{
  "type": "URL",
  "indicator": "https://spectro.finance",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://spectro.finance",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3756220602,
      "indicator": "https://spectro.finance",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "66141ecabe8f1ab189351dd3",
          "name": "Tofsee Botnet: Google.com.uy | Install | Injection | Pegasus Monitoring",
          "description": "Installed remotely by nefarious actor by Trojan dropper. Typically not install via PlayStore/AppStore; can be with severe compromise/ VPNs will be fake. Examples: 1.1.1.1, 1.1.1.4, Proton AG or Proton.ch. Not visible: [.uy.]. All data, monitored, manipulated, tracked, location,  vehicle tracking, webcams, IP track, data cryptocurrency mining, tracked 24/7, collection, DDoS attacks, ransom, full CnC.\nTweakers.net, .bv , etc., observed, pegasus related",
          "modified": "2024-05-08T16:00:34.588000",
          "created": "2024-04-08T16:43:54.908000",
          "tags": [
            "installer",
            "tofsee",
            "trojan",
            "dropper",
            "dns",
            "as20940",
            "united",
            "aaaa",
            "as15703",
            "search",
            "servers",
            "as8455 schuberg",
            "a domains",
            "encrypt",
            "code",
            "tweakers",
            "unknown",
            "ransom",
            "body",
            "webcams",
            "banker",
            "location tracking",
            "vehicle tracking",
            "device tracking",
            "exploitation",
            "redirects",
            "ip tracking",
            "vpn nullify",
            "vehicle keycodes",
            "search threat",
            "analyzer feeds",
            "panel platform",
            "search platform",
            "profile user",
            "iocs",
            "redacted for",
            "passive dns",
            "all scoreblue",
            "hostname",
            "next",
            "cnc",
            "scanning host",
            "milesone",
            "virtual currency mining",
            "crypto",
            "regsetvalueexa",
            "regdword",
            "default",
            "show",
            "regbinary",
            "read c",
            "settingswpad",
            "as15169",
            "malware",
            "copy",
            "write",
            "upatre",
            "ids detections",
            "scan endpoints",
            "filehash",
            "av detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "ransom",
            "related pulses",
            "entries",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pe resource",
            "august",
            "win32",
            "for privacy",
            "creation date",
            "name servers",
            "urls",
            "date",
            "status",
            "as15169 google",
            "as44273 host",
            "ipv4",
            "pulse submit",
            "url analysis",
            "msie",
            "chrome",
            "moved",
            "title",
            "gmt content",
            "apple",
            "invalidate_gift_cards",
            "tulach rebranded",
            "hallrender rebranded",
            "as8075",
            "verdana",
            "td tr",
            "domain",
            "germany unknown",
            "as34011 host",
            "etag",
            "medium",
            "module load",
            "invalidate_google_play",
            "algorithm",
            "v3 serial",
            "number",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "first",
            "win32 exe",
            "win32 dll",
            "javascript",
            "mozilla firefox",
            "edition",
            "detections type",
            "name",
            "keeweb",
            "setup",
            "firefox setup",
            "record type",
            "ttl value",
            "android",
            "files",
            "formbook",
            "critical cmd",
            "tracker",
            "tsara brashears",
            "remote",
            "historical ssl",
            "referrer",
            "march",
            "body html",
            "head meta",
            "moved title",
            "head body",
            "pegasus",
            "nemtih",
            "hit",
            "men",
            "gift_card_mining",
            "google_play_card_mining",
            "miner",
            "htmladodb may",
            "twitter",
            "win64",
            "as21342",
            "as2914 ntt",
            "as15334",
            "error",
            "certificate",
            "checkbox",
            "accept",
            "record value",
            "emails",
            "domain name"
          ],
          "references": [
            "Virustotal  - google.com.uy",
            "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
            "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
            "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect",
            "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
            "nr-data.net [Apple Private Data Collection]",
            "checkip.dyndns.org [command and control]",
            "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
            "144.76.108.82 [scanning host]",
            "Yara Detections PEtite24",
            "FormBook IP: 142.251.211.243",
            "https://pegasusm2.bullsbikesusa.com",
            "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Trojan:MSIL/TrojanDropper",
              "display_name": "Trojan:MSIL/TrojanDropper",
              "target": "/malware/Trojan:MSIL/TrojanDropper"
            },
            {
              "id": "Installer",
              "display_name": "Installer",
              "target": null
            },
            {
              "id": "Sf:Agent-DQ\\ [Trj]",
              "display_name": "Sf:Agent-DQ\\ [Trj]",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Upatre!rfn",
              "display_name": "TrojanDownloader:Win32/Upatre!rfn",
              "target": "/malware/TrojanDownloader:Win32/Upatre!rfn"
            },
            {
              "id": "Win32:DropperX-gen\\ [Drp]",
              "display_name": "Win32:DropperX-gen\\ [Drp]",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-9770082-1",
              "display_name": "Win.Trojan.Tofsee-9770082-1",
              "target": null
            },
            {
              "id": "Ransom:Win32/StopCrypt.AK!MTB",
              "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
              "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1574.005",
              "name": "Executable Installer File Permissions Weakness",
              "display_name": "T1574.005 - Executable Installer File Permissions Weakness"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1493",
              "name": "Transmitted Data Manipulation",
              "display_name": "T1493 - Transmitted Data Manipulation"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1013",
              "name": "Port Monitors",
              "display_name": "T1013 - Port Monitors"
            },
            {
              "id": "T1430",
              "name": "Location Tracking",
              "display_name": "T1430 - Location Tracking"
            },
            {
              "id": "T1468",
              "name": "Remotely Track Device Without Authorization",
              "display_name": "T1468 - Remotely Track Device Without Authorization"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1483",
              "name": "Domain Generation Algorithms",
              "display_name": "T1483 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 392,
            "FileHash-SHA1": 468,
            "FileHash-SHA256": 3233,
            "URL": 8667,
            "domain": 2219,
            "hostname": 3480,
            "email": 8
          },
          "indicator_count": 18467,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "711 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f55ed2015e05ffbc2b72a8",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-16T08:56:50.387000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980471600645142bcd924",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-19T12:08:39.100000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65f55ed2015e05ffbc2b72a8",
          "export_count": 186944,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546cf78627adef6562a97aa",
          "name": "Browser Malware Attack",
          "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:10:48.676000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "866 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546d0120a7e479fecffe2b1",
          "name": "Browser Malware Attack",
          "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:13:21.883000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "866 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
        "nr-data.net [Apple Private Data Collection]",
        "Botnet Server IP: 141.226.230.48",
        "209.85.145.113 [malware]",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "newrelic.se",
        "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
        "144.76.108.82 [scanning host]",
        "Ryuk: http://kramtechnology.com/",
        "http://tracking.3061331.corn10wuk.club",
        "https://pegasusm2.bullsbikesusa.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "states.app",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "dev-2.ernestatech.com",
        "globalworker1.sol.us",
        "www.search.app.goo.gl",
        "Data Analysis",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
        "apps.apple.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "hasownproperty.call",
        "cdn.fuckporntube.com",
        "1080p-torrent.ml",
        "apps.apple.com/us/app/id$",
        "worker-m-tlcus1.sol.us",
        "FormBook IP: 142.251.211.243",
        "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect",
        "id.google.com",
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "Yara Detections PEtite24",
        "Ransom: message.htm.com",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
        "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
        "t.name",
        "location.search",
        "object.prototype.hasownproperty.call",
        "http://decafsmob.this.id",
        "http://e.id?e.id:e.id.getAttribute",
        "https://dnsorangetel.dn2.n-helix.com",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
        "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
        "Alienvault OTX",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "applestore.id",
        "checkip.dyndns.org [command and control]",
        "WebTools",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "Virustotal  - google.com.uy",
        "a.default.meta.applestore.id",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "Online Research",
        "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
        "http://git.io/yBU2rg",
        "https://api.wavebrowserbase.com",
        "Ryuk: kramtechnology.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Webtoolbar",
            "Ransom:win32/stopcrypt.ak!mtb",
            "Win32:dropperx-gen\\ [drp]",
            "Gamehack",
            "Win.trojan.tofsee-9770082-1",
            "Installer",
            "Sf:agent-dq\\ [trj]",
            "Maltiverse",
            "Cl0p",
            "Trojandownloader:win32/upatre!rfn",
            "Generic",
            "Backdoor:msil/asyncrat",
            "Hsbc",
            "Tofsee",
            "Trojan:msil/trojandropper",
            "Trojanspy",
            "Backdoor:msil/quasarrat"
          ],
          "industries": [
            "Hacking",
            "Social media",
            "Media",
            "Technology"
          ],
          "unique_indicators": 71285
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/spectro.finance",
    "whois": "http://whois.domaintools.com/spectro.finance",
    "domain": "spectro.finance",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "66141ecabe8f1ab189351dd3",
      "name": "Tofsee Botnet: Google.com.uy | Install | Injection | Pegasus Monitoring",
      "description": "Installed remotely by nefarious actor by Trojan dropper. Typically not install via PlayStore/AppStore; can be with severe compromise/ VPNs will be fake. Examples: 1.1.1.1, 1.1.1.4, Proton AG or Proton.ch. Not visible: [.uy.]. All data, monitored, manipulated, tracked, location,  vehicle tracking, webcams, IP track, data cryptocurrency mining, tracked 24/7, collection, DDoS attacks, ransom, full CnC.\nTweakers.net, .bv , etc., observed, pegasus related",
      "modified": "2024-05-08T16:00:34.588000",
      "created": "2024-04-08T16:43:54.908000",
      "tags": [
        "installer",
        "tofsee",
        "trojan",
        "dropper",
        "dns",
        "as20940",
        "united",
        "aaaa",
        "as15703",
        "search",
        "servers",
        "as8455 schuberg",
        "a domains",
        "encrypt",
        "code",
        "tweakers",
        "unknown",
        "ransom",
        "body",
        "webcams",
        "banker",
        "location tracking",
        "vehicle tracking",
        "device tracking",
        "exploitation",
        "redirects",
        "ip tracking",
        "vpn nullify",
        "vehicle keycodes",
        "search threat",
        "analyzer feeds",
        "panel platform",
        "search platform",
        "profile user",
        "iocs",
        "redacted for",
        "passive dns",
        "all scoreblue",
        "hostname",
        "next",
        "cnc",
        "scanning host",
        "milesone",
        "virtual currency mining",
        "crypto",
        "regsetvalueexa",
        "regdword",
        "default",
        "show",
        "regbinary",
        "read c",
        "settingswpad",
        "as15169",
        "malware",
        "copy",
        "write",
        "upatre",
        "ids detections",
        "scan endpoints",
        "filehash",
        "av detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "ransom",
        "related pulses",
        "entries",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pe resource",
        "august",
        "win32",
        "for privacy",
        "creation date",
        "name servers",
        "urls",
        "date",
        "status",
        "as15169 google",
        "as44273 host",
        "ipv4",
        "pulse submit",
        "url analysis",
        "msie",
        "chrome",
        "moved",
        "title",
        "gmt content",
        "apple",
        "invalidate_gift_cards",
        "tulach rebranded",
        "hallrender rebranded",
        "as8075",
        "verdana",
        "td tr",
        "domain",
        "germany unknown",
        "as34011 host",
        "etag",
        "medium",
        "module load",
        "invalidate_google_play",
        "algorithm",
        "v3 serial",
        "number",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "first",
        "win32 exe",
        "win32 dll",
        "javascript",
        "mozilla firefox",
        "edition",
        "detections type",
        "name",
        "keeweb",
        "setup",
        "firefox setup",
        "record type",
        "ttl value",
        "android",
        "files",
        "formbook",
        "critical cmd",
        "tracker",
        "tsara brashears",
        "remote",
        "historical ssl",
        "referrer",
        "march",
        "body html",
        "head meta",
        "moved title",
        "head body",
        "pegasus",
        "nemtih",
        "hit",
        "men",
        "gift_card_mining",
        "google_play_card_mining",
        "miner",
        "htmladodb may",
        "twitter",
        "win64",
        "as21342",
        "as2914 ntt",
        "as15334",
        "error",
        "certificate",
        "checkbox",
        "accept",
        "record value",
        "emails",
        "domain name"
      ],
      "references": [
        "Virustotal  - google.com.uy",
        "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
        "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
        "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect",
        "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
        "nr-data.net [Apple Private Data Collection]",
        "checkip.dyndns.org [command and control]",
        "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
        "144.76.108.82 [scanning host]",
        "Yara Detections PEtite24",
        "FormBook IP: 142.251.211.243",
        "https://pegasusm2.bullsbikesusa.com",
        "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Trojan:MSIL/TrojanDropper",
          "display_name": "Trojan:MSIL/TrojanDropper",
          "target": "/malware/Trojan:MSIL/TrojanDropper"
        },
        {
          "id": "Installer",
          "display_name": "Installer",
          "target": null
        },
        {
          "id": "Sf:Agent-DQ\\ [Trj]",
          "display_name": "Sf:Agent-DQ\\ [Trj]",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Upatre!rfn",
          "display_name": "TrojanDownloader:Win32/Upatre!rfn",
          "target": "/malware/TrojanDownloader:Win32/Upatre!rfn"
        },
        {
          "id": "Win32:DropperX-gen\\ [Drp]",
          "display_name": "Win32:DropperX-gen\\ [Drp]",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-9770082-1",
          "display_name": "Win.Trojan.Tofsee-9770082-1",
          "target": null
        },
        {
          "id": "Ransom:Win32/StopCrypt.AK!MTB",
          "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
          "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1574.005",
          "name": "Executable Installer File Permissions Weakness",
          "display_name": "T1574.005 - Executable Installer File Permissions Weakness"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1493",
          "name": "Transmitted Data Manipulation",
          "display_name": "T1493 - Transmitted Data Manipulation"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1013",
          "name": "Port Monitors",
          "display_name": "T1013 - Port Monitors"
        },
        {
          "id": "T1430",
          "name": "Location Tracking",
          "display_name": "T1430 - Location Tracking"
        },
        {
          "id": "T1468",
          "name": "Remotely Track Device Without Authorization",
          "display_name": "T1468 - Remotely Track Device Without Authorization"
        },
        {
          "id": "T1450",
          "name": "Exploit SS7 to Track Device Location",
          "display_name": "T1450 - Exploit SS7 to Track Device Location"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1483",
          "name": "Domain Generation Algorithms",
          "display_name": "T1483 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 392,
        "FileHash-SHA1": 468,
        "FileHash-SHA256": 3233,
        "URL": 8667,
        "domain": 2219,
        "hostname": 3480,
        "email": 8
      },
      "indicator_count": 18467,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "711 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f55ed2015e05ffbc2b72a8",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-16T08:56:50.387000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980471600645142bcd924",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-19T12:08:39.100000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65f55ed2015e05ffbc2b72a8",
      "export_count": 186944,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546cf78627adef6562a97aa",
      "name": "Browser Malware Attack",
      "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:10:48.676000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "866 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546d0120a7e479fecffe2b1",
      "name": "Browser Malware Attack",
      "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:13:21.883000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "866 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650a0b7c9a6b3c5d0a2a3960",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
      "modified": "2023-10-19T14:04:37.381000",
      "created": "2023-09-19T20:58:36.137000",
      "tags": [
        "contacted",
        "threat roundup",
        "execution",
        "ssl certificate",
        "dark web",
        "crypto threat",
        "resolutions",
        "referrer",
        "stealer",
        "quasar",
        "asyncrat",
        "error",
        "social engineering",
        "iPhone phishing",
        "Apple phishing",
        "email phishing",
        "emotet",
        "remote",
        "attacks"
      ],
      "references": [
        "Alienvault OTX",
        "Data Analysis",
        "Online Research",
        "WebTools"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "India"
      ],
      "malware_families": [
        {
          "id": "Backdoor:MSIL/AsyncRAT",
          "display_name": "Backdoor:MSIL/AsyncRAT",
          "target": "/malware/Backdoor:MSIL/AsyncRAT"
        },
        {
          "id": "Backdoor:MSIL/QuasarRat",
          "display_name": "Backdoor:MSIL/QuasarRat",
          "target": "/malware/Backdoor:MSIL/QuasarRat"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1548",
          "name": "Abuse Elevation Control Mechanism",
          "display_name": "T1548 - Abuse Elevation Control Mechanism"
        }
      ],
      "industries": [
        "Media",
        "Social Media",
        "Technology",
        "Hacking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 5791,
        "URL": 11513,
        "domain": 2317,
        "hostname": 3255,
        "CVE": 3
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://spectro.finance",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://spectro.finance",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630142.3870845
}