{
  "type": "URL",
  "indicator": "https://sso.dev.applemarketingtools.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://sso.dev.applemarketingtools.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4305606655,
      "indicator": "https://sso.dev.applemarketingtools.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "698e93e1ab02db8c49e8c3ed",
          "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
          "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
          "modified": "2026-04-19T08:11:41.130000",
          "created": "2026-02-13T03:00:49.872000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 27678,
            "FileHash-SHA256": 47676,
            "FileHash-MD5": 42534,
            "FileHash-SHA1": 23213,
            "hostname": 33703,
            "URL": 75433,
            "SSLCertFingerprint": 30,
            "CVE": 7582,
            "email": 313,
            "FileHash-IMPHASH": 8,
            "CIDR": 26205,
            "JA3": 1,
            "IPv4": 80,
            "URI": 5
          },
          "indicator_count": 284461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "12 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ded8198b25581a09b90824",
          "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
          "description": "",
          "modified": "2026-04-15T00:13:13.981000",
          "created": "2026-04-15T00:13:13.981000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "4 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ddeb45c45f6a3cd721397d",
          "name": "Active attacks  \u2022 Apple \u2022 Tulach",
          "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
          "modified": "2026-04-14T07:22:45.250000",
          "created": "2026-04-14T07:22:45.250000",
          "tags": [
            "url http",
            "ipv4",
            "indicator role",
            "active related",
            "united",
            "moved",
            "gmt content",
            "certificate",
            "all domain",
            "msie",
            "chrome",
            "extraction",
            "data upload",
            "twitter",
            "cookie",
            "extra",
            "include data",
            "review locs",
            "exclude",
            "suggested os",
            "onlv",
            "failed",
            "stop data",
            "read c",
            "unicode",
            "rgba",
            "memcommit",
            "delete",
            "dock",
            "write",
            "execution",
            "sc type",
            "extri",
            "include review",
            "exclude sugges",
            "typ data",
            "a domains",
            "present apr",
            "script urls",
            "files",
            "files ip",
            "address",
            "ios",
            "mac",
            "apple",
            "appleid",
            "itunes",
            "next associated",
            "all ipv4",
            "included ic",
            "uny teade",
            "type hostnar",
            "hostnar hostnar",
            "hostnar",
            "macair",
            "macairaustralia",
            "ipad",
            "ipod",
            "cryptexportkey",
            "invalid pointer",
            "cryptgenkey",
            "stream",
            "defender",
            "delphi",
            "class",
            "stack",
            "format",
            "unknown",
            "united states",
            "phishing",
            "password",
            "traffic redirected",
            "service mod",
            "service execution",
            "youtube",
            "music",
            "streams",
            "songs",
            "played songs",
            "music streams",
            "most played",
            "fonelab",
            "indicator",
            "included iocs",
            "manually add",
            "review ocs",
            "exclude inn",
            "sugges data",
            "find",
            "include",
            "url https",
            "enter sc",
            "type",
            "no matchme",
            "search otx",
            "https",
            "references x",
            "analyze",
            "open th",
            "url data",
            "se http",
            "no match",
            "excluded iocs",
            "iocs",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "analysis date",
            "file score",
            "medium risk",
            "yara detections",
            "contacted",
            "related tags",
            "x vercel",
            "file type",
            "type indicator",
            "role title",
            "related pulses",
            "mulch virtua",
            "library loade",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugt",
            "samuel tulach",
            "unity engine",
            "tulach",
            "sa awareness",
            "sabey",
            "sar cut",
            "autofill",
            "includer review",
            "portiana oney",
            "targeting",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "musickit_1_.js",
            "lazarus",
            "injection",
            "CVE-2017-8570",
            "prefetch2",
            "target",
            "aaaa",
            "ip address",
            "record value",
            "emails",
            "samuel tuachs",
            "sapev",
            "review exclude",
            "monitored target",
            "script",
            "mitre att",
            "ascii text",
            "span",
            "path",
            "iframe",
            "april",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "body",
            "development att",
            "t1055.012 list planting",
            "active"
          ],
          "references": [
            "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
            "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
            "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
            "https://podcasts.apple.com/us/podcast/lazarus",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://help.aiseesoft.jp/blu-ray-player",
            "http://help.aiseesoft.jp/fonelab/",
            "https://action.aiseesoft.jp/itunes.php",
            "http://help.aiseesoft.jp/total-video-converter",
            "http://help.aiseesoft.jp/total-video-converter/",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
            "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
            "http://test-firstmile.digitecgalaxus.ch",
            "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
            "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
            "cdn.rss.applemarketingtools.com",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "1.bing.com.cn",
            "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
            "www.phantomcameras.cn",
            "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
            "podcasts.apple.com \u2022 23.34.32.21",
            "www.apple.com \u2022 23.34.32.199",
            "js-cdn.music.apple.com \u2022 23.78.51.170",
            "http://firstmile.digitecgalaxus.ch",
            "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
            "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
            "Tulach.cc",
            "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
            "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
            "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
            "asp.net domain pointer",
            "developer.x.com",
            "aotx.alienvault.com (aotx.?)",
            "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
            "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1020.001",
              "name": "Traffic Duplication",
              "display_name": "T1020.001 - Traffic Duplication"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591.002",
              "name": "Business Relationships",
              "display_name": "T1591.002 - Business Relationships"
            },
            {
              "id": "T1591.001",
              "name": "Determine Physical Locations",
              "display_name": "T1591.001 - Determine Physical Locations"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1029,
            "domain": 396,
            "email": 7,
            "URL": 2784,
            "FileHash-SHA256": 898,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 68,
            "IPv4": 35,
            "CVE": 1,
            "SSLCertFingerprint": 13
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "5 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69db05f833d3d6d2231fb201",
          "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
          "description": "",
          "modified": "2026-04-12T02:39:52.993000",
          "created": "2026-04-12T02:39:52.993000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dab27a0493e0e80a0f35cd",
          "name": "SearchSuite \u2022 Healthcare Administration",
          "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
          "modified": "2026-04-11T20:43:38.695000",
          "created": "2026-04-11T20:43:38.695000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "account-apple.com",
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "www.phantomcameras.cn",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "www.apple.com \u2022 23.34.32.199",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
        "Yara Detections: Tofsee",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "http://help.aiseesoft.jp/total-video-converter",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "euw-serp-dev-testing19.duck.ai",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "http://help.aiseesoft.jp/fonelab/",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "ids-apple.com \u2022 itunes.org",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Tulach.cc",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "http://help.aiseesoft.jp/blu-ray-player",
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "http://firstmile.digitecgalaxus.ch",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "http://cab.applemarketingtools.com",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://console.applemarketingtools.com/",
        "http://help.aiseesoft.jp/total-video-converter/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "BearShare Install File Version 12.0.0.135802",
        "asp.net domain pointer",
        "https://action.aiseesoft.jp/itunes.php",
        "Musiclab, LLC",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "aotx.alienvault.com (aotx.?)",
        "cdn.rss.applemarketingtools.com",
        "xn--cloud-4sa.com",
        "developer.x.com",
        "africa.konnect.com",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "http://test-firstmile.digitecgalaxus.ch",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "1.bing.com.cn",
        "podcasts.apple.com \u2022 23.34.32.21"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win32.application.bearshare.a",
            "Trojandownloader:win32/cutwail",
            "Backdoor:win32/tofsee.t",
            "Exploit:win32/cve-2017-0147",
            "Win.packed.bandook-9882274-1",
            "Win.trojan.tofsee-7102058-0",
            "Cve-2023-22518",
            "Win32/searchsuite"
          ],
          "industries": [
            "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in",
            "Government",
            "Technology",
            "Healthcare"
          ],
          "unique_indicators": 147207
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/applemarketingtools.com",
    "whois": "http://whois.domaintools.com/applemarketingtools.com",
    "domain": "applemarketingtools.com",
    "hostname": "sso.dev.applemarketingtools.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "698e93e1ab02db8c49e8c3ed",
      "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
      "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
      "modified": "2026-04-19T08:11:41.130000",
      "created": "2026-02-13T03:00:49.872000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 27678,
        "FileHash-SHA256": 47676,
        "FileHash-MD5": 42534,
        "FileHash-SHA1": 23213,
        "hostname": 33703,
        "URL": 75433,
        "SSLCertFingerprint": 30,
        "CVE": 7582,
        "email": 313,
        "FileHash-IMPHASH": 8,
        "CIDR": 26205,
        "JA3": 1,
        "IPv4": 80,
        "URI": 5
      },
      "indicator_count": 284461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "12 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ded8198b25581a09b90824",
      "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
      "description": "",
      "modified": "2026-04-15T00:13:13.981000",
      "created": "2026-04-15T00:13:13.981000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "4 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ddeb45c45f6a3cd721397d",
      "name": "Active attacks  \u2022 Apple \u2022 Tulach",
      "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
      "modified": "2026-04-14T07:22:45.250000",
      "created": "2026-04-14T07:22:45.250000",
      "tags": [
        "url http",
        "ipv4",
        "indicator role",
        "active related",
        "united",
        "moved",
        "gmt content",
        "certificate",
        "all domain",
        "msie",
        "chrome",
        "extraction",
        "data upload",
        "twitter",
        "cookie",
        "extra",
        "include data",
        "review locs",
        "exclude",
        "suggested os",
        "onlv",
        "failed",
        "stop data",
        "read c",
        "unicode",
        "rgba",
        "memcommit",
        "delete",
        "dock",
        "write",
        "execution",
        "sc type",
        "extri",
        "include review",
        "exclude sugges",
        "typ data",
        "a domains",
        "present apr",
        "script urls",
        "files",
        "files ip",
        "address",
        "ios",
        "mac",
        "apple",
        "appleid",
        "itunes",
        "next associated",
        "all ipv4",
        "included ic",
        "uny teade",
        "type hostnar",
        "hostnar hostnar",
        "hostnar",
        "macair",
        "macairaustralia",
        "ipad",
        "ipod",
        "cryptexportkey",
        "invalid pointer",
        "cryptgenkey",
        "stream",
        "defender",
        "delphi",
        "class",
        "stack",
        "format",
        "unknown",
        "united states",
        "phishing",
        "password",
        "traffic redirected",
        "service mod",
        "service execution",
        "youtube",
        "music",
        "streams",
        "songs",
        "played songs",
        "music streams",
        "most played",
        "fonelab",
        "indicator",
        "included iocs",
        "manually add",
        "review ocs",
        "exclude inn",
        "sugges data",
        "find",
        "include",
        "url https",
        "enter sc",
        "type",
        "no matchme",
        "search otx",
        "https",
        "references x",
        "analyze",
        "open th",
        "url data",
        "se http",
        "no match",
        "excluded iocs",
        "iocs",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "analysis date",
        "file score",
        "medium risk",
        "yara detections",
        "contacted",
        "related tags",
        "x vercel",
        "file type",
        "type indicator",
        "role title",
        "related pulses",
        "mulch virtua",
        "library loade",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugt",
        "samuel tulach",
        "unity engine",
        "tulach",
        "sa awareness",
        "sabey",
        "sar cut",
        "autofill",
        "includer review",
        "portiana oney",
        "targeting",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "musickit_1_.js",
        "lazarus",
        "injection",
        "CVE-2017-8570",
        "prefetch2",
        "target",
        "aaaa",
        "ip address",
        "record value",
        "emails",
        "samuel tuachs",
        "sapev",
        "review exclude",
        "monitored target",
        "script",
        "mitre att",
        "ascii text",
        "span",
        "path",
        "iframe",
        "april",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "body",
        "development att",
        "t1055.012 list planting",
        "active"
      ],
      "references": [
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/blu-ray-player",
        "http://help.aiseesoft.jp/fonelab/",
        "https://action.aiseesoft.jp/itunes.php",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "cdn.rss.applemarketingtools.com",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "1.bing.com.cn",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "www.phantomcameras.cn",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "podcasts.apple.com \u2022 23.34.32.21",
        "www.apple.com \u2022 23.34.32.199",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://firstmile.digitecgalaxus.ch",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "Tulach.cc",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "asp.net domain pointer",
        "developer.x.com",
        "aotx.alienvault.com (aotx.?)",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1020.001",
          "name": "Traffic Duplication",
          "display_name": "T1020.001 - Traffic Duplication"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591.002",
          "name": "Business Relationships",
          "display_name": "T1591.002 - Business Relationships"
        },
        {
          "id": "T1591.001",
          "name": "Determine Physical Locations",
          "display_name": "T1591.001 - Determine Physical Locations"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1029,
        "domain": 396,
        "email": 7,
        "URL": 2784,
        "FileHash-SHA256": 898,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 68,
        "IPv4": 35,
        "CVE": 1,
        "SSLCertFingerprint": 13
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "5 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69db05f833d3d6d2231fb201",
      "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
      "description": "",
      "modified": "2026-04-12T02:39:52.993000",
      "created": "2026-04-12T02:39:52.993000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dab27a0493e0e80a0f35cd",
      "name": "SearchSuite \u2022 Healthcare Administration",
      "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
      "modified": "2026-04-11T20:43:38.695000",
      "created": "2026-04-11T20:43:38.695000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://sso.dev.applemarketingtools.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://sso.dev.applemarketingtools.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629893.5337286
}