{
  "type": "URL",
  "indicator": "https://test.tweakbit.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://test.tweakbit.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3857458392,
      "indicator": "https://test.tweakbit.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "66d8c7ca53cccd3b3190a603",
          "name": "Certs (2 Graphs, 1 Pulse; enriched).",
          "description": "Here is the full list of certs:  \u00c2\u00a31.5m.zip, which were released on the same day as the opening of the Windows 2003 operating system on 22 July 2004.\n2 graphs become 1:\nCopy of vgt.pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6 (More Certs[.]zip)\nCopy of Copy of globalsign.com // 104.18.21.226 // Cloudflare - 09.04.24",
          "modified": "2024-10-04T20:00:57.639000",
          "created": "2024-09-04T20:49:14.979000",
          "tags": [
            "networkwifi",
            "versioncode5",
            "sdkversion3613",
            "1996",
            "entity",
            "triage",
            "malware",
            "analysis",
            "report",
            "reported",
            "analyze",
            "sandbox",
            "score",
            "resource",
            "sha512",
            "size",
            "sha256",
            "affirmtrus",
            "sha1",
            "ac raiz",
            "sample ac",
            "10 discovery",
            "general",
            "target",
            "config",
            "copy",
            "sample digicert",
            "assured id",
            "global root",
            "target digicert",
            "academic",
            "hellenic a",
            "sample hellenic",
            "rootca",
            "10 blocklisted",
            "ck v13",
            "sample",
            "root ca",
            "sample emsign",
            "starfield",
            "authority",
            "security c",
            "swisssign",
            "class"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/g0d379c712b7f4a9eb508d3a99b321893d01dea728ea14fcb889a04dfe05f5f6b?theme=dark",
            "https://www.virustotal.com/graph/embed/g7a71a4d796b548dea709d925ba2f612b75b944e6e27849b4b0baee3764a972bc?theme=dark",
            "https://tria.ge/240830-vvtvmsvhlg",
            "https://tria.ge/240830-vywteawape",
            "https://tria.ge/240830-v2wykswbrf",
            "https://tria.ge/240830-wkhv3axbkh",
            "https://tria.ge/240830-v7p28axcnp",
            "https://tria.ge/240830-v5fe1awcrh",
            "https://viz.greynoise.io/analysis/93e7b998-55e5-4da9-88dd-11d6217d0fe2",
            "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723",
            "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/community",
            "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/iocs",
            "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 267,
            "FileHash-SHA1": 266,
            "FileHash-SHA256": 1311,
            "URL": 305,
            "domain": 75,
            "hostname": 243
          },
          "indicator_count": 2467,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "562 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d4c1b250f6582414e87c7c",
          "name": "Compromised CA? -> Copy of vgt.pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6",
          "description": "Mashup of Skocherhans vgt[.]pl graph mashed up with a set of mal security certs on hand\nCopy of vgt[.]pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6 (More Certs[.]zip)\nFrom VirusTotal Graphs - 09.01.24",
          "modified": "2024-10-01T20:01:33.620000",
          "created": "2024-09-01T19:34:10.807000",
          "tags": [
            "entity",
            "Certificates",
            "MalCerts"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/g0d379c712b7f4a9eb508d3a99b321893d01dea728ea14fcb889a04dfe05f5f6b?theme=dark",
            "https://viz.greynoise.io/analysis/a1ebb5ca-0985-43db-a8e4-83673134a813",
            "https://viz.greynoise.io/query/AS8075"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 394,
            "FileHash-SHA1": 392,
            "FileHash-SHA256": 3426,
            "URL": 327,
            "domain": 315,
            "hostname": 264,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 5121,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "565 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f55ed2015e05ffbc2b72a8",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-16T08:56:50.387000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980471600645142bcd924",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-19T12:08:39.100000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65f55ed2015e05ffbc2b72a8",
          "export_count": 186972,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "newrelic.se",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "https://viz.greynoise.io/query/AS8075",
        "https://tria.ge/240830-vywteawape",
        "https://viz.greynoise.io/analysis/a1ebb5ca-0985-43db-a8e4-83673134a813",
        "Ryuk: kramtechnology.com",
        "https://api.wavebrowserbase.com",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723",
        "https://tria.ge/240830-v7p28axcnp",
        "Ransom: message.htm.com",
        "https://tria.ge/240830-wkhv3axbkh",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/iocs",
        "https://tria.ge/240830-vvtvmsvhlg",
        "https://tria.ge/240830-v2wykswbrf",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "https://www.virustotal.com/graph/embed/g0d379c712b7f4a9eb508d3a99b321893d01dea728ea14fcb889a04dfe05f5f6b?theme=dark",
        "https://tria.ge/240830-v5fe1awcrh",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/graph",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/community",
        "https://www.virustotal.com/graph/embed/g7a71a4d796b548dea709d925ba2f612b75b944e6e27849b4b0baee3764a972bc?theme=dark",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "https://viz.greynoise.io/analysis/93e7b998-55e5-4da9-88dd-11d6217d0fe2",
        "Botnet Server IP: 141.226.230.48",
        "Ryuk: http://kramtechnology.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Maltiverse",
            "Cl0p",
            "Generic"
          ],
          "industries": [
            "Telecommunications",
            "Government",
            "Technology",
            "Education"
          ],
          "unique_indicators": 23582
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/tweakbit.com",
    "whois": "http://whois.domaintools.com/tweakbit.com",
    "domain": "tweakbit.com",
    "hostname": "test.tweakbit.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "66d8c7ca53cccd3b3190a603",
      "name": "Certs (2 Graphs, 1 Pulse; enriched).",
      "description": "Here is the full list of certs:  \u00c2\u00a31.5m.zip, which were released on the same day as the opening of the Windows 2003 operating system on 22 July 2004.\n2 graphs become 1:\nCopy of vgt.pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6 (More Certs[.]zip)\nCopy of Copy of globalsign.com // 104.18.21.226 // Cloudflare - 09.04.24",
      "modified": "2024-10-04T20:00:57.639000",
      "created": "2024-09-04T20:49:14.979000",
      "tags": [
        "networkwifi",
        "versioncode5",
        "sdkversion3613",
        "1996",
        "entity",
        "triage",
        "malware",
        "analysis",
        "report",
        "reported",
        "analyze",
        "sandbox",
        "score",
        "resource",
        "sha512",
        "size",
        "sha256",
        "affirmtrus",
        "sha1",
        "ac raiz",
        "sample ac",
        "10 discovery",
        "general",
        "target",
        "config",
        "copy",
        "sample digicert",
        "assured id",
        "global root",
        "target digicert",
        "academic",
        "hellenic a",
        "sample hellenic",
        "rootca",
        "10 blocklisted",
        "ck v13",
        "sample",
        "root ca",
        "sample emsign",
        "starfield",
        "authority",
        "security c",
        "swisssign",
        "class"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g0d379c712b7f4a9eb508d3a99b321893d01dea728ea14fcb889a04dfe05f5f6b?theme=dark",
        "https://www.virustotal.com/graph/embed/g7a71a4d796b548dea709d925ba2f612b75b944e6e27849b4b0baee3764a972bc?theme=dark",
        "https://tria.ge/240830-vvtvmsvhlg",
        "https://tria.ge/240830-vywteawape",
        "https://tria.ge/240830-v2wykswbrf",
        "https://tria.ge/240830-wkhv3axbkh",
        "https://tria.ge/240830-v7p28axcnp",
        "https://tria.ge/240830-v5fe1awcrh",
        "https://viz.greynoise.io/analysis/93e7b998-55e5-4da9-88dd-11d6217d0fe2",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/community",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/iocs",
        "https://www.virustotal.com/gui/collection/d6cc140d6120a6ca1e06f5eec3190446022a455942d383ae49fe1cf90fea9723/graph"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 267,
        "FileHash-SHA1": 266,
        "FileHash-SHA256": 1311,
        "URL": 305,
        "domain": 75,
        "hostname": 243
      },
      "indicator_count": 2467,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "562 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d4c1b250f6582414e87c7c",
      "name": "Compromised CA? -> Copy of vgt.pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6",
      "description": "Mashup of Skocherhans vgt[.]pl graph mashed up with a set of mal security certs on hand\nCopy of vgt[.]pl certificate & 66262cd24479f4ad1812508bc71ddc21ea04b168ecf7ca8ca942459e1bc6b1e6 (More Certs[.]zip)\nFrom VirusTotal Graphs - 09.01.24",
      "modified": "2024-10-01T20:01:33.620000",
      "created": "2024-09-01T19:34:10.807000",
      "tags": [
        "entity",
        "Certificates",
        "MalCerts"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g0d379c712b7f4a9eb508d3a99b321893d01dea728ea14fcb889a04dfe05f5f6b?theme=dark",
        "https://viz.greynoise.io/analysis/a1ebb5ca-0985-43db-a8e4-83673134a813",
        "https://viz.greynoise.io/query/AS8075"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 394,
        "FileHash-SHA1": 392,
        "FileHash-SHA256": 3426,
        "URL": 327,
        "domain": 315,
        "hostname": 264,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 5121,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "565 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f55ed2015e05ffbc2b72a8",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-16T08:56:50.387000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980471600645142bcd924",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-19T12:08:39.100000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65f55ed2015e05ffbc2b72a8",
      "export_count": 186972,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://test.tweakbit.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://test.tweakbit.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639153.800762
}