learn leve blu linux x8664 live live screenshot local logs look m. brian sabey",
        "TAGS: macintosh malware medium melvin sabey meta mitre att mobile ms windows mtb dec",
        "TAGS: mtb yara name servers name tactics network traffic new browser next associated next",
        "TAGS: yara niggercat none file null object os x outbound passive dns path pattern match",
        "TAGS: pink screen port possible prefetch8 present program protocol h3 ptr record none push",
        "TAGS: pyspark python python initiated quic ransom recipes record value redacted for",
        "TAGS. redirect refresh related tags remoteIPAddress resource restart reverse dns route runner",
        "TAGS: sample analysis se domains search security quic add source level span spawns spy",
        "TAGS: state of colorado stream strings suspicious t1590 gather tcp syn title tools tr trex triangulation",
        "TAGS: trojan trojandropper trojanspy united unknown unknown aaaa unknown ns updater",
        "TAGS: upnproxy url analysis url https url text urls verified verify veryhigh victim network vubbuv win32 win64 windows windows nt windows server worm write write c yara detections yara rule"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Hungary"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "DDos:Linux/Gafgyt.YA!MTB",
          "display_name": "DDos:Linux/Gafgyt.YA!MTB",
          "target": "/malware/DDos:Linux/Gafgyt.YA!MTB"
        },
        {
          "id": "ELF:DDoS-S\\ [Trj]",
          "display_name": "ELF:DDoS-S\\ [Trj]",
          "target": null
        },
        {
          "id": "Pykspa.C",
          "display_name": "Pykspa.C",
          "target": null
        },
        {
          "id": "Trojan:Win32/Dorv.A",
          "display_name": "Trojan:Win32/Dorv.A",
          "target": "/malware/Trojan:Win32/Dorv.A"
        },
        {
          "id": "Unix.Trojan.Gafgyt-698115",
          "display_name": "Unix.Trojan.Gafgyt-698115",
          "target": null
        },
        {
          "id": "4-0 Win.Malware.Pits-10035540-0",
          "display_name": "4-0 Win.Malware.Pits-10035540-0",
          "target": null
        },
        {
          "id": "Win.Packed.Usteal-7531303-0",
          "display_name": "Win.Packed.Usteal-7531303-0",
          "target": null
        },
        {
          "id": "tR",
          "display_name": "tR",
          "target": null
        },
        {
          "id": "DeathHiddenTear (Large&Small HT)   >",
          "display_name": "DeathHiddenTear (Large&Small HT)   >",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1456",
          "name": "Drive-by Compromise",
          "display_name": "T1456 - Drive-by Compromise"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1608",
          "name": "Stage Capabilities",
          "display_name": "T1608 - Stage Capabilities"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1586,
        "FileHash-SHA1": 1479,
        "FileHash-SHA256": 1938,
        "URL": 4548,
        "domain": 1052,
        "hostname": 2501,
        "email": 9,
        "SSLCertFingerprint": 7,
        "CIDR": 2
      },
      "indicator_count": 13122,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "46 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692f04e9fa3d782118e94aac",
      "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
      "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
      "modified": "2026-01-01T15:04:20.907000",
      "created": "2025-12-02T15:25:29.158000",
      "tags": [
        "levelblue",
        "open threat",
        "dynamicloader",
        "tlsv1",
        "high",
        "msie",
        "windows nt",
        "delete c",
        "fwlink",
        "stream",
        "powershell",
        "write",
        "malware",
        "local",
        "united",
        "flag",
        "date",
        "server",
        "crazy egg",
        "name server",
        "gmt flag",
        "domain address",
        "markmonitor",
        "enom",
        "sugges",
        "onv incude",
        "data upload",
        "find s",
        "extraction",
        "types",
        "type",
        "indicator",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "contacted hosts",
        "search",
        "entries",
        "read c",
        "medium",
        "memcommit",
        "tls handshake",
        "failure",
        "module load",
        "next",
        "execution",
        "dock",
        "capture",
        "persistence",
        "copy",
        "unknown",
        "suricata alert",
        "et info",
        "bad traffic",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "t1480 execution",
        "file defense",
        "write c",
        "x02x82",
        "xe6x15c6",
        "x16f",
        "xc0xc0xc0",
        "revengerat",
        "guard",
        "service",
        "encrypt",
        "entries yara",
        "delphi",
        "win32",
        "jordan",
        "delete app"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Vmprotect-9880726-0",
          "display_name": "Win.Malware.Vmprotect-9880726-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [
        "Technology",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4624,
        "FileHash-SHA256": 2021,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 20,
        "SSLCertFingerprint": 10,
        "hostname": 1433,
        "domain": 728
      },
      "indicator_count": 8887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e2d950ac7d1e2a3454a4f",
      "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack",
      "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers",
      "modified": "2025-12-31T23:04:59.378000",
      "created": "2025-12-02T00:06:45.807000",
      "tags": [
        "iocs",
        "drop",
        "network traffic",
        "ck id",
        "mitre att",
        "ck matrix",
        "network related",
        "detected",
        "t1566",
        "t1204",
        "united",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "tor analysis",
        "dns requests",
        "learn",
        "suspicious",
        "informative",
        "name tactics",
        "adversaries",
        "command",
        "initial access",
        "spawns",
        "found",
        "binary file",
        "t1189",
        "regsetvalueexa",
        "regdword",
        "post http",
        "medium",
        "high",
        "regbinary",
        "loader",
        "dock",
        "write",
        "malware",
        "unknown",
        "romania unknown",
        "present may",
        "msie",
        "chrome",
        "body",
        "passive dns",
        "ip address",
        "present jun",
        "welcome",
        "accept",
        "encrypt",
        "gmt content",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "reverse dns",
        "unknown aaaa",
        "certificate",
        "hostname add",
        "error",
        "flag",
        "domain address",
        "contacted hosts",
        "type",
        "india unknown",
        "record value",
        "body html",
        "head title",
        "title",
        "entries",
        "read c",
        "high defense",
        "evasion",
        "yara detections",
        "virtool",
        "win32",
        "ahmann",
        "hacker group",
        "law firm",
        "order",
        "google",
        "smart assembly"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "VirTool:MSIL/Injector.BF",
          "display_name": "VirTool:MSIL/Injector.BF",
          "target": "/malware/VirTool:MSIL/Injector.BF"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1087.003",
          "name": "Email Account",
          "display_name": "T1087.003 - Email Account"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 115,
        "FileHash-SHA1": 112,
        "FileHash-SHA256": 589,
        "URL": 1795,
        "SSLCertFingerprint": 3,
        "domain": 319,
        "hostname": 847,
        "email": 1
      },
      "indicator_count": 3781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e1b4122a419384f1add7f",
      "name": "Cutwail Trojan DownLoader | Driveby compromises | Redirect",
      "description": "Cutwail Trojan DownLoader | Driveby comprises | Malicious Redirects.\n\nSuspicious redirects from Google homepage to \u2018Doodle\u2019s\nHeavy , ongoing cyber attack. Affects, iOS, Android, Cellular networks (global)\n\nI\u2019m hoping OTX will fully pulse. Indicators will be pulsed fully relying on OTX auto\npulse alone. No references or input from me.",
      "modified": "2025-12-31T22:02:44.679000",
      "created": "2025-12-01T22:48:33.510000",
      "tags": [
        "filehashmd5",
        "filehashsha256",
        "sha256",
        "filehashsha1",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "dynamicloader",
        "medium",
        "show",
        "entries",
        "dynamic",
        "pe section",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "copy",
        "write",
        "flag",
        "misc activity",
        "et info",
        "cloudflare dns",
        "over https",
        "windir",
        "openurl c",
        "prefetch2",
        "dns requests",
        "domain address",
        "google homepage",
        "html",
        "binary file",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "matched",
        "redirect",
        "t1189",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "ck techniques",
        "alert",
        "potential ip",
        "general",
        "click",
        "united",
        "analysis tip",
        "analysis",
        "tor analysis",
        "date",
        "c pe",
        "data upload",
        "extraction",
        "iocs",
        "manually add",
        "network traffic",
        "detected",
        "t1566",
        "submitted url",
        "t1204"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 95,
        "FileHash-SHA1": 95,
        "FileHash-SHA256": 183,
        "hostname": 227,
        "domain": 83,
        "URL": 575
      },
      "indicator_count": 1258,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6928f8d9e4222a6a219d785e",
      "name": "ClipBanker Spy & Information stealer | Crazy Frost | MaaS | Chrome & Cloudflare attacks",
      "description": "It appears that entity CrazyFrost provides MasS among other things that include major smear campaigns.| Likely quasi government , and Law Firm contractors.. Domestic terrorizing isn\u2019t a stretch.\nClipBanker: A form of banking trojan information stealer and spy that specifically monitors and steals information, likely by modifying the clipboard contents to redirect financial transactions (e.g., changing a copied bank account number to the attacker's).\n\n[OTX populated - HOSTNAME: CloudFlare.com.., a company owned by the US government, has been added to Pulse, an anti-virus database. (Pulses) created by users.]",
      "modified": "2025-12-28T00:04:06.179000",
      "created": "2025-11-28T01:20:25.401000",
      "tags": [
        "dynamicloader",
        "json",
        "ascii text",
        "high",
        "data",
        "x90uxa4xf8",
        "cape",
        "stream",
        "guard",
        "write",
        "trojan",
        "redline",
        "malware",
        "push",
        "local",
        "injection_inter_process",
        "recon_fingerprint",
        "persistence_ads",
        "process_creation_suspicious_location",
        "infostealer_browser",
        "infostealer_cookies",
        "stealth_file",
        "cape_detected_threat",
        "antivm_generic_bios",
        "cape_extracted_content",
        "united",
        "mtb jul",
        "a domains",
        "aaaa",
        "443 ma86400",
        "servers",
        "win32upatre jul",
        "virtool",
        "b778b1",
        "div div",
        "d9e4f4",
        "edf2f8",
        "present mar",
        "fastest privacy",
        "first dns",
        "win32",
        "trojandropper",
        "passive dns",
        "mtb nov",
        "ipv4 add",
        "asn as13335",
        "dns resolutions",
        "domain",
        "data upload",
        "extraction",
        "yara",
        "troja yara",
        "trojar data",
        "virto",
        "worn data",
        "included iocs",
        "manually add",
        "resolved ips",
        "ta0002",
        "evasion ta0005",
        "tr shared",
        "modules",
        "files",
        "infor",
        "t1027",
        "process t1057",
        "community score",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "defense evasion",
        "spawns",
        "flag",
        "name server",
        "date",
        "cloudflare",
        "data protected",
        "misc activity",
        "et info",
        "dns requests",
        "domain address",
        "gmt flag",
        "techtarget",
        "server",
        "et policy",
        "prefetch2",
        "t1179 hooking",
        "access windows",
        "installs",
        "mitre att",
        "ck techniques",
        "click",
        "windir",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "contacted",
        "http traffic",
        "suricata alerts",
        "event category",
        "found"
      ],
      "references": [
        "Malware : ClipBanker Entity: Crazy Frost",
        "www.crazyfrost.com FileDescription :JF_CF_MiniZM FileVersion: 1.1.0.0 InternalName: jf_cf_frostovip.exe LegalCopyright Copyright \u00a9 CrazyFrost",
        "IDS Detections: Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)",
        "Services : GoogleChromeElevationService = Delete",
        "Yara: RansomWin32SintaCry CodeOverlap TrojanClickerWin32Zeriest CodeOverlap",
        "Yara: TrojanDownloaderMSILBalamid CodeOverlap TrojanDropperWin32Popsenong CodeOverlap",
        "Yara: TrojanPythonKaazar CodeOverlap TrojanSpyWin32Chekafev CodeOverlap",
        "Yara: TrojanWin32Kredbegg  CodeOverlap TrojanWin32Motve CodeOverlap TrojanWin32Pitroj",
        "Yara : VirToolMSILLuxod CodeOverlap WormMSILVonriamt CodeOverlap TrojanWin32Depriz CodeOverlap",
        "Yara: WormWin32Rombrast CodeOverlap Jorgen,Ibsen PECompact_2xx VZX Jeremy,Collake",
        "Sigma: Matches rule Suspicious desktop.ini Action by Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO)",
        "CS IDS: Matches rule (http_inspect) invalid status line",
        "CS IDS: Matches rule INDICATOR-COMPROMISE png file attachment without matching file magic Unique rule identifier: This rule belongs to a private collection.",
        "jf_cf_frostovip.exe FILEHASH SHA256 4b9d6c5de40bfc4da8cb8b3ab9408dc574346b97268983f10bef8810e3f6bed8",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian\t URL\thttp://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex\t\u2022 http://www.anyxxxtube",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/\t URL\thttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears \u2022 http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube/"
      ],
      "public": 1,
      "adversary": "Crazy Frost",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Trojan.Disfa/downloader10",
          "display_name": "Trojan.Disfa/downloader10",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "Rozena",
          "display_name": "Rozena",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1464",
          "name": "Jamming or Denial of Service",
          "display_name": "T1464 - Jamming or Denial of Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 295,
        "FileHash-SHA1": 217,
        "FileHash-SHA256": 1887,
        "URL": 3263,
        "domain": 597,
        "hostname": 1085,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 7347,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "112 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://prodapi.flashpetrol.am",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://prodapi.flashpetrol.am",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776596795.573699
}