{ "type": "URL", "indicator": "https://test-admin.shoebillhealth.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://test-admin.shoebillhealth.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3742452588, "indicator": "https://test-admin.shoebillhealth.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 14, "pulses": [ { "id": "68596260a9ca6c4cc92ca068", "name": "Delete service | Affects Threat Research Platforms", "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com", "modified": "2025-08-20T04:13:22.641000", "created": "2025-06-23T14:19:12.328000", "tags": [ "ta0004 defense", "evasion ta0005", "command", "control ta0011", "oc0006", "get http", "resolved ips", "dns resolutions", "request", "response", "windows nt", "win64", "khtml", "gecko", "ip address", "country name", "cname", "port", "accept", "gmt ifnonematch", "url data", "icmp", "mutexes nothing", "data", "datacrashpad", "edge", "created", "nothing", "html internet", "html document", "ascii text", "gtmkvjvztk dl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2401, "URL": 5856, "FileHash-SHA256": 3473, "domain": 2188, "FileHash-MD5": 123, "FileHash-SHA1": 120, "CVE": 2 }, "indicator_count": 14163, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "243 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "687d74d0266b4805d1dfa9d2", "name": "Top Tier Spyware | There\u2019s a reason billionaires retreated to their bunkers. This is terrible.", "description": "Nothing seems real.", "modified": "2025-08-19T22:03:32.365000", "created": "2025-07-20T22:59:28.332000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 1062, "domain": 1521, "hostname": 3005, "URL": 11045 }, "indicator_count": 16639, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "243 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67da62bb520508659a5", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:09.511000", "created": "2023-12-06T16:51:09.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67567202b93ee502ff7", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:00.527000", "created": "2023-12-06T16:51:00.527000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a66d9992e6957b2d1415", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:53.855000", "created": "2023-12-06T16:50:53.855000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a667be1f5233855ae115", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:47.344000", "created": "2023-12-06T16:50:47.344000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a581b1024ea61979da96", "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)", "description": "", "modified": "2023-12-06T16:46:57.782000", "created": "2023-12-06T16:46:57.782000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 3, "FileHash-SHA256": 5791, "hostname": 3255, "domain": 2317, "FileHash-MD5": 44, "FileHash-SHA1": 34, "URL": 11513 }, "indicator_count": 22957, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a050e7d74f25c209652b", "name": "BitMapCase.exe ___ trojan.emotet/autoruns", "description": "", "modified": "2023-12-06T16:24:48.215000", "created": "2023-12-06T16:24:48.215000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1002, "hostname": 752, "domain": 392, "URL": 2568, "FileHash-MD5": 20, "FileHash-SHA1": 15, "CIDR": 5, "email": 4 }, "indicator_count": 4759, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5300c7fbb0ebe0aad3", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:51.070000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5622544406ab139161", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:53.825000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5d65c4b99d76421b48", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:09:01.502000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a60be1d9162d87c5e93", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:09:04.704000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "650a0b7c9a6b3c5d0a2a3960", "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)", "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers. Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.", "modified": "2023-10-19T14:04:37.381000", "created": "2023-09-19T20:58:36.137000", "tags": [ "contacted", "threat roundup", "execution", "ssl certificate", "dark web", "crypto threat", "resolutions", "referrer", "stealer", "quasar", "asyncrat", "error", "social engineering", "iPhone phishing", "Apple phishing", "email phishing", "emotet", "remote", "attacks" ], "references": [ "Alienvault OTX", "Data Analysis", "Online Research", "WebTools" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "India" ], "malware_families": [ { "id": "Backdoor:MSIL/AsyncRAT", "display_name": "Backdoor:MSIL/AsyncRAT", "target": "/malware/Backdoor:MSIL/AsyncRAT" }, { "id": "Backdoor:MSIL/QuasarRat", "display_name": "Backdoor:MSIL/QuasarRat", "target": "/malware/Backdoor:MSIL/QuasarRat" } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1068", "name": "Exploitation for Privilege Escalation", "display_name": "T1068 - Exploitation for Privilege Escalation" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" } ], "industries": [ "Media", "Social Media", "Technology", "Hacking" ], "TLP": "white", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 44, "FileHash-SHA1": 34, "FileHash-SHA256": 5791, "URL": 11513, "domain": 2317, "hostname": 3255, "CVE": 3 }, "indicator_count": 22957, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "914 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e101334838efce8004a4d5", "name": "BitMapCase.exe ___ trojan.emotet/autoruns", "description": "A website Auto generates emotet. I would consider this VERY malicious. Emotet is run by cyber criminals Mealybug or TA542. Began as a Banking Trojan Malware is typically spread via MalSpam. Emotet later evolving into a Bot Network. Once thought to be eradicated we saw a resurgence circa 2019. W32/Emotet CnC Checkin M2\nWin32/Emotet CnC Checkin Response\nHigh Priority\nYara Detections\nNone\nAlerts\ndead_host\nnetwork_icmp\nnolookup_communication\npersistence_autorun\nremoves_zoneid_ads\ndumped_buffer\nnetwork_cnc_http\nnetwork_http\nnetwork_http_post\nallocates_rwx\nantisandbox_foregroundwindows\ncreates_service\nmoves_self\nantivm_queries_computername\nchecks_debugger\npeid_packer\n\n (Auto Generated Description:??? Contacted IP addresses are being used to track down and identify people who are likely to be using the same IP address as those of those who have been on the receiving end of a similar service.)", "modified": "2023-09-19T09:00:03.081000", "created": "2023-08-19T17:51:47.973000", "tags": [ "ms word", "contacted ip", "ip detections", "country", "ca execution", "parents", "type name", "document", "contacted urls" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 28, "FileHash-SHA1": 24, "FileHash-SHA256": 2463, "URL": 4276, "hostname": 1296, "domain": 737, "CIDR": 5, "email": 4, "CVE": 1 }, "indicator_count": 8834, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "944 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "WebTools", "Online Research", "Alienvault OTX", "Data Analysis" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Backdoor:msil/asyncrat", "Backdoor:msil/quasarrat", "Trojan/banker.androidos.bzd" ], "industries": [ "Technology", "Hacking", "Social media", "Media" ], "unique_indicators": 67440 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/shoebillhealth.com", "whois": "http://whois.domaintools.com/shoebillhealth.com", "domain": "shoebillhealth.com", "hostname": "test-admin.shoebillhealth.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 14, "pulses": [ { "id": "68596260a9ca6c4cc92ca068", "name": "Delete service | Affects Threat Research Platforms", "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com", "modified": "2025-08-20T04:13:22.641000", "created": "2025-06-23T14:19:12.328000", "tags": [ "ta0004 defense", "evasion ta0005", "command", "control ta0011", "oc0006", "get http", "resolved ips", "dns resolutions", "request", "response", "windows nt", "win64", "khtml", "gecko", "ip address", "country name", "cname", "port", "accept", "gmt ifnonematch", "url data", "icmp", "mutexes nothing", "data", "datacrashpad", "edge", "created", "nothing", "html internet", "html document", "ascii text", "gtmkvjvztk dl" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2401, "URL": 5856, "FileHash-SHA256": 3473, "domain": 2188, "FileHash-MD5": 123, "FileHash-SHA1": 120, "CVE": 2 }, "indicator_count": 14163, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "243 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "687d74d0266b4805d1dfa9d2", "name": "Top Tier Spyware | There\u2019s a reason billionaires retreated to their bunkers. This is terrible.", "description": "Nothing seems real.", "modified": "2025-08-19T22:03:32.365000", "created": "2025-07-20T22:59:28.332000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 1062, "domain": 1521, "hostname": 3005, "URL": 11045 }, "indicator_count": 16639, "is_author": false, "is_subscribing": null, "subscriber_count": 140, "modified_text": "243 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67da62bb520508659a5", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:09.511000", "created": "2023-12-06T16:51:09.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 112, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a67567202b93ee502ff7", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:51:00.527000", "created": "2023-12-06T16:51:00.527000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a66d9992e6957b2d1415", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:53.855000", "created": "2023-12-06T16:50:53.855000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a667be1f5233855ae115", "name": "Play Ransomware", "description": "", "modified": "2023-12-06T16:50:47.344000", "created": "2023-12-06T16:50:47.344000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "hostname": 1520, "domain": 1023, "URL": 4595, "FileHash-SHA1": 43, "FileHash-MD5": 41 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a581b1024ea61979da96", "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)", "description": "", "modified": "2023-12-06T16:46:57.782000", "created": "2023-12-06T16:46:57.782000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 3, "FileHash-SHA256": 5791, "hostname": 3255, "domain": 2317, "FileHash-MD5": 44, "FileHash-SHA1": 34, "URL": 11513 }, "indicator_count": 22957, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a050e7d74f25c209652b", "name": "BitMapCase.exe ___ trojan.emotet/autoruns", "description": "", "modified": "2023-12-06T16:24:48.215000", "created": "2023-12-06T16:24:48.215000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1002, "hostname": 752, "domain": 392, "URL": 2568, "FileHash-MD5": 20, "FileHash-SHA1": 15, "CIDR": 5, "email": 4 }, "indicator_count": 4759, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "866 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5300c7fbb0ebe0aad3", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:51.070000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65133a5622544406ab139161", "name": "Play Ransomware", "description": "Malicious. Various unknown, unauthorized clouds set up on a device.", "modified": "2023-10-26T19:03:33.397000", "created": "2023-09-26T20:08:53.825000", "tags": [ "ssl certificate", "historical ssl", "referrer", "subdomains", "resolutions", "communicating", "contacted", "llwn", "threat roundup", "family", "roots", "lolkek", "tzw variants", "play ransomware", "ursnif", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Trojan/Banker.AndroidOS.bzd", "display_name": "Trojan/Banker.AndroidOS.bzd", "target": null } ], "attack_ids": [ { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1064, "FileHash-MD5": 41, "FileHash-SHA1": 43, "domain": 1023, "hostname": 1520, "URL": 4595 }, "indicator_count": 8286, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "907 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://test-admin.shoebillhealth.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://test-admin.shoebillhealth.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776718366.7678738 }