{
  "type": "URL",
  "indicator": "https://sysmex.zyxonx.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://sysmex.zyxonx.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3906366116,
      "indicator": "https://sysmex.zyxonx.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "6608aaf7ca0e965e593ed1d4",
          "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
          "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
          "modified": "2025-10-17T11:03:07.034000",
          "created": "2024-03-31T00:14:47.183000",
          "tags": [
            "sha256",
            "ssdeep",
            "reputacja",
            "tworzy pliki",
            "informacje",
            "bardzo duga",
            "tworzy",
            "adresy url",
            "tworzy katalog",
            "win64",
            "ameryki",
            "typ pliku",
            "serwer nazw",
            "san jose",
            "adres",
            "digital",
            "data wyganicia",
            "csc corporate",
            "domains",
            "ca data",
            "data utworzenia",
            "dnssec"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6432,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2140,
            "hostname": 5874,
            "FileHash-SHA256": 12539,
            "FileHash-MD5": 3686,
            "FileHash-SHA1": 2751,
            "IPv4": 503,
            "URL": 10770,
            "email": 26,
            "CVE": 88,
            "YARA": 6,
            "JA3": 2,
            "IPv6": 28,
            "SSLCertFingerprint": 5,
            "BitcoinAddress": 3,
            "CIDR": 1
          },
          "indicator_count": 38422,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "184 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665c44f012d938d1c7dd591e",
          "name": "PIT Projekt.exe (www.pitprojekt.pl , pitprojekt.pl)  oraz  Ceidg.gov.pl - Dane publiczne wpisu",
          "description": "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4   NIP:6161230754\nhttps://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778               NIP;6112323510\nhttp://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778\n2.16.6.145146f05-9aac-4942-a42d-f2550a19c0c4              NIP:6131434311\nipv4: 2.16.6.14, 2.16.6.6, 2.16.6.1,",
          "modified": "2025-10-06T11:12:39.639000",
          "created": "2024-06-02T10:09:52.601000",
          "tags": [
            "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g",
            "prosz czeka",
            "pobierz plik",
            "wojcieszyce",
            "urls competing",
            "ceidg centralna",
            "gospodarczej",
            "wyszukiwanie",
            "przejd",
            "centrum pomocy",
            "informacja o",
            "mapa",
            "strona gwna",
            "przegldanie",
            "ceidg szybki",
            "uwagi prawne",
            "deklaracja",
            "serwer",
            "returnurl",
            "idf3ee4c4ee00",
            "id7a025cc6516",
            "wctxrm0",
            "idf3ee4c4",
            "id35146f059aa",
            "ideb8f4cf26ef",
            "id7a025cc",
            "id35146f0",
            "publicznywsz3",
            "id97c275c",
            "url wiek",
            "ssdeep",
            "sha1",
            "pehasz",
            "typlibid",
            "pit projekt",
            "chcesz",
            "pity online",
            "program",
            "interesuje ci",
            "pity zapisane",
            "jeli",
            "oddajemy w",
            "twoje rce",
            "dziki jego"
          ],
          "references": [
            "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
            "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4",
            "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search",
            "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4",
            "http://www.pitprojekt.pl",
            "http://pitprojekt.pl"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wojcieszyce",
              "display_name": "Wojcieszyce",
              "target": null
            },
            {
              "id": "Serwer",
              "display_name": "Serwer",
              "target": null
            },
            {
              "id": "Serwer A Przed\u0142u\u017cenie sesji #{text}",
              "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text}",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8271,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1259,
            "URL": 6009,
            "hostname": 3030,
            "FileHash-SHA256": 10233,
            "FileHash-MD5": 2742,
            "FileHash-SHA1": 2348,
            "email": 75,
            "SSLCertFingerprint": 11,
            "YARA": 2,
            "CVE": 13,
            "FileHash-PEHASH": 1,
            "IPv4": 34,
            "IPv6": 6
          },
          "indicator_count": 25763,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 134,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66246ff49ed29ea9bb2bf122",
          "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
          "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
          "modified": "2025-05-14T21:18:36.989000",
          "created": "2024-04-21T01:46:28.554000",
          "tags": [
            "jeleniej grze",
            "aktualnoci",
            "informacje",
            "jednostka",
            "rejonowy",
            "konkurs",
            "najczciej",
            "sd rejonowy",
            "przejd",
            "czytaj",
            "click",
            "sdzia jarosaw",
            "wydziau",
            "sdzia grzegorz",
            "katarzyna",
            "rudnicka dane",
            "kontaktowe sd",
            "jelenia gra",
            "mickiewicza",
            "zawarto",
            "html",
            "nazwa meta",
            "robotw",
            "telefon",
            "brak",
            "skala",
            "ua zgodna",
            "head body",
            "zasb",
            "cname",
            "kod odpowiedzi",
            "kodowanie treci",
            "wygasa",
            "gmt serwer",
            "pragma",
            "kontrola pamici",
            "podrcznej",
            "data",
            "gmt kontrola",
            "dostpuzezwl na",
            "czytaj wicej",
            "sd okrgowy",
            "jednostki",
            "okrgowy",
            "ogoszenia",
            "sha256",
            "vhash",
            "ssdeep",
            "https odcisk",
            "palca jarma",
            "https dane",
            "v3 numer",
            "odcisk palca",
            "tworzy katalog",
            "tworzy pliki",
            "typ pliku",
            "json",
            "ascii",
            "windows",
            "sqlite",
            "foxpro fpt",
            "links typ",
            "mapa",
            "152 x",
            "sqlite w",
            "sha1",
            "sha512",
            "file size",
            "b file",
            "testing",
            "komornik sdowy",
            "sdzie rejonowym",
            "tomasz rodacki",
            "obwieszczenie",
            "komornicze",
            "tumacza migam",
            "tumacz czynny",
            "zamknite",
            "wiadczenia",
            "schedule",
            "error",
            "javascript",
            "bakers hall",
            "ixaction",
            "script",
            "ixchatlauncher",
            "compatibility",
            "com dla",
            "t1055 pewno",
            "unikanie obrony",
            "t1036 maskarada",
            "t1082 pewno",
            "informacje o",
            "nazwa pliku",
            "dokument pdf",
            "rozmiar pliku",
            "zapowied",
            "type",
            "iii dbt",
            "utf8",
            "dziennik"
          ],
          "references": [
            "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
            "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
            "http://www.jelenia-gora.so.gov.pl/",
            "https://www.jelenia-gora.so.gov.pl/",
            "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
            "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
            "https://www.jelenia-gora.sr.gov.pl/spacer",
            "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            },
            {
              "id": "serwer",
              "display_name": "serwer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 71,
            "domain": 7651,
            "hostname": 7680,
            "IPv4": 331,
            "FileHash-SHA256": 16168,
            "URL": 10399,
            "FileHash-MD5": 3639,
            "FileHash-SHA1": 3468,
            "CIDR": 4,
            "CVE": 89,
            "YARA": 521,
            "SSLCertFingerprint": 25,
            "JA3": 1,
            "IPv6": 5813
          },
          "indicator_count": 55860,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6665c84b687c5e16b95e8f8e",
          "name": "94.152.152.223  v65023.niebieski.net  Cyber_Folks S.A.  (vgt.pl)",
          "description": "SHA1  32223ade25c4a1d39cb8ac13042e8e6dfe3ca78f ,  SHA1 \n 99987c1ee1ddb7fd113abd65c836fbb71c3da4da\n Role:  UPX , Ransomware , Trojan ,  Mirai , Buschido Mirai  antywirusowe\nWin.Trojan.VBGeneric-6735875-0 , Robak:Win32/Mofksys.RND!MTB",
          "modified": "2024-12-31T01:53:43.222000",
          "created": "2024-06-09T15:20:43.178000",
          "tags": [
            "expiration",
            "no expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "ipv4",
            "filehashsha256",
            "fh no",
            "filehashmd5",
            "https odcisk",
            "palca jarma",
            "https dane",
            "v3 numer",
            "odcisk palca",
            "pl o",
            "unizeto",
            "sa ou",
            "urzd",
            "certum cn"
          ],
          "references": [
            "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591",
            "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71",
            "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527"
          ],
          "public": 1,
          "adversary": "TrojanDownloader:Win32/Nemucod",
          "targeted_countries": [
            "Poland",
            "United States of America",
            "Germany",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce  PL",
              "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce  PL",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1027.005",
              "name": "Indicator Removal from Tools",
              "display_name": "T1027.005 - Indicator Removal from Tools"
            },
            {
              "id": "T1027.004",
              "name": "Compile After Delivery",
              "display_name": "T1027.004 - Compile After Delivery"
            },
            {
              "id": "T1027.003",
              "name": "Steganography",
              "display_name": "T1027.003 - Steganography"
            },
            {
              "id": "T1027.002",
              "name": "Software Packing",
              "display_name": "T1027.002 - Software Packing"
            },
            {
              "id": "T1027.001",
              "name": "Binary Padding",
              "display_name": "T1027.001 - Binary Padding"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.003",
              "name": "Windows Command Shell",
              "display_name": "T1059.003 - Windows Command Shell"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1553.006",
              "name": "Code Signing Policy Modification",
              "display_name": "T1553.006 - Code Signing Policy Modification"
            },
            {
              "id": "T1553.004",
              "name": "Install Root Certificate",
              "display_name": "T1553.004 - Install Root Certificate"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1055.011",
              "name": "Extra Window Memory Injection",
              "display_name": "T1055.011 - Extra Window Memory Injection"
            },
            {
              "id": "T1055.008",
              "name": "Ptrace System Calls",
              "display_name": "T1055.008 - Ptrace System Calls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1036.001",
              "name": "Invalid Code Signature",
              "display_name": "T1036.001 - Invalid Code Signature"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 3205,
            "FileHash-SHA1": 2671,
            "FileHash-SHA256": 11469,
            "SSLCertFingerprint": 6,
            "URL": 5435,
            "domain": 1356,
            "email": 55,
            "hostname": 2205,
            "CVE": 13,
            "YARA": 4,
            "CIDR": 1,
            "IPv4": 25,
            "FileHash-IMPHASH": 1,
            "BitcoinAddress": 2,
            "IPv6": 13
          },
          "indicator_count": 26461,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "474 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "664b74b2683dec84891aef96",
          "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads",
          "description": "http://185.172.128.69/batushka/inte.exe  \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe",
          "modified": "2024-10-14T20:36:05.361000",
          "created": "2024-05-20T16:05:06.313000",
          "tags": [
            "stdin via",
            "nextron",
            "powershell id",
            "powershell",
            "tim rauch",
            "elastic",
            "script block",
            "logging",
            "pe32",
            "ms windows",
            "intel",
            "nazwa typ",
            "md5 nazwa",
            "procesu"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7268,
            "domain": 1310,
            "URL": 8101,
            "FileHash-SHA1": 1615,
            "hostname": 2590,
            "FileHash-MD5": 1852,
            "email": 267,
            "SSLCertFingerprint": 3,
            "CIDR": 38,
            "CVE": 7,
            "IPv4": 15,
            "YARA": 4
          },
          "indicator_count": 23070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 135,
          "modified_text": "551 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "663d2869e0f3a42bbddc42ff",
          "name": "UPX executable packer.",
          "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
          "modified": "2024-10-14T00:01:17.069000",
          "created": "2024-05-09T19:47:53.786000",
          "tags": [
            "cioch adrian",
            "centrum usug",
            "sieciowych",
            "elf binary",
            "upx compression",
            "roth",
            "nextron",
            "info",
            "javascript",
            "html",
            "office open",
            "xml document",
            "network capture",
            "win32 exe",
            "xml pakietu",
            "pdf zestawy",
            "przechwytywanie",
            "office",
            "filehashsha1",
            "url https",
            "cve cve20201070",
            "cve cve20203153",
            "cve cve20201048",
            "cve cve20211732",
            "cve20201048 apr",
            "filehashmd5",
            "cve cve20010901",
            "cve cve20021841",
            "cve20153202 apr",
            "cve cve20160728",
            "cve cve20161807",
            "cve cve20175123",
            "cve20185407 apr",
            "cve cve20054605",
            "cve cve20060745",
            "cve cve20070452",
            "cve cve20070453",
            "cve cve20070454",
            "cve cve20071355",
            "cve cve20071358",
            "cve cve20071871",
            "cve20149614 apr",
            "cve cve20151503",
            "cve cve20152080",
            "cve cve20157377",
            "cve cve20170131",
            "cve20200796 may",
            "cve cve20113403"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6861,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5771,
            "domain": 3139,
            "URL": 14525,
            "FileHash-SHA1": 2610,
            "IPv4": 108,
            "CIDR": 40,
            "FileHash-SHA256": 10705,
            "FileHash-MD5": 3373,
            "YARA": 2,
            "CVE": 148,
            "Mutex": 7,
            "FilePath": 3,
            "SSLCertFingerprint": 3,
            "email": 23,
            "JA3": 1,
            "IPv6": 2
          },
          "indicator_count": 40460,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "552 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71",
        "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search",
        "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4",
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "https://www.jelenia-gora.so.gov.pl/",
        "http://www.pitprojekt.pl",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "http://www.jelenia-gora.so.gov.pl/",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
        "http://pitprojekt.pl",
        "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
        "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "TrojanDownloader:Win32/Nemucod"
          ],
          "malware_families": [
            "",
            "Serwer a przed\u0142u\u017cenie sesji #{text}",
            "Serwer",
            "Wojcieszyce",
            "Serwer a przed\u0142u\u017cenie sesji #{text} wojcieszyce  pl"
          ],
          "industries": [],
          "unique_indicators": 167657
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/zyxonx.com",
    "whois": "http://whois.domaintools.com/zyxonx.com",
    "domain": "zyxonx.com",
    "hostname": "sysmex.zyxonx.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "6608aaf7ca0e965e593ed1d4",
      "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
      "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
      "modified": "2025-10-17T11:03:07.034000",
      "created": "2024-03-31T00:14:47.183000",
      "tags": [
        "sha256",
        "ssdeep",
        "reputacja",
        "tworzy pliki",
        "informacje",
        "bardzo duga",
        "tworzy",
        "adresy url",
        "tworzy katalog",
        "win64",
        "ameryki",
        "typ pliku",
        "serwer nazw",
        "san jose",
        "adres",
        "digital",
        "data wyganicia",
        "csc corporate",
        "domains",
        "ca data",
        "data utworzenia",
        "dnssec"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6432,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2140,
        "hostname": 5874,
        "FileHash-SHA256": 12539,
        "FileHash-MD5": 3686,
        "FileHash-SHA1": 2751,
        "IPv4": 503,
        "URL": 10770,
        "email": 26,
        "CVE": 88,
        "YARA": 6,
        "JA3": 2,
        "IPv6": 28,
        "SSLCertFingerprint": 5,
        "BitcoinAddress": 3,
        "CIDR": 1
      },
      "indicator_count": 38422,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "184 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665c44f012d938d1c7dd591e",
      "name": "PIT Projekt.exe (www.pitprojekt.pl , pitprojekt.pl)  oraz  Ceidg.gov.pl - Dane publiczne wpisu",
      "description": "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4   NIP:6161230754\nhttps://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778               NIP;6112323510\nhttp://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778\n2.16.6.145146f05-9aac-4942-a42d-f2550a19c0c4              NIP:6131434311\nipv4: 2.16.6.14, 2.16.6.6, 2.16.6.1,",
      "modified": "2025-10-06T11:12:39.639000",
      "created": "2024-06-02T10:09:52.601000",
      "tags": [
        "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g",
        "prosz czeka",
        "pobierz plik",
        "wojcieszyce",
        "urls competing",
        "ceidg centralna",
        "gospodarczej",
        "wyszukiwanie",
        "przejd",
        "centrum pomocy",
        "informacja o",
        "mapa",
        "strona gwna",
        "przegldanie",
        "ceidg szybki",
        "uwagi prawne",
        "deklaracja",
        "serwer",
        "returnurl",
        "idf3ee4c4ee00",
        "id7a025cc6516",
        "wctxrm0",
        "idf3ee4c4",
        "id35146f059aa",
        "ideb8f4cf26ef",
        "id7a025cc",
        "id35146f0",
        "publicznywsz3",
        "id97c275c",
        "url wiek",
        "ssdeep",
        "sha1",
        "pehasz",
        "typlibid",
        "pit projekt",
        "chcesz",
        "pity online",
        "program",
        "interesuje ci",
        "pity zapisane",
        "jeli",
        "oddajemy w",
        "twoje rce",
        "dziki jego"
      ],
      "references": [
        "http://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=7a025cc6-5167-43cf-947f-387a3b830778",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=f3ee4c4e-e009-4d69-82da-eef3bad1ecc4",
        "https://aplikacja.ceidg.gov.pl/CEIDG/GroupMenu.aspx?key=_group_search",
        "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/SearchDetails.aspx?Id=35146f05-9aac-4942-a42d-f2550a19c0c4",
        "http://www.pitprojekt.pl",
        "http://pitprojekt.pl"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wojcieszyce",
          "display_name": "Wojcieszyce",
          "target": null
        },
        {
          "id": "Serwer",
          "display_name": "Serwer",
          "target": null
        },
        {
          "id": "Serwer A Przed\u0142u\u017cenie sesji #{text}",
          "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text}",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8271,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1259,
        "URL": 6009,
        "hostname": 3030,
        "FileHash-SHA256": 10233,
        "FileHash-MD5": 2742,
        "FileHash-SHA1": 2348,
        "email": 75,
        "SSLCertFingerprint": 11,
        "YARA": 2,
        "CVE": 13,
        "FileHash-PEHASH": 1,
        "IPv4": 34,
        "IPv6": 6
      },
      "indicator_count": 25763,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 134,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66246ff49ed29ea9bb2bf122",
      "name": "S\u0105d Rejonowy w Jeleniej Gorze  POLAND",
      "description": "Przechowywania lub dost\u0119pu do plik\u00f3w cookies w Twojej przegl\u0105darce\nhttps://www.virustotal.com/gui/domain/jelenia-gora.sr.gov.pl/relations",
      "modified": "2025-05-14T21:18:36.989000",
      "created": "2024-04-21T01:46:28.554000",
      "tags": [
        "jeleniej grze",
        "aktualnoci",
        "informacje",
        "jednostka",
        "rejonowy",
        "konkurs",
        "najczciej",
        "sd rejonowy",
        "przejd",
        "czytaj",
        "click",
        "sdzia jarosaw",
        "wydziau",
        "sdzia grzegorz",
        "katarzyna",
        "rudnicka dane",
        "kontaktowe sd",
        "jelenia gra",
        "mickiewicza",
        "zawarto",
        "html",
        "nazwa meta",
        "robotw",
        "telefon",
        "brak",
        "skala",
        "ua zgodna",
        "head body",
        "zasb",
        "cname",
        "kod odpowiedzi",
        "kodowanie treci",
        "wygasa",
        "gmt serwer",
        "pragma",
        "kontrola pamici",
        "podrcznej",
        "data",
        "gmt kontrola",
        "dostpuzezwl na",
        "czytaj wicej",
        "sd okrgowy",
        "jednostki",
        "okrgowy",
        "ogoszenia",
        "sha256",
        "vhash",
        "ssdeep",
        "https odcisk",
        "palca jarma",
        "https dane",
        "v3 numer",
        "odcisk palca",
        "tworzy katalog",
        "tworzy pliki",
        "typ pliku",
        "json",
        "ascii",
        "windows",
        "sqlite",
        "foxpro fpt",
        "links typ",
        "mapa",
        "152 x",
        "sqlite w",
        "sha1",
        "sha512",
        "file size",
        "b file",
        "testing",
        "komornik sdowy",
        "sdzie rejonowym",
        "tomasz rodacki",
        "obwieszczenie",
        "komornicze",
        "tumacza migam",
        "tumacz czynny",
        "zamknite",
        "wiadczenia",
        "schedule",
        "error",
        "javascript",
        "bakers hall",
        "ixaction",
        "script",
        "ixchatlauncher",
        "compatibility",
        "com dla",
        "t1055 pewno",
        "unikanie obrony",
        "t1036 maskarada",
        "t1082 pewno",
        "informacje o",
        "nazwa pliku",
        "dokument pdf",
        "rozmiar pliku",
        "zapowied",
        "type",
        "iii dbt",
        "utf8",
        "dziennik"
      ],
      "references": [
        "S?d Rejonowy w Jeleniej G\u00f3rze.htm",
        "II Wydzia? Karny - S?d Rejonowy w Jeleniej G\u00f3rze 1.htm",
        "http://www.jelenia-gora.so.gov.pl/",
        "https://www.jelenia-gora.so.gov.pl/",
        "http://www.jelenia-gora.sr.gov.pl/ogloszenia-komornicze",
        "https://tlumacz.migam.org/sad_rejonowy_jelenia_gora",
        "https://www.jelenia-gora.sr.gov.pl/spacer",
        "https://waf.intelix.pl/957476/Chat/Script/Compatibility"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        },
        {
          "id": "serwer",
          "display_name": "serwer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 71,
        "domain": 7651,
        "hostname": 7680,
        "IPv4": 331,
        "FileHash-SHA256": 16168,
        "URL": 10399,
        "FileHash-MD5": 3639,
        "FileHash-SHA1": 3468,
        "CIDR": 4,
        "CVE": 89,
        "YARA": 521,
        "SSLCertFingerprint": 25,
        "JA3": 1,
        "IPv6": 5813
      },
      "indicator_count": 55860,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6665c84b687c5e16b95e8f8e",
      "name": "94.152.152.223  v65023.niebieski.net  Cyber_Folks S.A.  (vgt.pl)",
      "description": "SHA1  32223ade25c4a1d39cb8ac13042e8e6dfe3ca78f ,  SHA1 \n 99987c1ee1ddb7fd113abd65c836fbb71c3da4da\n Role:  UPX , Ransomware , Trojan ,  Mirai , Buschido Mirai  antywirusowe\nWin.Trojan.VBGeneric-6735875-0 , Robak:Win32/Mofksys.RND!MTB",
      "modified": "2024-12-31T01:53:43.222000",
      "created": "2024-06-09T15:20:43.178000",
      "tags": [
        "expiration",
        "no expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "ipv4",
        "filehashsha256",
        "fh no",
        "filehashmd5",
        "https odcisk",
        "palca jarma",
        "https dane",
        "v3 numer",
        "odcisk palca",
        "pl o",
        "unizeto",
        "sa ou",
        "urzd",
        "certum cn"
      ],
      "references": [
        "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591",
        "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71",
        "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527"
      ],
      "public": 1,
      "adversary": "TrojanDownloader:Win32/Nemucod",
      "targeted_countries": [
        "Poland",
        "United States of America",
        "Germany",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce  PL",
          "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce  PL",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1027.005",
          "name": "Indicator Removal from Tools",
          "display_name": "T1027.005 - Indicator Removal from Tools"
        },
        {
          "id": "T1027.004",
          "name": "Compile After Delivery",
          "display_name": "T1027.004 - Compile After Delivery"
        },
        {
          "id": "T1027.003",
          "name": "Steganography",
          "display_name": "T1027.003 - Steganography"
        },
        {
          "id": "T1027.002",
          "name": "Software Packing",
          "display_name": "T1027.002 - Software Packing"
        },
        {
          "id": "T1027.001",
          "name": "Binary Padding",
          "display_name": "T1027.001 - Binary Padding"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.003",
          "name": "Windows Command Shell",
          "display_name": "T1059.003 - Windows Command Shell"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1553.006",
          "name": "Code Signing Policy Modification",
          "display_name": "T1553.006 - Code Signing Policy Modification"
        },
        {
          "id": "T1553.004",
          "name": "Install Root Certificate",
          "display_name": "T1553.004 - Install Root Certificate"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1055.011",
          "name": "Extra Window Memory Injection",
          "display_name": "T1055.011 - Extra Window Memory Injection"
        },
        {
          "id": "T1055.008",
          "name": "Ptrace System Calls",
          "display_name": "T1055.008 - Ptrace System Calls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1036.001",
          "name": "Invalid Code Signature",
          "display_name": "T1036.001 - Invalid Code Signature"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 3205,
        "FileHash-SHA1": 2671,
        "FileHash-SHA256": 11469,
        "SSLCertFingerprint": 6,
        "URL": 5435,
        "domain": 1356,
        "email": 55,
        "hostname": 2205,
        "CVE": 13,
        "YARA": 4,
        "CIDR": 1,
        "IPv4": 25,
        "FileHash-IMPHASH": 1,
        "BitcoinAddress": 2,
        "IPv6": 13
      },
      "indicator_count": 26461,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "474 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "664b74b2683dec84891aef96",
      "name": "PrivateLoader is a malware with a module structure that has the capability is to download and execute one or several payloads",
      "description": "http://185.172.128.69/batushka/inte.exe  \nhttp://185.172.128.69/allnewumm.exe\nhttp://185.172.128.69/brandumma.exe\nhttp://185.172.128.69/files\nhttp://185.172.128.69/files/US.file\nhttp://185.172.128.69/latestumma.exe\nhttp://185.172.128.69/newumma.exe\nhttp://185.172.128.69/sekundumma.exe\nhttp://185.172.128.69/ummanew.exe",
      "modified": "2024-10-14T20:36:05.361000",
      "created": "2024-05-20T16:05:06.313000",
      "tags": [
        "stdin via",
        "nextron",
        "powershell id",
        "powershell",
        "tim rauch",
        "elastic",
        "script block",
        "logging",
        "pe32",
        "ms windows",
        "intel",
        "nazwa typ",
        "md5 nazwa",
        "procesu"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7268,
        "domain": 1310,
        "URL": 8101,
        "FileHash-SHA1": 1615,
        "hostname": 2590,
        "FileHash-MD5": 1852,
        "email": 267,
        "SSLCertFingerprint": 3,
        "CIDR": 38,
        "CVE": 7,
        "IPv4": 15,
        "YARA": 4
      },
      "indicator_count": 23070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 135,
      "modified_text": "551 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "663d2869e0f3a42bbddc42ff",
      "name": "UPX executable packer.",
      "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
      "modified": "2024-10-14T00:01:17.069000",
      "created": "2024-05-09T19:47:53.786000",
      "tags": [
        "cioch adrian",
        "centrum usug",
        "sieciowych",
        "elf binary",
        "upx compression",
        "roth",
        "nextron",
        "info",
        "javascript",
        "html",
        "office open",
        "xml document",
        "network capture",
        "win32 exe",
        "xml pakietu",
        "pdf zestawy",
        "przechwytywanie",
        "office",
        "filehashsha1",
        "url https",
        "cve cve20201070",
        "cve cve20203153",
        "cve cve20201048",
        "cve cve20211732",
        "cve20201048 apr",
        "filehashmd5",
        "cve cve20010901",
        "cve cve20021841",
        "cve20153202 apr",
        "cve cve20160728",
        "cve cve20161807",
        "cve cve20175123",
        "cve20185407 apr",
        "cve cve20054605",
        "cve cve20060745",
        "cve cve20070452",
        "cve cve20070453",
        "cve cve20070454",
        "cve cve20071355",
        "cve cve20071358",
        "cve cve20071871",
        "cve20149614 apr",
        "cve cve20151503",
        "cve cve20152080",
        "cve cve20157377",
        "cve cve20170131",
        "cve20200796 may",
        "cve cve20113403"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6861,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 5771,
        "domain": 3139,
        "URL": 14525,
        "FileHash-SHA1": 2610,
        "IPv4": 108,
        "CIDR": 40,
        "FileHash-SHA256": 10705,
        "FileHash-MD5": 3373,
        "YARA": 2,
        "CVE": 148,
        "Mutex": 7,
        "FilePath": 3,
        "SSLCertFingerprint": 3,
        "email": 23,
        "JA3": 1,
        "IPv6": 2
      },
      "indicator_count": 40460,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "552 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://sysmex.zyxonx.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://sysmex.zyxonx.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776616645.624529
}