{
  "type": "URL",
  "indicator": "https://schedule-ai.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://schedule-ai.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4165819003,
      "indicator": "https://schedule-ai.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6946fdbb4a22dc28d60d6ca2",
          "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
          "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
          "modified": "2026-01-19T19:04:41.997000",
          "created": "2025-12-20T19:49:15.713000",
          "tags": [
            "doomscroller",
            "browsehappy",
            "xpirat",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "united",
            "tlsv1",
            "execution",
            "dock",
            "write",
            "persistence",
            "encrypt",
            "meta",
            "browse happy",
            "worry",
            "body doctype",
            "online",
            "gmt server",
            "a domains",
            "ipv4 add",
            "win32",
            "trojandropper",
            "title",
            "date",
            "unknown",
            "post http",
            "cryptexportkey",
            "cryptgenkey",
            "calgrc4",
            "expiro",
            "temple",
            "xserver",
            "adversaries",
            "worry wordpress"
          ],
          "references": [
            "Xpirat = doomscroller.io"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Xpirat",
              "display_name": "Xpirat",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1423",
              "name": "Network Service Scanning",
              "display_name": "T1423 - Network Service Scanning"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5576,
            "domain": 1502,
            "FileHash-MD5": 116,
            "FileHash-SHA1": 73,
            "FileHash-SHA256": 1041,
            "SSLCertFingerprint": 1,
            "hostname": 1951
          },
          "indicator_count": 10260,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6946ef0ba069c6b92160f8f6",
          "name": "Doomscroller \u2022 BrowserHappy | Part 1",
          "description": "Comments reserved for Part 2.\nOTX I extraction keeps timing out for me. Possibly location/signal related.",
          "modified": "2026-01-19T17:03:32.999000",
          "created": "2025-12-20T18:46:35.660000",
          "tags": [
            "servers",
            "united states",
            "united",
            "script script",
            "cnc beacon",
            "x5drh",
            "ipv4",
            "urls",
            "twitter",
            "trojandropper",
            "ipv4 add",
            "reverse dns",
            "ransom",
            "mtb may",
            "backdoor",
            "trojanspy",
            "loee7oiy",
            "trojan",
            "win32",
            "susp",
            "mtb jul",
            "virtool",
            "mtb aug",
            "worm",
            "avast avg",
            "lowfi",
            "multiplug jun",
            "urls show",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results dec",
            "k dec",
            "read c",
            "process32nextw",
            "tls handshake",
            "search",
            "show",
            "et info",
            "failure",
            "unknown",
            "service",
            "malware",
            "tools",
            "win64",
            "write",
            "revil",
            "sodinokibi",
            "titan",
            "mtb trojan",
            "mtb alf",
            "win32dinwod may"
          ],
          "references": [
            "Xpirat = doomscroller.io",
            "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
            "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
            "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanDownloader:Win32/Upatre.AA",
              "display_name": "TrojanDownloader:Win32/Upatre.AA",
              "target": "/malware/TrojanDownloader:Win32/Upatre.AA"
            },
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Sodinoki",
              "display_name": "Sodinoki",
              "target": null
            },
            {
              "id": "Ransom:Win32/Revil.A",
              "display_name": "Ransom:Win32/Revil.A",
              "target": "/malware/Ransom:Win32/Revil.A"
            },
            {
              "id": "Cutwail",
              "display_name": "Cutwail",
              "target": null
            },
            {
              "id": "!#HSTR:SigGen0136cb6c",
              "display_name": "!#HSTR:SigGen0136cb6c",
              "target": null
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Win.Malware",
              "display_name": "Win.Malware",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.BG",
              "display_name": "TrojanSpy:Win32/Nivdort.BG",
              "target": "/malware/TrojanSpy:Win32/Nivdort.BG"
            },
            {
              "id": "#Lowfi:Lua:Mampa:99!ml",
              "display_name": "#Lowfi:Lua:Mampa:99!ml",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "#Lowfi:HSTR:Installer:Multiplug",
              "display_name": "#Lowfi:HSTR:Installer:Multiplug",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Dinwod",
              "display_name": "TrojanDropper:Win32/Dinwod",
              "target": "/malware/TrojanDropper:Win32/Dinwod"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.CB",
              "display_name": "TrojanSpy:Win32/Nivdort.CB",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CB"
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBB6!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBB6!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBB6!MTB"
            },
            {
              "id": "Ploprolo",
              "display_name": "Ploprolo",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
              "display_name": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 692,
            "URL": 1666,
            "FileHash-SHA256": 630,
            "hostname": 804,
            "FileHash-MD5": 441,
            "FileHash-SHA1": 437,
            "SSLCertFingerprint": 1,
            "CVE": 1
          },
          "indicator_count": 4672,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "90 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
        "Xpirat = doomscroller.io",
        "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Sodinoki",
            "#lowfi:hstr:virtool:win32/obfuscator!diplugem.f",
            "!#hstr:siggen0136cb6c",
            "Trojan:win32/zbot.sibb6!mtb",
            "Bayrob",
            "Win.trojan.barys-10005825-0",
            "Trojandownloader:win32/upatre.aa",
            "Ransom:win32/revil.a",
            "Cutwail",
            "#lowfi:hstr:installer:multiplug",
            "#lowfi:lua:mampa:99!ml",
            "Win.malware",
            "Trojandownloader:win32/cutwail",
            "Ploprolo",
            "Trojandropper:win32/dinwod",
            "Zbot",
            "Upatre",
            "Expiro",
            "Trojanspy:win32/nivdort.bg",
            "Trojanspy:win32/nivdort.cb",
            "Xpirat"
          ],
          "industries": [],
          "unique_indicators": 14748
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/schedule-ai.com",
    "whois": "http://whois.domaintools.com/schedule-ai.com",
    "domain": "schedule-ai.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6946fdbb4a22dc28d60d6ca2",
      "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
      "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
      "modified": "2026-01-19T19:04:41.997000",
      "created": "2025-12-20T19:49:15.713000",
      "tags": [
        "doomscroller",
        "browsehappy",
        "xpirat",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "united",
        "tlsv1",
        "execution",
        "dock",
        "write",
        "persistence",
        "encrypt",
        "meta",
        "browse happy",
        "worry",
        "body doctype",
        "online",
        "gmt server",
        "a domains",
        "ipv4 add",
        "win32",
        "trojandropper",
        "title",
        "date",
        "unknown",
        "post http",
        "cryptexportkey",
        "cryptgenkey",
        "calgrc4",
        "expiro",
        "temple",
        "xserver",
        "adversaries",
        "worry wordpress"
      ],
      "references": [
        "Xpirat = doomscroller.io"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Xpirat",
          "display_name": "Xpirat",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1423",
          "name": "Network Service Scanning",
          "display_name": "T1423 - Network Service Scanning"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5576,
        "domain": 1502,
        "FileHash-MD5": 116,
        "FileHash-SHA1": 73,
        "FileHash-SHA256": 1041,
        "SSLCertFingerprint": 1,
        "hostname": 1951
      },
      "indicator_count": 10260,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6946ef0ba069c6b92160f8f6",
      "name": "Doomscroller \u2022 BrowserHappy | Part 1",
      "description": "Comments reserved for Part 2.\nOTX I extraction keeps timing out for me. Possibly location/signal related.",
      "modified": "2026-01-19T17:03:32.999000",
      "created": "2025-12-20T18:46:35.660000",
      "tags": [
        "servers",
        "united states",
        "united",
        "script script",
        "cnc beacon",
        "x5drh",
        "ipv4",
        "urls",
        "twitter",
        "trojandropper",
        "ipv4 add",
        "reverse dns",
        "ransom",
        "mtb may",
        "backdoor",
        "trojanspy",
        "loee7oiy",
        "trojan",
        "win32",
        "susp",
        "mtb jul",
        "virtool",
        "mtb aug",
        "worm",
        "avast avg",
        "lowfi",
        "multiplug jun",
        "urls show",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results dec",
        "k dec",
        "read c",
        "process32nextw",
        "tls handshake",
        "search",
        "show",
        "et info",
        "failure",
        "unknown",
        "service",
        "malware",
        "tools",
        "win64",
        "write",
        "revil",
        "sodinokibi",
        "titan",
        "mtb trojan",
        "mtb alf",
        "win32dinwod may"
      ],
      "references": [
        "Xpirat = doomscroller.io",
        "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
        "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanDownloader:Win32/Upatre.AA",
          "display_name": "TrojanDownloader:Win32/Upatre.AA",
          "target": "/malware/TrojanDownloader:Win32/Upatre.AA"
        },
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Sodinoki",
          "display_name": "Sodinoki",
          "target": null
        },
        {
          "id": "Ransom:Win32/Revil.A",
          "display_name": "Ransom:Win32/Revil.A",
          "target": "/malware/Ransom:Win32/Revil.A"
        },
        {
          "id": "Cutwail",
          "display_name": "Cutwail",
          "target": null
        },
        {
          "id": "!#HSTR:SigGen0136cb6c",
          "display_name": "!#HSTR:SigGen0136cb6c",
          "target": null
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Win.Malware",
          "display_name": "Win.Malware",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.BG",
          "display_name": "TrojanSpy:Win32/Nivdort.BG",
          "target": "/malware/TrojanSpy:Win32/Nivdort.BG"
        },
        {
          "id": "#Lowfi:Lua:Mampa:99!ml",
          "display_name": "#Lowfi:Lua:Mampa:99!ml",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "#Lowfi:HSTR:Installer:Multiplug",
          "display_name": "#Lowfi:HSTR:Installer:Multiplug",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Dinwod",
          "display_name": "TrojanDropper:Win32/Dinwod",
          "target": "/malware/TrojanDropper:Win32/Dinwod"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.CB",
          "display_name": "TrojanSpy:Win32/Nivdort.CB",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CB"
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBB6!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBB6!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBB6!MTB"
        },
        {
          "id": "Ploprolo",
          "display_name": "Ploprolo",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
          "display_name": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 692,
        "URL": 1666,
        "FileHash-SHA256": 630,
        "hostname": 804,
        "FileHash-MD5": 441,
        "FileHash-SHA1": 437,
        "SSLCertFingerprint": 1,
        "CVE": 1
      },
      "indicator_count": 4672,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "90 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://schedule-ai.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://schedule-ai.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630037.7908423
}