{ "type": "URL", "indicator": "https://t.l.call/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://t.l.call/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3603287372, "indicator": "https://t.l.call/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 21, "pulses": [ { "id": "69c1bd40f81db45dc044697c", "name": "Masterkey Clone By CallmeDoris", "description": "", "modified": "2026-03-23T22:22:56.940000", "created": "2026-03-23T22:22:56.940000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "642db7b656049e54b2f71c20", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a384e3e8573cf5ecac4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-12-06T15:58:48.938000", "created": "2023-12-06T15:58:48.938000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1569, "URL": 3824, "email": 8, "domain": 290, "hostname": 189, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6508, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a271fd1e3c22cf63f86", "name": "iCloud - cant access due to insecure conx - yes everything here is compromised via chaining, neural ai and accessibilty kit emulated via android", "description": "", "modified": "2023-12-06T15:58:31.832000", "created": "2023-12-06T15:58:31.832000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 705, "domain": 302, "FileHash-SHA256": 840, "URL": 2603, "email": 2, "FileHash-MD5": 51, "FileHash-SHA1": 51 }, "indicator_count": 4554, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709929c16e0817dea8f7ff", "name": "https://www.microsoft.com/en-US/servicesagreement/upcoming-faq.aspx", "description": "", "modified": "2023-12-06T15:54:17.119000", "created": "2023-12-06T15:54:17.119000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 963, "domain": 255, "hostname": 730, "URL": 2400, "FileHash-MD5": 50, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 4449, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099064c0c0aa442282397", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-12-06T15:53:42.077000", "created": "2023-12-06T15:53:42.077000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1040, "domain": 293, "FileHash-MD5": 58, "FileHash-SHA1": 56, "hostname": 809, "URL": 2661, "email": 1 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098ff4c59f8ac3f86f613", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "", "modified": "2023-12-06T15:53:35.032000", "created": "2023-12-06T15:53:35.032000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1168, "hostname": 1366, "domain": 412, "URL": 3576, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653d41d95fceb536fa8b3bae", "name": "https://www.npmjs.com/", "description": "Github critical bounty", "modified": "2023-11-27T19:03:33.482000", "created": "2023-10-28T17:16:09.274000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 902, "domain": 448, "hostname": 378, "FileHash-SHA256": 6821, "FileHash-MD5": 1308, "FileHash-SHA1": 1270, "CVE": 2, "email": 4 }, "indicator_count": 11133, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "874 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1d947db1f44d13bf9982", "name": " Malicious Google - Sign in? https://accounts.google.com/speedbump", "description": "", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-30T03:05:56.431000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6535ef14a479ec0ed4c895b4", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6535ef14a479ec0ed4c895b4", "name": "Malicious Google - Sign in? https://accounts.google.com/speedbump/changepassword", "description": "Is account part of Botnet. I witnessed; login needs to be reset, logged out [get this 'https://accounts.google.com/speedbump/changepassword' read browser bar when looks suspect, log in to a Google interface, titled Google Account, font is different. Says this device logged in for the first time 10/19/2023. Untrue. Implicated someone had password and Google critical security alert email.\nI haven't had enough time to research. Hostile bruteforce account login.? Complete CNC on Google email accounts.", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-23T03:57:08.696000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645932281e34157197d4cbe4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-05-08T17:32:24.648000", "created": "2023-05-08T17:32:24.648000", "tags": [ "dropped file", "null", "varchar", "gecko", "pcap", "pcap processing", "win64", "khtml", "span", "cookie", "path", "mozi", "roboto", "class", "mozilla", "body", "form", "window", "accept", "meta", "iframe", "contact", "4629", "trim", "embed", "dwis", "test", "tear", "qakbot", "tecv", "1inb", "a3ob", "u9p10dkhttps", "windir", "openurl c", "l10dkhttps", "charset", "w6t2hm", "is6bi" ], "references": [ "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3824, "hostname": 189, "domain": 290, "FileHash-SHA256": 1569, "email": 8, "IPv4": 27, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6535, "is_author": false, "is_subscribing": null, "subscriber_count": 95, "modified_text": "1077 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6457df59f333c9e3027ac390", "name": "iCloud - cant access due to insecure conx - yes everything here is compromised via chaining, neural ai and accessibilty kit emulated via android", "description": "thisi s from scan 25 april 2023 \nlets compare to 2020", "modified": "2023-05-07T17:36:13.269000", "created": "2023-05-07T17:26:49.285000", "tags": [ "chromeua", "optout", "windir", "prefetch8 ansi", "fatalerror", "facebook", "meta", "unknown", "suspicious", "null", "body", "black", "iframe", "media", "qakbot", "icloud", "apple" ], "references": [ "https://www.icloud.com", "https://www.hybrid-analysis.com/sample/d3ffdf44916b01e14fceca04c3a3beb5fbad5aeea482e2242c5a843793073874/6447a07b59116aba3303e517" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2603, "hostname": 705, "domain": 302, "FileHash-SHA256": 840, "email": 2, "IPv4": 10, "FileHash-MD5": 51, "FileHash-SHA1": 51 }, "indicator_count": 4564, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1078 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642fbeba84c7b4cbee43200a", "name": "https://www.microsoft.com/en-US/servicesagreement/upcoming-faq.aspx", "description": "", "modified": "2023-05-07T00:00:36.624000", "created": "2023-04-07T06:56:58.157000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "chromeua", "ansi", "dropped file", "optout", "runtime data", "object", "drmedgeua", "optin", "edgeua", "unicode", "span", "error", "generator", "void", "august", "body", "path", "close", "format", "template", "suspicious", "unknown", "critical", "addressbar", "desktop", "dark", "light", "meta", "chat", "this", "small", "june", "footer", "window", "legend", "hybrid", "click", "null", "april", "general", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/9318798ecf1cf2d52d10ec99e821454ff81196ced4cb4337dcab41b79dcca0ec/642ecd01f0ad4977b40ce225" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2400, "hostname": 730, "domain": 255, "FileHash-SHA256": 963, "email": 1, "FileHash-MD5": 50, "FileHash-SHA1": 50 }, "indicator_count": 4449, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1078 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "642db7b656049e54b2f71c20", "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100", "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness", "modified": "2023-05-05T16:00:23.366000", "created": "2023-04-05T18:02:30.403000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1080 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6428649b535c12c6f8d60b0b", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-05-01T15:05:10.466000", "created": "2023-04-01T17:06:35.022000", "tags": [ "chromeua", "ansi", "dropped file", "optout", "runtime data", "object", "drmedgeua", "optin", "edgeua", "unicode", "span", "error", "generator", "void", "path", "null", "entropy", "click", "template", "date", "unknown", "critical", "addressbar", "desktop", "dark", "light", "quicksearch", "this", "suspicious", "window", "legend", "hybrid", "hosts", "next", "main", "refresh", "hello", "voice", "malicious", "strings", "qakbot" ], "references": [ "https://hybrid-analysis.com/sample/45e147babe00d1834af72b2139dbc65043ee50cb09d1d4e470f9bd48ad50c6bf/64283fca3a07828f100b2551" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2661, "hostname": 809, "domain": 293, "FileHash-SHA256": 1040, "email": 1, "FileHash-MD5": 58, "FileHash-SHA1": 56 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1084 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6426181ff6ddb7ccafbfac76", "name": "v2 - front.viewinter.ai - plus all suggested ioc's", "description": "", "modified": "2023-04-29T23:04:49.088000", "created": "2023-03-30T23:15:43.500000", "tags": [], "references": [ "f_00023a .js - 225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053", "f_000243 .js - 312571a21f35168fbed9342d755e5df0a56a053c75bd58c6aa837351f28aa0f5", "https://hybrid-analysis.com/sample/cb3eb59660aaf4566fc75ec8d4088942fcfd40b6a65e4832cf619ba4c56b5f15", "https://hybrid-analysis.com/sample/225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053", "https://hybrid-analysis.com/sample/225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053/6421e770b2b593f60c066418", "Part RU .js - daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 641, "domain": 68, "hostname": 118, "FileHash-SHA256": 46, "FileHash-MD5": 7, "FileHash-SHA1": 2 }, "indicator_count": 882, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1086 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6425a2f9c155fd53b9922bcd", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "hope peeps are gona learn from 3cx that false positives are in fact often not false", "modified": "2023-04-29T13:05:05.409000", "created": "2023-03-30T14:55:53.652000", "tags": [ "trojan", "apt", "ansi", "dropped file", "runtime data", "chromeua", "optout", "programfiles", "typeof e", "localappdata", "error", "date", "generator", "path", "null", "void", "win64", "twitter", "this", "critical", "desktop", "dark", "light", "meta", "roboto", "span", "class", "template", "blink", "suspicious", "facebook", "mexico", "malicious", "mozilla", "strings", "qakbot", "://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00" ], "references": [ "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661", "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 412, "FileHash-SHA256": 1168, "URL": 3576, "hostname": 1366, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1086 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6426dda295502d82e6e6ef7f", "name": "v4 - Hybrid scan uploaded + all suggested ioc's - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code", "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.", "modified": "2023-03-31T13:18:26.733000", "created": "2023-03-31T13:18:26.733000", "tags": [ "trojan", "apt", "ansi", "memoryfile scan", "error", "runtime data", "typeof e", "regexp", "array", "object", "typeof t", "void", "null", "unknown", "path", "facebook", "4096", "suspicious", "meta", "lazy", "entity", "union", "body", "idkey", "scroll", "backspace", "insert", "roboto", "target", "stack", "hybrid", "model", "click", "stream", "strings", "qakbot", "pattern match", "ud801", "ud804", "ud805", "ud806", "ud81a", "ud835", "ud800", "ud802", "sha1", "sha256", "vendor.3a0e728a.js" ], "references": [ "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1353, "hostname": 222, "domain": 221, "FileHash-SHA256": 85, "FileHash-MD5": 3, "FileHash-SHA1": 1 }, "indicator_count": 1885, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1115 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63ed8628367c1a4f3f8e773a", "name": "just a load of errors on edge watching twitch", "description": "load of unknown user pics, but that could just be a twitch thing", "modified": "2023-03-18T00:05:45.328000", "created": "2023-02-16T01:26:00.959000", "tags": [ "object", "typeerror", "typeof symbol", "error", "typeof t", "array", "string", "typeof e", "typeof n", "referenceerror", "date", "body", "null", "local", "generator", "class", "typeof tcfapi", "tcfapi", "daten", "image", "typeof comscore", "true", "regexp", "config", "nolbundle", "novmsjs", "nlssdk", "retry request", "nolsdkbundle", "typeof o", "bsdk check", "optout", "basever", "lsid", "qqfunction", "nielsen log", "info", "stop", "logger", "android", "donate", "ukraine relief", "requestbuilder", "slotbuilder", "uint8array", "nthis", "promise", "symbol", "fullscreen", "adload", "false", "facebook", "unknown", "meta", "direct", "this", "close", "locale", "model", "survey", "companion", "scroll", "backspace", "insert", "infinity", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "runtime data", "ansi", "path", "hybrid analysis", "api call", "registry access", "function", "calls", "window", "hybrid", "general", "click", "ransomware", "february", "strings", "suspicious", "irequestslot", "islotbuilder", "amazonerrorcode", "errortype", "adunit", "conflict", "please" ], "references": [ "https://hybrid-analysis.com/sample/5da0de230eb98e5598b152944d0e7e6b355485484052df6c7f1c747e2c5564c0/63ed708125f47738b45a6520", "webpack buildin global.js", "SlotBuilder.ts", "P34D56F9D-5684-4C83-8EE1-5EA7DE9CF45D.js", "apstag.js", "nlsSDK600.bundle.min.js", "v6s.js", "https://sb.scorecardresearch.com/p?c1=2&c2=6745306&ns_type=hidden&ns_st_sv=5.1.3.160420&ns_st_smv=5.1&ns_st_it=r&ns_st_id=1676508021004&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=1560430&ns_st_cl=0&ns_st_hc=31&ns_st_mp=js_api&ns_st_mv=5.1.3.160420&ns_st_pn=1&ns_st_tp=0&ns_st_ci=47976339133&ns_st_pt=1560430&ns_st_dpt=360423&ns_st_ipt=60010&ns_st_et=1560430&ns_st_det=360423&ns_st_upc=1560430&ns_st_dupc=360423&ns_st_iupc=60010&ns_st_upa=15604", "https://sb.scorecardresearch.com/p?ax_uuid=d247c6142f285bb0488533aa7f2d53c5&c1=9&c2=31864766&ns__t=1676508027511&ns_c=UTF-8&cv=3.1&c8=SecurityWeekly%20-%20Twitch&c7=https%3A%2F%2Fwww.twitch.tv%2Fsecurityweekly&c9=", "https://hybrid-analysis.com/sample/b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b/", "beacon.js", "https://static-cdn.jtvnw.net/jtv_user_pictures/6f4129f6-3750-4c02-b7c8-c88a05064129-profile_image-70x70.png" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SlotBuilder", "display_name": "SlotBuilder", "target": null }, { "id": "RequestBuilder", "display_name": "RequestBuilder", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1353, "hostname": 363, "domain": 201, "FileHash-SHA256": 203, "FileHash-MD5": 9, "FileHash-SHA1": 3 }, "indicator_count": 2132, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1128 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63ed86228ecb2b03d35b046f", "name": "just a load of errors on edge watching twitch", "description": "load of unknown user pics, but that could just be a twitch thing", "modified": "2023-03-18T00:05:45.328000", "created": "2023-02-16T01:25:54.305000", "tags": [ "object", "typeerror", "typeof symbol", "error", "typeof t", "array", "string", "typeof e", "typeof n", "referenceerror", "date", "body", "null", "local", "generator", "class", "typeof tcfapi", "tcfapi", "daten", "image", "typeof comscore", "true", "regexp", "config", "nolbundle", "novmsjs", "nlssdk", "retry request", "nolsdkbundle", "typeof o", "bsdk check", "optout", "basever", "lsid", "qqfunction", "nielsen log", "info", "stop", "logger", "android", "donate", "ukraine relief", "requestbuilder", "slotbuilder", "uint8array", "nthis", "promise", "symbol", "fullscreen", "adload", "false", "facebook", "unknown", "meta", "direct", "this", "close", "locale", "model", "survey", "companion", "scroll", "backspace", "insert", "infinity", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "runtime data", "ansi", "path", "hybrid analysis", "api call", "registry access", "function", "calls", "window", "hybrid", "general", "click", "ransomware", "february", "strings", "suspicious", "irequestslot", "islotbuilder", "amazonerrorcode", "errortype", "adunit", "conflict", "please" ], "references": [ "https://hybrid-analysis.com/sample/5da0de230eb98e5598b152944d0e7e6b355485484052df6c7f1c747e2c5564c0/63ed708125f47738b45a6520", "webpack buildin global.js", "SlotBuilder.ts", "P34D56F9D-5684-4C83-8EE1-5EA7DE9CF45D.js", "apstag.js", "nlsSDK600.bundle.min.js", "v6s.js", "https://sb.scorecardresearch.com/p?c1=2&c2=6745306&ns_type=hidden&ns_st_sv=5.1.3.160420&ns_st_smv=5.1&ns_st_it=r&ns_st_id=1676508021004&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=1560430&ns_st_cl=0&ns_st_hc=31&ns_st_mp=js_api&ns_st_mv=5.1.3.160420&ns_st_pn=1&ns_st_tp=0&ns_st_ci=47976339133&ns_st_pt=1560430&ns_st_dpt=360423&ns_st_ipt=60010&ns_st_et=1560430&ns_st_det=360423&ns_st_upc=1560430&ns_st_dupc=360423&ns_st_iupc=60010&ns_st_upa=15604", "https://sb.scorecardresearch.com/p?ax_uuid=d247c6142f285bb0488533aa7f2d53c5&c1=9&c2=31864766&ns__t=1676508027511&ns_c=UTF-8&cv=3.1&c8=SecurityWeekly%20-%20Twitch&c7=https%3A%2F%2Fwww.twitch.tv%2Fsecurityweekly&c9=", "https://hybrid-analysis.com/sample/b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b/", "beacon.js", "https://static-cdn.jtvnw.net/jtv_user_pictures/6f4129f6-3750-4c02-b7c8-c88a05064129-profile_image-70x70.png" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SlotBuilder", "display_name": "SlotBuilder", "target": null }, { "id": "RequestBuilder", "display_name": "RequestBuilder", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1353, "hostname": 363, "domain": 201, "FileHash-SHA256": 203, "FileHash-MD5": 9, "FileHash-SHA1": 3 }, "indicator_count": 2132, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1128 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63f536f3d17c09ae380da074", "name": "webcomponents-sd-ce-pf_1_.js", "description": "", "modified": "2023-02-21T21:26:11.748000", "created": "2023-02-21T21:26:11.748000", "tags": [ "memoryfile scan", "typeerror", "null", "polymer project", "trident", "generator", "void", "webcomponents-sd-ce-pf_1_.js", "f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b", "c.insertbefore.call" ], "references": [ "https://hybrid-analysis.com/sample/f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b/63f299f3c79eb479f661e947", "c.insertbefore.call - fail" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 723, "FileHash-SHA256": 39, "hostname": 171, "domain": 91, "FileHash-MD5": 5, "FileHash-SHA1": 1 }, "indicator_count": 1030, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1153 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63a3b9aaaca8891186e6f7a2", "name": "vt errors on edge 21 dec 2022", "description": "var n-i,n-n, r.test, is a new type of webpack, which uses a set of rules to store data in the form of a single address, or code.", "modified": "2023-01-21T00:01:41.590000", "created": "2022-12-22T01:58:02.495000", "tags": [ "eaca", "eace", "iaca", "iace", "boolean", "object", "path", "aacf", "customevent", "string", "span", "error", "code", "virustotal", "date", "null", "contact", "blank", "close", "twitter", "unknown", "download", "this", "easy", "desktop", "body", "requires", "footer", "refresh", "patch", "write", "cobalt strike", "shell", "zero", "harmless", "main", "aalfe", "getclass", "copy", "iframe", "divi", "roboto", "insert", "template", "class", "void", "form", "back", "ransomware", "trace", "comment", "tools", "premium", "bufferwriter", "bufferreader", "array", "typeerror", "vtuibutton", "number", "typeof o", "urls", "please", "javascript", "https://www.virustotal.com/gui/vt-ui-sw-installer.e0eb1a1e08d651", "https://www.virustotal.com/gui/main.900e36f7a852b9863014.js" ], "references": [ "https://www.virustotal.com/gui/vt-ui-sw-installer.e0eb1a1e08d6512ba355.js/ Depreciated", "https://www.virustotal.com/gui/main.900e36f7a852b9863014.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "BufferReader", "display_name": "BufferReader", "target": null }, { "id": "BufferWriter", "display_name": "BufferWriter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1051, "FileHash-SHA256": 204, "hostname": 275, "domain": 212, "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1745, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1184 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.virustotal.com/gui/vt-ui-sw-installer.e0eb1a1e08d6512ba355.js/ Depreciated", "https://sb.scorecardresearch.com/p?c1=2&c2=6745306&ns_type=hidden&ns_st_sv=5.1.3.160420&ns_st_smv=5.1&ns_st_it=r&ns_st_id=1676508021004&ns_st_ec=3&ns_st_sp=1&ns_st_sc=1&ns_st_sq=1&ns_st_ppc=1&ns_st_apc=1&ns_st_spc=1&ns_st_cn=1&ns_st_ev=hb&ns_st_po=1560430&ns_st_cl=0&ns_st_hc=31&ns_st_mp=js_api&ns_st_mv=5.1.3.160420&ns_st_pn=1&ns_st_tp=0&ns_st_ci=47976339133&ns_st_pt=1560430&ns_st_dpt=360423&ns_st_ipt=60010&ns_st_et=1560430&ns_st_det=360423&ns_st_upc=1560430&ns_st_dupc=360423&ns_st_iupc=60010&ns_st_upa=15604", "https://www.icloud.com", "https://hybrid-analysis.com/sample/45e147babe00d1834af72b2139dbc65043ee50cb09d1d4e470f9bd48ad50c6bf/64283fca3a07828f100b2551", "webpack buildin global.js", "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381", "https://hybrid-analysis.com/sample/5da0de230eb98e5598b152944d0e7e6b355485484052df6c7f1c747e2c5564c0/63ed708125f47738b45a6520", "f_00023a .js - 225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053", "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9", "https://sb.scorecardresearch.com/p?ax_uuid=d247c6142f285bb0488533aa7f2d53c5&c1=9&c2=31864766&ns__t=1676508027511&ns_c=UTF-8&cv=3.1&c8=SecurityWeekly%20-%20Twitch&c7=https%3A%2F%2Fwww.twitch.tv%2Fsecurityweekly&c9=", "nlsSDK600.bundle.min.js", "https://hybrid-analysis.com/sample/b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b/", "P34D56F9D-5684-4C83-8EE1-5EA7DE9CF45D.js", "https://www.virustotal.com/gui/main.900e36f7a852b9863014.js", "v6s.js", "http://web.basemark.com/result/?4A3D0fmu%1C%00%00%00B%00a%00s%00e%00m%00a%00r%00k", "https://hybrid-analysis.com/sample/225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053/6421e770b2b593f60c066418", "f_000243 .js - 312571a21f35168fbed9342d755e5df0a56a053c75bd58c6aa837351f28aa0f5", "beacon.js", "https://static-cdn.jtvnw.net/jtv_user_pictures/6f4129f6-3750-4c02-b7c8-c88a05064129-profile_image-70x70.png", "https://hybrid-analysis.com/sample/cb3eb59660aaf4566fc75ec8d4088942fcfd40b6a65e4832cf619ba4c56b5f15", "https://www.hybrid-analysis.com/sample/d3ffdf44916b01e14fceca04c3a3beb5fbad5aeea482e2242c5a843793073874/6447a07b59116aba3303e517", "https://hybrid-analysis.com/sample/225016fbe7412fd92296fc35ad54fd9a58a1b747cc6d5c66dd5abb299559b053", "https://hybrid-analysis.com/sample/e7740c893812cea8e34ffb04331dcc45762dec73def71929bfbabcbfb22e93e9/641e30763dcad56bc2075661", "https://hybrid-analysis.com/sample/9318798ecf1cf2d52d10ec99e821454ff81196ced4cb4337dcab41b79dcca0ec/642ecd01f0ad4977b40ce225", "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c", "apstag.js", "https://hybrid-analysis.com/sample/f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b/63f299f3c79eb479f661e947", "c.insertbefore.call - fail", "SlotBuilder.ts", "Part RU .js - daa8547f1dbc8c994eed3725f3076aaf6c4e298b963fb712e53eb0fa2dc1e789" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Requestbuilder", "Slotbuilder", "Bufferwriter", "Bufferreader" ], "industries": [], "unique_indicators": 34245 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/l.call", "whois": "http://whois.domaintools.com/l.call", "domain": "l.call", "hostname": "t.l.call" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 21, "pulses": [ { "id": "69c1bd40f81db45dc044697c", "name": "Masterkey Clone By CallmeDoris", "description": "", "modified": "2026-03-23T22:22:56.940000", "created": "2026-03-23T22:22:56.940000", "tags": [ "dropped file", "chromeua", "runtime data", "drmedgeua", "edgeua", "generator", "win64", "null", "template", "unknown", "critical", "addressbar", "desktop", "dark", "light", "iframe", "cookie", "meta", "body", "legend", "dwis", "core", "tear", "malicious", "mozilla", "strings", "qakbot", "://masterkey.com.ua/download/MKClientSetup.exe" ], "references": [ "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "642db7b656049e54b2f71c20", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 949, "URL": 5642, "CVE": 2, "domain": 509, "FileHash-SHA256": 293, "FileHash-MD5": 550, "FileHash-SHA1": 60, "email": 5 }, "indicator_count": 8010, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a384e3e8573cf5ecac4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-12-06T15:58:48.938000", "created": "2023-12-06T15:58:48.938000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1569, "URL": 3824, "email": 8, "domain": 290, "hostname": 189, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6508, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709a271fd1e3c22cf63f86", "name": "iCloud - cant access due to insecure conx - yes everything here is compromised via chaining, neural ai and accessibilty kit emulated via android", "description": "", "modified": "2023-12-06T15:58:31.832000", "created": "2023-12-06T15:58:31.832000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 705, "domain": 302, "FileHash-SHA256": 840, "URL": 2603, "email": 2, "FileHash-MD5": 51, "FileHash-SHA1": 51 }, "indicator_count": 4554, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709929c16e0817dea8f7ff", "name": "https://www.microsoft.com/en-US/servicesagreement/upcoming-faq.aspx", "description": "", "modified": "2023-12-06T15:54:17.119000", "created": "2023-12-06T15:54:17.119000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 963, "domain": 255, "hostname": 730, "URL": 2400, "FileHash-MD5": 50, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 4449, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657099064c0c0aa442282397", "name": "http://www.xiazai99.com/down/soft9106.html", "description": "", "modified": "2023-12-06T15:53:42.077000", "created": "2023-12-06T15:53:42.077000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1040, "domain": 293, "FileHash-MD5": 58, "FileHash-SHA1": 56, "hostname": 809, "URL": 2661, "email": 1 }, "indicator_count": 4918, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657098ff4c59f8ac3f86f613", "name": "v2 of web.basemark.com plus all suggested ioc,s dont forget about the dropped js files from the 2nd hybrid link", "description": "", "modified": "2023-12-06T15:53:35.032000", "created": "2023-12-06T15:53:35.032000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1168, "hostname": 1366, "domain": 412, "URL": 3576, "email": 2, "FileHash-MD5": 61, "FileHash-SHA1": 54 }, "indicator_count": 6639, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653d41d95fceb536fa8b3bae", "name": "https://www.npmjs.com/", "description": "Github critical bounty", "modified": "2023-11-27T19:03:33.482000", "created": "2023-10-28T17:16:09.274000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 902, "domain": 448, "hostname": 378, "FileHash-SHA256": 6821, "FileHash-MD5": 1308, "FileHash-SHA1": 1270, "CVE": 2, "email": 4 }, "indicator_count": 11133, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "874 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1d947db1f44d13bf9982", "name": " Malicious Google - Sign in? https://accounts.google.com/speedbump", "description": "", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-30T03:05:56.431000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6535ef14a479ec0ed4c895b4", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6535ef14a479ec0ed4c895b4", "name": "Malicious Google - Sign in? https://accounts.google.com/speedbump/changepassword", "description": "Is account part of Botnet. I witnessed; login needs to be reset, logged out [get this 'https://accounts.google.com/speedbump/changepassword' read browser bar when looks suspect, log in to a Google interface, titled Google Account, font is different. Says this device logged in for the first time 10/19/2023. Untrue. Implicated someone had password and Google critical security alert email.\nI haven't had enough time to research. Hostile bruteforce account login.? Complete CNC on Google email accounts.", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-23T03:57:08.696000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "645932281e34157197d4cbe4", "name": "v2 - kopat electronic door security with hybrid scan data", "description": "", "modified": "2023-05-08T17:32:24.648000", "created": "2023-05-08T17:32:24.648000", "tags": [ "dropped file", "null", "varchar", "gecko", "pcap", "pcap processing", "win64", "khtml", "span", "cookie", "path", "mozi", "roboto", "class", "mozilla", "body", "form", "window", "accept", "meta", "iframe", "contact", "4629", "trim", "embed", "dwis", "test", "tear", "qakbot", "tecv", "1inb", "a3ob", "u9p10dkhttps", "windir", "openurl c", "l10dkhttps", "charset", "w6t2hm", "is6bi" ], "references": [ "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3824, "hostname": 189, "domain": 290, "FileHash-SHA256": 1569, "email": 8, "IPv4": 27, "FileHash-MD5": 576, "FileHash-SHA1": 52 }, "indicator_count": 6535, "is_author": false, "is_subscribing": null, "subscriber_count": 95, "modified_text": "1077 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://t.l.call/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://t.l.call/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776642239.7161987 }