{
  "type": "URL",
  "indicator": "https://qegyhig.com/login.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://qegyhig.com/login.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3969896750,
      "indicator": "https://qegyhig.com/login.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6953775a0aed71947ca3f90e",
          "name": "Ransom WannaCrypt- Hackers masquerade as a law firm | Social Engineering |",
          "description": "Hackers , likely Colorado State employees masquerading as legal, entities, social\nengineering, financial exchanges involved. Fraud. Dangerous enterprise. Found in an \u2018alleged \u2018 Plaintiff Law Firms malicious link discovered in old print out, also seen in earlier pulse. [OTX generated description: Adversaries may be able to evade detection and network filtering by blending in with existing traffic, as well as using web protocols, in order to avoid detection/network filtering. and other measures.]",
          "modified": "2026-01-29T06:09:08.504000",
          "created": "2025-12-30T06:55:22.105000",
          "tags": [
            "united",
            "urls",
            "moved",
            "files",
            "ip address",
            "gmt content",
            "x adblock",
            "encrypt",
            "backdoor",
            "bq dec",
            "virtool",
            "ipv4 add",
            "ascii text",
            "pattern match",
            "ck id",
            "mitre att",
            "meta",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "unknown",
            "simplified",
            "etpro trojan",
            "possible virut",
            "dga nxdomain",
            "responses",
            "virus",
            "medium",
            "virustotal",
            "vipre",
            "baidu",
            "vitro",
            "drweb",
            "mcafee",
            "panda",
            "malware",
            "write",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "yara rule",
            "simda",
            "internal",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "discovery att",
            "ck matrix",
            "network traffic",
            "t1071",
            "t1057",
            "hybrid",
            "yara detections",
            "composite",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "none related",
            "passive dns",
            "hosting",
            "reverse dns",
            "location united",
            "title",
            "ences s",
            "data upload",
            "extraction",
            "status",
            "hostname add",
            "url analysis",
            "push",
            "present sep",
            "present may",
            "present jul",
            "present jan",
            "win32small dec",
            "ransom",
            "write c",
            "show",
            "search",
            "high",
            "et exploit",
            "probe ms17010",
            "eternal blue",
            "englewood colorado",
            "wannacry",
            "wannacrypt",
            "ransom",
            "wanna"
          ],
          "references": [
            "https://aws.hirecar.net/",
            "w32.virut.cf \u2022 win32.virut.am \u2022 virut.cf \u2022 http://w32.virut.cf \u2022http://w32.virut.cf/ \u2022 https://w32.virut.cf",
            "pandacookie2018.xyz",
            "Antivirus Detections: Win.Ransomware.Wanna-9769986-0 ,  Ransom:Win32/WannaCrypt.H",
            "IDS Detections: Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS",
            "DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) Possible ETERNALBLUE Probe MS17-010 (Generic Flags) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware ,  Win32_Ransomware_WannaCry ,  Wanna_Cry_Ransomware_Generic ,  MS17_010_WanaCry_worm ,  stack_string More Alerts 25 Alerts suspicious_iocontrol_codes persistence_autorun persistence_autorun_tasks stealth_file suricata_alert antivm_generic_disk anomalous_deletefil",
            "Domains Contacted: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com \u2022\u2019survey-smiles.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Win32/Small.IR",
              "display_name": "Backdoor:Win32/Small.IR",
              "target": "/malware/Backdoor:Win32/Small.IR"
            },
            {
              "id": "Win.Trojan.Agent-31853",
              "display_name": "Win.Trojan.Agent-31853",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Win.Ransomware.Wanna-9769986-0",
              "display_name": "Win.Ransomware.Wanna-9769986-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt.H",
              "display_name": "Ransom:Win32/WannaCrypt.H",
              "target": "/malware/Ransom:Win32/WannaCrypt.H"
            },
            {
              "id": "Virtool:Win32/Injector.gen!BQ",
              "display_name": "Virtool:Win32/Injector.gen!BQ",
              "target": "/malware/Virtool:Win32/Injector.gen!BQ"
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [
            "Government",
            "Technology",
            "Legal"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8605,
            "domain": 1228,
            "email": 2,
            "hostname": 1981,
            "FileHash-SHA256": 1617,
            "FileHash-SHA1": 184,
            "FileHash-MD5": 206,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13825,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "123 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68705b9e13e074fa3c778902",
          "name": "check",
          "description": "",
          "modified": "2026-01-23T01:10:39.457000",
          "created": "2025-07-11T00:32:30.277000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 421,
            "FileHash-MD5": 25,
            "FileHash-SHA1": 22,
            "FileHash-SHA256": 133,
            "domain": 270,
            "hostname": 35
          },
          "indicator_count": 906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "683e4307a059dee6d1ade4ed",
          "name": "lumma",
          "description": "",
          "modified": "2026-01-04T22:52:50.774000",
          "created": "2025-06-03T00:34:15.050000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 31,
            "FileHash-SHA1": 22,
            "FileHash-SHA256": 90,
            "URL": 550,
            "domain": 380,
            "hostname": 33
          },
          "indicator_count": 1106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688d5b9a901f21d7148c4f08",
          "name": "Data Server - |Win.Trojan.Shiz, \u2022PWS:Win32/Simda.D",
          "description": "- dl.fdlserver.com appears to be or have been used as  a software and / or data delivery service. Requires further investigation. It sure is malicious. Found in multiple attacks.\n*Win.Trojan.Shiz-664 , *PWS:Win32/Simda.D\nIDS Detections:\n\u2022 Unsupported/Fake Internet Explorer Version MSIE 2.\n\u2022 Unsupported/Fake Windows NT Version 5.0\nYara Detections: \n\u2022 generic_shellcode_downloader\nAlerts\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 antiav_detectfile\n\u2022 deletes_self\n\u2022 dynamic_function_loading\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx\n\u2022 stealth_network\n\u2022 queries_user_name\n\u2022 stealth_timeout\n\u2022 language_check",
          "modified": "2025-09-01T00:04:55.557000",
          "created": "2025-08-02T00:28:10.007000",
          "tags": [
            "united",
            "entries",
            "passive dns",
            "virtool",
            "next associated",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "files",
            "hosting",
            "body",
            "present jun",
            "present may",
            "present oct",
            "present apr",
            "present nov",
            "present jan",
            "present dec",
            "present jul",
            "netherlands",
            "present aug",
            "present feb",
            "creation date",
            "status",
            "ip address",
            "search",
            "name",
            "name servers",
            "expiration date",
            "date",
            "dynamicloader",
            "unknown",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "show",
            "write",
            "copy",
            "simda",
            "malware",
            "push",
            "extraction",
            "failed",
            "data upload",
            "include",
            "extraction data",
            "enter soudae",
            "lidi ad",
            "tewdaccarad ad",
            "ddawce type",
            "extri",
            "include review",
            "extra",
            "include data",
            "location united",
            "medium",
            "record value",
            "cowboy",
            "encrypt",
            "high"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 402,
            "FileHash-SHA1": 400,
            "FileHash-SHA256": 1798,
            "URL": 7586,
            "domain": 937,
            "hostname": 2470,
            "email": 1,
            "SSLCertFingerprint": 1,
            "CVE": 1
          },
          "indicator_count": 13596,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "273 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6786a59af06fee17c8decf9d",
          "name": "netcfg",
          "description": "000ceafd276003f46d06828bb0459b3ccdc2b44013a313b69d6270a224199034",
          "modified": "2025-05-31T02:36:52.299000",
          "created": "2025-01-14T17:57:46.687000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 222,
            "domain": 216,
            "hostname": 4,
            "FileHash-SHA256": 1
          },
          "indicator_count": 443,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 182,
          "modified_text": "366 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS Detections: Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS",
        "w32.virut.cf \u2022 win32.virut.am \u2022 virut.cf \u2022 http://w32.virut.cf \u2022http://w32.virut.cf/ \u2022 https://w32.virut.cf",
        "Antivirus Detections: Win.Ransomware.Wanna-9769986-0 ,  Ransom:Win32/WannaCrypt.H",
        "DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) Possible ETERNALBLUE Probe MS17-010 (Generic Flags) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware ,  Win32_Ransomware_WannaCry ,  Wanna_Cry_Ransomware_Generic ,  MS17_010_WanaCry_worm ,  stack_string More Alerts 25 Alerts suspicious_iocontrol_codes persistence_autorun persistence_autorun_tasks stealth_file suricata_alert antivm_generic_disk anomalous_deletefil",
        "https://aws.hirecar.net/",
        "Domains Contacted: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com \u2022\u2019survey-smiles.com",
        "pandacookie2018.xyz"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Virut",
            "Virtool:win32/injector.gen!bq",
            "Backdoor:win32/small.ir",
            "Win.trojan.agent-31853",
            "Win.ransomware.wanna-9769986-0",
            "Ransom:win32/wannacrypt.h"
          ],
          "industries": [
            "Technology",
            "Legal",
            "Government"
          ],
          "unique_indicators": 30313
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/qegyhig.com",
    "whois": "http://whois.domaintools.com/qegyhig.com",
    "domain": "qegyhig.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6953775a0aed71947ca3f90e",
      "name": "Ransom WannaCrypt- Hackers masquerade as a law firm | Social Engineering |",
      "description": "Hackers , likely Colorado State employees masquerading as legal, entities, social\nengineering, financial exchanges involved. Fraud. Dangerous enterprise. Found in an \u2018alleged \u2018 Plaintiff Law Firms malicious link discovered in old print out, also seen in earlier pulse. [OTX generated description: Adversaries may be able to evade detection and network filtering by blending in with existing traffic, as well as using web protocols, in order to avoid detection/network filtering. and other measures.]",
      "modified": "2026-01-29T06:09:08.504000",
      "created": "2025-12-30T06:55:22.105000",
      "tags": [
        "united",
        "urls",
        "moved",
        "files",
        "ip address",
        "gmt content",
        "x adblock",
        "encrypt",
        "backdoor",
        "bq dec",
        "virtool",
        "ipv4 add",
        "ascii text",
        "pattern match",
        "ck id",
        "mitre att",
        "meta",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "unknown",
        "simplified",
        "etpro trojan",
        "possible virut",
        "dga nxdomain",
        "responses",
        "virus",
        "medium",
        "virustotal",
        "vipre",
        "baidu",
        "vitro",
        "drweb",
        "mcafee",
        "panda",
        "malware",
        "write",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "yara rule",
        "simda",
        "internal",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "discovery att",
        "ck matrix",
        "network traffic",
        "t1071",
        "t1057",
        "hybrid",
        "yara detections",
        "composite",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "none related",
        "passive dns",
        "hosting",
        "reverse dns",
        "location united",
        "title",
        "ences s",
        "data upload",
        "extraction",
        "status",
        "hostname add",
        "url analysis",
        "push",
        "present sep",
        "present may",
        "present jul",
        "present jan",
        "win32small dec",
        "ransom",
        "write c",
        "show",
        "search",
        "high",
        "et exploit",
        "probe ms17010",
        "eternal blue",
        "englewood colorado",
        "wannacry",
        "wannacrypt",
        "ransom",
        "wanna"
      ],
      "references": [
        "https://aws.hirecar.net/",
        "w32.virut.cf \u2022 win32.virut.am \u2022 virut.cf \u2022 http://w32.virut.cf \u2022http://w32.virut.cf/ \u2022 https://w32.virut.cf",
        "pandacookie2018.xyz",
        "Antivirus Detections: Win.Ransomware.Wanna-9769986-0 ,  Ransom:Win32/WannaCrypt.H",
        "IDS Detections: Observed WannaCry Domain (iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff .com in DNS",
        "DNS Lookup) Possible ETERNALBLUE Probe MS17-010 (MSF style) Possible ETERNALBLUE Probe MS17-010 (Generic Flags) ETERNALBLUE Probe Vulnerable System Response MS17-010 Possible ETERNALBLUE MS17-010 Heap Spray More Yara Detections WannaCry_Ransomware ,  Win32_Ransomware_WannaCry ,  Wanna_Cry_Ransomware_Generic ,  MS17_010_WanaCry_worm ,  stack_string More Alerts 25 Alerts suspicious_iocontrol_codes persistence_autorun persistence_autorun_tasks stealth_file suricata_alert antivm_generic_disk anomalous_deletefil",
        "Domains Contacted: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwff.com \u2022\u2019survey-smiles.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Win32/Small.IR",
          "display_name": "Backdoor:Win32/Small.IR",
          "target": "/malware/Backdoor:Win32/Small.IR"
        },
        {
          "id": "Win.Trojan.Agent-31853",
          "display_name": "Win.Trojan.Agent-31853",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "Win.Ransomware.Wanna-9769986-0",
          "display_name": "Win.Ransomware.Wanna-9769986-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt.H",
          "display_name": "Ransom:Win32/WannaCrypt.H",
          "target": "/malware/Ransom:Win32/WannaCrypt.H"
        },
        {
          "id": "Virtool:Win32/Injector.gen!BQ",
          "display_name": "Virtool:Win32/Injector.gen!BQ",
          "target": "/malware/Virtool:Win32/Injector.gen!BQ"
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [
        "Government",
        "Technology",
        "Legal"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8605,
        "domain": 1228,
        "email": 2,
        "hostname": 1981,
        "FileHash-SHA256": 1617,
        "FileHash-SHA1": 184,
        "FileHash-MD5": 206,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13825,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "123 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68705b9e13e074fa3c778902",
      "name": "check",
      "description": "",
      "modified": "2026-01-23T01:10:39.457000",
      "created": "2025-07-11T00:32:30.277000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 421,
        "FileHash-MD5": 25,
        "FileHash-SHA1": 22,
        "FileHash-SHA256": 133,
        "domain": 270,
        "hostname": 35
      },
      "indicator_count": 906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "683e4307a059dee6d1ade4ed",
      "name": "lumma",
      "description": "",
      "modified": "2026-01-04T22:52:50.774000",
      "created": "2025-06-03T00:34:15.050000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 31,
        "FileHash-SHA1": 22,
        "FileHash-SHA256": 90,
        "URL": 550,
        "domain": 380,
        "hostname": 33
      },
      "indicator_count": 1106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688d5b9a901f21d7148c4f08",
      "name": "Data Server - |Win.Trojan.Shiz, \u2022PWS:Win32/Simda.D",
      "description": "- dl.fdlserver.com appears to be or have been used as  a software and / or data delivery service. Requires further investigation. It sure is malicious. Found in multiple attacks.\n*Win.Trojan.Shiz-664 , *PWS:Win32/Simda.D\nIDS Detections:\n\u2022 Unsupported/Fake Internet Explorer Version MSIE 2.\n\u2022 Unsupported/Fake Windows NT Version 5.0\nYara Detections: \n\u2022 generic_shellcode_downloader\nAlerts\n\u2022 polymorphic\n\u2022 procmem_yara\n\u2022 static_pe_anomaly\n\u2022 antiav_detectfile\n\u2022 deletes_self\n\u2022 dynamic_function_loading\n\u2022 network_http\n\u2022 packer_unknown_pe_section_name\n\u2022 packer_entropy\n\u2022 injection_rwx\n\u2022 stealth_network\n\u2022 queries_user_name\n\u2022 stealth_timeout\n\u2022 language_check",
      "modified": "2025-09-01T00:04:55.557000",
      "created": "2025-08-02T00:28:10.007000",
      "tags": [
        "united",
        "entries",
        "passive dns",
        "virtool",
        "next associated",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "files",
        "hosting",
        "body",
        "present jun",
        "present may",
        "present oct",
        "present apr",
        "present nov",
        "present jan",
        "present dec",
        "present jul",
        "netherlands",
        "present aug",
        "present feb",
        "creation date",
        "status",
        "ip address",
        "search",
        "name",
        "name servers",
        "expiration date",
        "date",
        "dynamicloader",
        "unknown",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "show",
        "write",
        "copy",
        "simda",
        "malware",
        "push",
        "extraction",
        "failed",
        "data upload",
        "include",
        "extraction data",
        "enter soudae",
        "lidi ad",
        "tewdaccarad ad",
        "ddawce type",
        "extri",
        "include review",
        "extra",
        "include data",
        "location united",
        "medium",
        "record value",
        "cowboy",
        "encrypt",
        "high"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 402,
        "FileHash-SHA1": 400,
        "FileHash-SHA256": 1798,
        "URL": 7586,
        "domain": 937,
        "hostname": 2470,
        "email": 1,
        "SSLCertFingerprint": 1,
        "CVE": 1
      },
      "indicator_count": 13596,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "273 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6786a59af06fee17c8decf9d",
      "name": "netcfg",
      "description": "000ceafd276003f46d06828bb0459b3ccdc2b44013a313b69d6270a224199034",
      "modified": "2025-05-31T02:36:52.299000",
      "created": "2025-01-14T17:57:46.687000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 222,
        "domain": 216,
        "hostname": 4,
        "FileHash-SHA256": 1
      },
      "indicator_count": 443,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 182,
      "modified_text": "366 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://qegyhig.com/login.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://qegyhig.com/login.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780294489.9744344
}