{
  "type": "URL",
  "indicator": "https://tabtale.com/t",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://tabtale.com/t",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3765718403,
      "indicator": "https://tabtale.com/t",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "689b9b9fab42ca4f016a226f",
          "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
          "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
          "modified": "2025-09-11T13:03:18.814000",
          "created": "2025-08-12T19:53:03.953000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "href",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "unknown ns",
            "ip address",
            "creation date",
            "search",
            "present sep",
            "moved",
            "domain add",
            "encrypt",
            "accept",
            "please",
            "passive dns",
            "msie",
            "next associated",
            "html",
            "background",
            "unknown site",
            "div div",
            "trojan",
            "zeus",
            "process32nextw",
            "read c",
            "show",
            "shellexecuteexw",
            "windows nt",
            "wow64",
            "copy",
            "dock",
            "write",
            "malware",
            "unknown",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "august",
            "hybrid",
            "port",
            "destination",
            "tlsv1",
            "as15169",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "persistence",
            "data upload",
            "extraction",
            "win32",
            "ransom",
            "trojandropper",
            "mtb nov",
            "forcud",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4179,
            "domain": 774,
            "hostname": 1673,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 2073,
            "email": 1,
            "SSLCertFingerprint": 13,
            "CVE": 1
          },
          "indicator_count": 8993,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7fc464f9f56ac33a389",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:32.030000",
          "created": "2023-12-06T16:57:32.030000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7e7daf278491d9f9eb4",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:11.228000",
          "created": "2023-12-06T16:57:11.228000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652044fb2f28d46e91d29160",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:33:47.403000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65204565ac1e8bce4de26df3",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:35:33.618000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1df9a7da086561b9897f",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-30T03:07:37.963000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65204565ac1e8bce4de26df3",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8",
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tulach"
          ],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 31948
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/tabtale.com",
    "whois": "http://whois.domaintools.com/tabtale.com",
    "domain": "tabtale.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "689b9b9fab42ca4f016a226f",
      "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
      "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
      "modified": "2025-09-11T13:03:18.814000",
      "created": "2025-08-12T19:53:03.953000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "href",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "unknown ns",
        "ip address",
        "creation date",
        "search",
        "present sep",
        "moved",
        "domain add",
        "encrypt",
        "accept",
        "please",
        "passive dns",
        "msie",
        "next associated",
        "html",
        "background",
        "unknown site",
        "div div",
        "trojan",
        "zeus",
        "process32nextw",
        "read c",
        "show",
        "shellexecuteexw",
        "windows nt",
        "wow64",
        "copy",
        "dock",
        "write",
        "malware",
        "unknown",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "august",
        "hybrid",
        "port",
        "destination",
        "tlsv1",
        "as15169",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "persistence",
        "data upload",
        "extraction",
        "win32",
        "ransom",
        "trojandropper",
        "mtb nov",
        "forcud",
        "files show",
        "date hash",
        "avast avg"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4179,
        "domain": 774,
        "hostname": 1673,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 110,
        "FileHash-SHA256": 2073,
        "email": 1,
        "SSLCertFingerprint": 13,
        "CVE": 1
      },
      "indicator_count": 8993,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7fc464f9f56ac33a389",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:32.030000",
      "created": "2023-12-06T16:57:32.030000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7e7daf278491d9f9eb4",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:11.228000",
      "created": "2023-12-06T16:57:11.228000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652044fb2f28d46e91d29160",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:33:47.403000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65204565ac1e8bce4de26df3",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:35:33.618000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f1df9a7da086561b9897f",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-30T03:07:37.963000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65204565ac1e8bce4de26df3",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://tabtale.com/t",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://tabtale.com/t",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638987.6879756
}