{
  "type": "URL",
  "indicator": "https://the.license.md/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://the.license.md/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3756752312,
      "indicator": "https://the.license.md/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6570a598f3d4e8c2cffd4f73",
          "name": "SMS SPY  \u2022 Remote Access",
          "description": "",
          "modified": "2023-12-06T16:47:19.410000",
          "created": "2023-12-06T16:47:19.410000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1043,
            "hostname": 684,
            "domain": 639,
            "FileHash-MD5": 382,
            "FileHash-SHA1": 212,
            "URL": 2215
          },
          "indicator_count": 5175,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650b67e5a3ff15727eed5a06",
          "name": "SMS SPY  \u2022 Remote Access",
          "description": "Malvertizing. Spyware\nMalbranding:\nTagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person,  click on link infecting devices.",
          "modified": "2023-10-20T21:00:45.519000",
          "created": "2023-09-20T21:45:09.422000",
          "tags": [
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "alexa",
            "united",
            "engineering",
            "phishing",
            "bank",
            "cobalt strike",
            "emotet",
            "phishtank",
            "spammer",
            "malware site",
            "deepscan",
            "malicious",
            "smsspy",
            "bradesco",
            "stealer",
            "facebook",
            "download",
            "service",
            "zbot",
            "formbook",
            "coinminer",
            "raccoonstealer",
            "social engineering",
            "vj75",
            "http",
            "oid3",
            "vis1",
            "redirect chain",
            "z554903578",
            "slfrd1",
            "xpccbgarern6r",
            "xpcyqqhir7yvq",
            "xpchgxkc32lbs",
            "pattern match",
            "q0o0mahttp",
            "pfunction",
            "lkvoid",
            "glfunction",
            "befunction",
            "mrtk",
            "7jfjrw",
            "zzvyn6uhsb"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:MSIL/RacoonStealer",
              "display_name": "Trojan:MSIL/RacoonStealer",
              "target": "/malware/Trojan:MSIL/RacoonStealer"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Bradesco",
              "display_name": "TrojanSpy:Win32/Bradesco",
              "target": "/malware/TrojanSpy:Win32/Bradesco"
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 36,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 639,
            "hostname": 684,
            "FileHash-MD5": 382,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 1043,
            "URL": 2215
          },
          "indicator_count": 5175,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "954 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy:win32/bradesco",
            "Cobalt strike",
            "Formbook",
            "Alf:heraklezeval:trojan:win32/zbot",
            "Trojan:msil/racoonstealer"
          ],
          "industries": [],
          "unique_indicators": 5231
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/license.md",
    "whois": "http://whois.domaintools.com/license.md",
    "domain": "license.md",
    "hostname": "the.license.md"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6570a598f3d4e8c2cffd4f73",
      "name": "SMS SPY  \u2022 Remote Access",
      "description": "",
      "modified": "2023-12-06T16:47:19.410000",
      "created": "2023-12-06T16:47:19.410000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1043,
        "hostname": 684,
        "domain": 639,
        "FileHash-MD5": 382,
        "FileHash-SHA1": 212,
        "URL": 2215
      },
      "indicator_count": 5175,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650b67e5a3ff15727eed5a06",
      "name": "SMS SPY  \u2022 Remote Access",
      "description": "Malvertizing. Spyware\nMalbranding:\nTagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person,  click on link infecting devices.",
      "modified": "2023-10-20T21:00:45.519000",
      "created": "2023-09-20T21:45:09.422000",
      "tags": [
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "alexa",
        "united",
        "engineering",
        "phishing",
        "bank",
        "cobalt strike",
        "emotet",
        "phishtank",
        "spammer",
        "malware site",
        "deepscan",
        "malicious",
        "smsspy",
        "bradesco",
        "stealer",
        "facebook",
        "download",
        "service",
        "zbot",
        "formbook",
        "coinminer",
        "raccoonstealer",
        "social engineering",
        "vj75",
        "http",
        "oid3",
        "vis1",
        "redirect chain",
        "z554903578",
        "slfrd1",
        "xpccbgarern6r",
        "xpcyqqhir7yvq",
        "xpchgxkc32lbs",
        "pattern match",
        "q0o0mahttp",
        "pfunction",
        "lkvoid",
        "glfunction",
        "befunction",
        "mrtk",
        "7jfjrw",
        "zzvyn6uhsb"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:MSIL/RacoonStealer",
          "display_name": "Trojan:MSIL/RacoonStealer",
          "target": "/malware/Trojan:MSIL/RacoonStealer"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Bradesco",
          "display_name": "TrojanSpy:Win32/Bradesco",
          "target": "/malware/TrojanSpy:Win32/Bradesco"
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 36,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 639,
        "hostname": 684,
        "FileHash-MD5": 382,
        "FileHash-SHA1": 212,
        "FileHash-SHA256": 1043,
        "URL": 2215
      },
      "indicator_count": 5175,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "954 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://the.license.md/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://the.license.md/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780301806.0260415
}