{
  "type": "URL",
  "indicator": "https://sacred-journey.info",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://sacred-journey.info",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4111305587,
      "indicator": "https://sacred-journey.info",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6a19ab3077e26f1ba3c8cd51",
          "name": "Credit Q.Vashti \"Unknown - Established hacker group. Affects banking\" clone",
          "description": "",
          "modified": "2026-05-31T05:26:42.780000",
          "created": "2026-05-29T15:05:20.198000",
          "tags": [
            "united",
            "search",
            "entries",
            "unknown ns",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "moved",
            "body",
            "encrypt",
            "lowfi",
            "trojanspy",
            "checkin",
            "passive dns",
            "trojan",
            "next associated",
            "cryp",
            "win32",
            "phishing",
            "virtool",
            "hstr",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "header http2",
            "accept encoding",
            "gmt related",
            "domains show",
            "domain related",
            "response ip",
            "address google",
            "safe browsing",
            "entries http",
            "scans show",
            "title",
            "link",
            "present mar",
            "meta",
            "starfield",
            "dynamicloader",
            "qaeaav12",
            "medium",
            "high",
            "malware",
            "windows wget",
            "qbeipbdii",
            "write",
            "suspicious",
            "copy",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "unknown",
            "yara detections",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "oinetsim",
            "oudevelopment",
            "write c",
            "demo",
            "mtb sep",
            "trojandropper",
            "cookie",
            "path max",
            "age86400 set",
            "win32qqpass sep",
            "results aug",
            "script urls",
            "script domains",
            "a domains",
            "cache control",
            "cache status",
            "fury",
            "zenedge",
            "present jun",
            "present dec",
            "present jan",
            "present nov",
            "for privacy",
            "present may",
            "name servers",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "filehashsha1",
            "iocs",
            "extract",
            "enter source",
            "url or",
            "text drag",
            "drop or",
            "domain",
            "expiration",
            "url http",
            "hostname",
            "email abuse"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "688f1ce317fc8b3f9d5d5f33",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 459,
            "FileHash-MD5": 553,
            "FileHash-SHA256": 1042,
            "URL": 1429,
            "hostname": 478,
            "domain": 521,
            "email": 3,
            "SSLCertFingerprint": 1,
            "JA3": 1
          },
          "indicator_count": 4487,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "17 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688f3a54e7db6a02a7bb25c9",
          "name": "Bank of America - Gafgyt \u2022 TrojanSpy \u2022 South African Service Center (BotNet)",
          "description": "Bank of America South African Service Center BotNet - IoT botnet Gafgyt targets popular routers through RCE vulnerabilities, also known as BASHLITE,  discovered in 2014. It is a Linux-based Mirai related IoT botnet \u2022\n 197.221.2.3 - www.readersareleaders.co.za\twww.readersareleaders.co.za\t[South Africa] AS37153 african network information center\nThis is the call center affecting multiple entities, targeting involved. Affects AllState [Esurance = NGIC? ] BoFa \u2022 T-mobile | MetroBy T\u2022 Mobile \u2022 .\nWhy is Bank of America so sketchy? \n[remote.dekro.co.za]",
          "modified": "2025-09-02T09:02:13.372000",
          "created": "2025-08-03T10:30:43.521000",
          "tags": [
            "dynamicloader",
            "medium",
            "write c",
            "entries",
            "show",
            "search",
            "http traffic",
            "utf8",
            "crlf line",
            "post",
            "trojanspy",
            "copy",
            "powershell",
            "write",
            "delphi",
            "win32",
            "next",
            "graphics",
            "gaz company",
            "turbo exe",
            "company turbo",
            "code",
            "malware",
            "dcom",
            "execution",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "development att",
            "defense evasion",
            "south africa",
            "td tr",
            "unknown a",
            "td td",
            "tbody",
            "tr tr",
            "passive dns",
            "ddos",
            "next associated",
            "body",
            "click",
            "unknown soa",
            "unknown cname",
            "location south",
            "africa asn",
            "as37153",
            "pulses none",
            "related tags",
            "none indicator",
            "facts",
            "asn as37153",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "mtb oct",
            "date",
            "united",
            "urls",
            "ov ssl",
            "record value",
            "object",
            "pulse",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "null",
            "refresh",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 732,
            "domain": 175,
            "hostname": 470,
            "FileHash-SHA256": 346,
            "FileHash-MD5": 141,
            "FileHash-SHA1": 132,
            "email": 1
          },
          "indicator_count": 1997,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "271 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688f1ce317fc8b3f9d5d5f33",
          "name": "Unknown  - Established hacker group. Affects banking, financial  and much more.",
          "description": "Crowdsourced. Identifies as a Dark Web gang stalking entity. Research suggests that this is a very organized, possibly quasi governmental entity with shadowy state figures that social engineer targets. Even though they have been considered scammers and they are grifters, they are very established, dangerous and a very large force with claims of military alignments which has not yet been fully confirmed.\n\nThis group is anything you want them to be, attorney, accountant, technician, nurse, uber driver.",
          "modified": "2025-09-02T08:02:34.108000",
          "created": "2025-08-03T08:25:07.135000",
          "tags": [
            "united",
            "search",
            "entries",
            "unknown ns",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "moved",
            "body",
            "encrypt",
            "lowfi",
            "trojanspy",
            "checkin",
            "passive dns",
            "trojan",
            "next associated",
            "cryp",
            "win32",
            "phishing",
            "virtool",
            "hstr",
            "backdoor",
            "ipv4",
            "pulse pulses",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "header http2",
            "accept encoding",
            "gmt related",
            "domains show",
            "domain related",
            "response ip",
            "address google",
            "safe browsing",
            "entries http",
            "scans show",
            "title",
            "link",
            "present mar",
            "meta",
            "starfield",
            "dynamicloader",
            "qaeaav12",
            "medium",
            "high",
            "malware",
            "windows wget",
            "qbeipbdii",
            "write",
            "suspicious",
            "copy",
            "yara rule",
            "gravityrat",
            "detectvm",
            "x00 x00",
            "x00x00",
            "doviacmd",
            "rootjob",
            "getfiles",
            "updateserver",
            "ethernetid",
            "unknown",
            "yara detections",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "oinetsim",
            "oudevelopment",
            "write c",
            "demo",
            "mtb sep",
            "trojandropper",
            "cookie",
            "path max",
            "age86400 set",
            "win32qqpass sep",
            "results aug",
            "script urls",
            "script domains",
            "a domains",
            "cache control",
            "cache status",
            "fury",
            "zenedge",
            "present jun",
            "present dec",
            "present jan",
            "present nov",
            "for privacy",
            "present may",
            "name servers",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "filehashsha1",
            "iocs",
            "extract",
            "enter source",
            "url or",
            "text drag",
            "drop or",
            "domain",
            "expiration",
            "url http",
            "hostname",
            "email abuse"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 459,
            "FileHash-MD5": 553,
            "FileHash-SHA256": 1042,
            "URL": 1426,
            "hostname": 476,
            "domain": 521,
            "email": 3,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 4481,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "271 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 5893
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/sacred-journey.info",
    "whois": "http://whois.domaintools.com/sacred-journey.info",
    "domain": "sacred-journey.info",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6a19ab3077e26f1ba3c8cd51",
      "name": "Credit Q.Vashti \"Unknown - Established hacker group. Affects banking\" clone",
      "description": "",
      "modified": "2026-05-31T05:26:42.780000",
      "created": "2026-05-29T15:05:20.198000",
      "tags": [
        "united",
        "search",
        "entries",
        "unknown ns",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "moved",
        "body",
        "encrypt",
        "lowfi",
        "trojanspy",
        "checkin",
        "passive dns",
        "trojan",
        "next associated",
        "cryp",
        "win32",
        "phishing",
        "virtool",
        "hstr",
        "backdoor",
        "ipv4",
        "pulse pulses",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "header http2",
        "accept encoding",
        "gmt related",
        "domains show",
        "domain related",
        "response ip",
        "address google",
        "safe browsing",
        "entries http",
        "scans show",
        "title",
        "link",
        "present mar",
        "meta",
        "starfield",
        "dynamicloader",
        "qaeaav12",
        "medium",
        "high",
        "malware",
        "windows wget",
        "qbeipbdii",
        "write",
        "suspicious",
        "copy",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "unknown",
        "yara detections",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "oinetsim",
        "oudevelopment",
        "write c",
        "demo",
        "mtb sep",
        "trojandropper",
        "cookie",
        "path max",
        "age86400 set",
        "win32qqpass sep",
        "results aug",
        "script urls",
        "script domains",
        "a domains",
        "cache control",
        "cache status",
        "fury",
        "zenedge",
        "present jun",
        "present dec",
        "present jan",
        "present nov",
        "for privacy",
        "present may",
        "name servers",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "filehashsha1",
        "iocs",
        "extract",
        "enter source",
        "url or",
        "text drag",
        "drop or",
        "domain",
        "expiration",
        "url http",
        "hostname",
        "email abuse"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "688f1ce317fc8b3f9d5d5f33",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 459,
        "FileHash-MD5": 553,
        "FileHash-SHA256": 1042,
        "URL": 1429,
        "hostname": 478,
        "domain": 521,
        "email": 3,
        "SSLCertFingerprint": 1,
        "JA3": 1
      },
      "indicator_count": 4487,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "17 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688f3a54e7db6a02a7bb25c9",
      "name": "Bank of America - Gafgyt \u2022 TrojanSpy \u2022 South African Service Center (BotNet)",
      "description": "Bank of America South African Service Center BotNet - IoT botnet Gafgyt targets popular routers through RCE vulnerabilities, also known as BASHLITE,  discovered in 2014. It is a Linux-based Mirai related IoT botnet \u2022\n 197.221.2.3 - www.readersareleaders.co.za\twww.readersareleaders.co.za\t[South Africa] AS37153 african network information center\nThis is the call center affecting multiple entities, targeting involved. Affects AllState [Esurance = NGIC? ] BoFa \u2022 T-mobile | MetroBy T\u2022 Mobile \u2022 .\nWhy is Bank of America so sketchy? \n[remote.dekro.co.za]",
      "modified": "2025-09-02T09:02:13.372000",
      "created": "2025-08-03T10:30:43.521000",
      "tags": [
        "dynamicloader",
        "medium",
        "write c",
        "entries",
        "show",
        "search",
        "http traffic",
        "utf8",
        "crlf line",
        "post",
        "trojanspy",
        "copy",
        "powershell",
        "write",
        "delphi",
        "win32",
        "next",
        "graphics",
        "gaz company",
        "turbo exe",
        "company turbo",
        "code",
        "malware",
        "dcom",
        "execution",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "development att",
        "defense evasion",
        "south africa",
        "td tr",
        "unknown a",
        "td td",
        "tbody",
        "tr tr",
        "passive dns",
        "ddos",
        "next associated",
        "body",
        "click",
        "unknown soa",
        "unknown cname",
        "location south",
        "africa asn",
        "as37153",
        "pulses none",
        "related tags",
        "none indicator",
        "facts",
        "asn as37153",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "mtb oct",
        "date",
        "united",
        "urls",
        "ov ssl",
        "record value",
        "object",
        "pulse",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "null",
        "refresh",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 732,
        "domain": 175,
        "hostname": 470,
        "FileHash-SHA256": 346,
        "FileHash-MD5": 141,
        "FileHash-SHA1": 132,
        "email": 1
      },
      "indicator_count": 1997,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "271 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688f1ce317fc8b3f9d5d5f33",
      "name": "Unknown  - Established hacker group. Affects banking, financial  and much more.",
      "description": "Crowdsourced. Identifies as a Dark Web gang stalking entity. Research suggests that this is a very organized, possibly quasi governmental entity with shadowy state figures that social engineer targets. Even though they have been considered scammers and they are grifters, they are very established, dangerous and a very large force with claims of military alignments which has not yet been fully confirmed.\n\nThis group is anything you want them to be, attorney, accountant, technician, nurse, uber driver.",
      "modified": "2025-09-02T08:02:34.108000",
      "created": "2025-08-03T08:25:07.135000",
      "tags": [
        "united",
        "search",
        "entries",
        "unknown ns",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "moved",
        "body",
        "encrypt",
        "lowfi",
        "trojanspy",
        "checkin",
        "passive dns",
        "trojan",
        "next associated",
        "cryp",
        "win32",
        "phishing",
        "virtool",
        "hstr",
        "backdoor",
        "ipv4",
        "pulse pulses",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "header http2",
        "accept encoding",
        "gmt related",
        "domains show",
        "domain related",
        "response ip",
        "address google",
        "safe browsing",
        "entries http",
        "scans show",
        "title",
        "link",
        "present mar",
        "meta",
        "starfield",
        "dynamicloader",
        "qaeaav12",
        "medium",
        "high",
        "malware",
        "windows wget",
        "qbeipbdii",
        "write",
        "suspicious",
        "copy",
        "yara rule",
        "gravityrat",
        "detectvm",
        "x00 x00",
        "x00x00",
        "doviacmd",
        "rootjob",
        "getfiles",
        "updateserver",
        "ethernetid",
        "unknown",
        "yara detections",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "oinetsim",
        "oudevelopment",
        "write c",
        "demo",
        "mtb sep",
        "trojandropper",
        "cookie",
        "path max",
        "age86400 set",
        "win32qqpass sep",
        "results aug",
        "script urls",
        "script domains",
        "a domains",
        "cache control",
        "cache status",
        "fury",
        "zenedge",
        "present jun",
        "present dec",
        "present jan",
        "present nov",
        "for privacy",
        "present may",
        "name servers",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "filehashsha1",
        "iocs",
        "extract",
        "enter source",
        "url or",
        "text drag",
        "drop or",
        "domain",
        "expiration",
        "url http",
        "hostname",
        "email abuse"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 459,
        "FileHash-MD5": 553,
        "FileHash-SHA256": 1042,
        "URL": 1426,
        "hostname": 476,
        "domain": 521,
        "email": 3,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 4481,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "271 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://sacred-journey.info",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://sacred-journey.info",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780267901.3172586
}