{
  "type": "URL",
  "indicator": "https://twitmazeed.com/show/djP",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://twitmazeed.com/show/djP",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3620932638,
      "indicator": "https://twitmazeed.com/show/djP",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "659560d63178b32f07838efb",
          "name": "Covert | Big O Tires active cyber threat | Dark Power | Emotet|",
          "description": "Active, ongoing cyber threat, multiple malicious activities including, network rat, ransomware encryption, social engineering,  spammers, infostealer, botnet activity.\nConsumers may also be contacted by mail or phone or find account seized. I haven't benn able to properly access the magnitude of the issue, there has been at least a handful of customers in good standing , with higher limits on paid of cards that ended up being stolen or according to Big O Representatives 'closed' for unfounded reasons; failure to confirm citizenship, identity, unknown patriot act offences, failure to comply Big O Tires via mail.",
          "modified": "2024-02-02T12:04:41.638000",
          "created": "2024-01-03T13:27:50.685000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "unsafeeval",
            "path",
            "expiressat",
            "auto",
            "wheels online",
            "o tires",
            "shop tires",
            "html info",
            "title shop",
            "tires",
            "meta tags",
            "big o",
            "tires language",
            "name verdict",
            "falcon sandbox",
            "samples",
            "localappdata",
            "json data",
            "temp",
            "getprocaddress",
            "ascii text",
            "windir",
            "file",
            "indicator",
            "mitre att",
            "ck id",
            "factory",
            "hybrid",
            "model",
            "comspec",
            "ssl certificate",
            "whois record",
            "execution",
            "contacted",
            "historical ssl",
            "whois whois",
            "simda http",
            "collections",
            "historical",
            "dropped",
            "backdoor",
            "unknown",
            "united",
            "asnone",
            "show",
            "entries",
            "search",
            "intel",
            "ms windows",
            "pe32",
            "windows nt",
            "copy",
            "write",
            "logic",
            "download",
            "malware",
            "suspicious",
            "next",
            "destination",
            "port",
            "components",
            "globalnpf",
            "china as23724",
            "music",
            "data c",
            "mexico",
            "as15169 google",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "win32",
            "united kingdom",
            "explorer",
            "xserver",
            "mtb aug",
            "location united",
            "america asn",
            "open",
            "trojan",
            "worm",
            "dataadobereader",
            "as397240",
            "msie",
            "etpro trojan",
            "virgin islands",
            "script urls",
            "creation date",
            "record value",
            "date",
            "a domains",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "related nids",
            "pulse http",
            "url https",
            "files location",
            "as20940",
            "aaaa",
            "as2914 ntt",
            "canada unknown",
            "japan unknown",
            "as16625 akamai",
            "domain",
            "hostname",
            "gmt content",
            "gmt report",
            "0 report",
            "sea alt",
            "body",
            "encrypt",
            "social engineering",
            "revenge rat",
            "rat",
            "identity theft",
            "credit card",
            "referrer",
            "communicating",
            "bundled",
            "family",
            "roots",
            "lolkek",
            "tzw variants",
            "quasar rat",
            "dark power",
            "swisyn",
            "wiper",
            "ransomware",
            "cobalt strike",
            "attack",
            "core",
            "emotet",
            "exploit",
            "hacktool",
            "mail spammer",
            "as63949 linode",
            "mtb dec",
            "checkin m1",
            "trojanspy",
            "artro",
            "remote",
            "infostealer"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/3fb8f0af07a9e94045be0f592c675e4f6146c95523f1774bc03f8eb5cf8c7d4e/65951c3d58467c9eb00f69dc"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ukraine",
            "Georgia",
            "India",
            "Hong Kong",
            "Canada",
            "China",
            "Indonesia",
            "South Africa",
            "Germany",
            "Slovenia",
            "Mexico",
            "Netherlands",
            "Japan",
            "Spain",
            "Argentina",
            "France",
            "Chile",
            "Italy",
            "Aruba",
            "Switzerland",
            "United Kingdom of Great Britain and Northern Ireland",
            "Denmark",
            "Poland",
            "Colombia",
            "Taiwan",
            "Bulgaria",
            "Austria",
            "Russian Federation",
            "Australia",
            "Philippines",
            "Norway",
            "Sweden"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Comspec",
              "display_name": "Trojan:Win32/Comspec",
              "target": "/malware/Trojan:Win32/Comspec"
            },
            {
              "id": "#Lowfi:SCPT:KiraAsciiObfuscator",
              "display_name": "#Lowfi:SCPT:KiraAsciiObfuscator",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Simda",
              "display_name": "Backdoor:Win32/Simda",
              "target": "/malware/Backdoor:Win32/Simda"
            },
            {
              "id": "Crypt3.BLXP",
              "display_name": "Crypt3.BLXP",
              "target": null
            },
            {
              "id": "PWS:Win32/VB.CU",
              "display_name": "PWS:Win32/VB.CU",
              "target": "/malware/PWS:Win32/VB.CU"
            },
            {
              "id": "Trojan:MSIL/ClipBanker.GB!MTB",
              "display_name": "Trojan:MSIL/ClipBanker.GB!MTB",
              "target": "/malware/Trojan:MSIL/ClipBanker.GB!MTB"
            },
            {
              "id": "Virus:Win32/Floxif.H",
              "display_name": "Virus:Win32/Floxif.H",
              "target": "/malware/Virus:Win32/Floxif.H"
            },
            {
              "id": "Win.Packed.Zusy-7170176-0",
              "display_name": "Win.Packed.Zusy-7170176-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Zbot-9880005-0",
              "display_name": "Win.Trojan.Zbot-9880005-0",
              "target": null
            },
            {
              "id": "'Win32:Trojan-gen",
              "display_name": "'Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "TEL:TrojanDownloader:O97M/MsiexecAbuse",
              "display_name": "TEL:TrojanDownloader:O97M/MsiexecAbuse",
              "target": null
            },
            {
              "id": "Worm:Win32/Mofksys.B",
              "display_name": "Worm:Win32/Mofksys.B",
              "target": "/malware/Worm:Win32/Mofksys.B"
            },
            {
              "id": "Worm:Win32/Mofksys.RND!MTB",
              "display_name": "Worm:Win32/Mofksys.RND!MTB",
              "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
            },
            {
              "id": "Worm:LOGO/Logic",
              "display_name": "Worm:LOGO/Logic",
              "target": "/malware/Worm:LOGO/Logic"
            },
            {
              "id": "ETPro Trojan",
              "display_name": "ETPro Trojan",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Swisyn",
              "display_name": "TrojanSpy:Win32/Swisyn",
              "target": "/malware/TrojanSpy:Win32/Swisyn"
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [
            "Telecommunications"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 560,
            "FileHash-SHA1": 350,
            "FileHash-SHA256": 4371,
            "URL": 8165,
            "domain": 2548,
            "hostname": 2813,
            "CVE": 4,
            "email": 3
          },
          "indicator_count": 18814,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658b9e86f7a149333882bfb9",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
          "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T03:48:22.319000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "859 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658ca3f53717bb3a25e96065",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
          "description": "",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T22:23:49.562000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658b9e86f7a149333882bfb9",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "859 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6583e3a2d1432cbf9054d26d",
          "name": "Qkbot | Reddit",
          "description": "Qbot URL:  https://seedbeej.pk/tin/index.php?QBOT.zip found in Reddit Honeypot link: https://www.reddit.com/user\nbackdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork  with many capabilities, attack methods and demands.  An unsuspecting victim  always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware, malvertizing, fraud services, full control of badly compromised digital profiles which have been discovered.",
          "modified": "2024-01-20T02:02:19.559000",
          "created": "2023-12-21T07:05:06.936000",
          "tags": [
            "ssl certificate",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "threat",
            "paste",
            "blacklist https",
            "qakbot",
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "ascii text",
            "pattern match",
            "file",
            "windows nt",
            "appdata",
            "indicator",
            "crlf line",
            "unicode text",
            "jpeg image",
            "mitre att",
            "hybrid",
            "general",
            "local",
            "error",
            "click",
            "strings",
            "microsoft",
            "threat analyzer",
            "urls https",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "heur",
            "malware site",
            "malicious site",
            "safe site",
            "malware",
            "html",
            "phishing site",
            "site top",
            "riskware",
            "unsafe",
            "artemis",
            "quasar rat",
            "downldr",
            "agent",
            "presenoker",
            "applicunwnt",
            "crack",
            "cve201711882",
            "win64",
            "iframe",
            "quasar",
            "trojanspy",
            "exit",
            "node tcp",
            "tor known",
            "tor relayrouter",
            "traffic",
            "anonymizer",
            "brasil",
            "phishing three",
            "united",
            "phishing bank",
            "virustotal",
            "tech",
            "bank",
            "maltiverse",
            "hidelink",
            "samples",
            "spyware",
            "injector",
            "mon jan",
            "tld count",
            "wed dec",
            "download",
            "first",
            "team",
            "simda",
            "bambernek",
            "simda simda",
            "infy",
            "alexa",
            "gregory",
            "cyber threat",
            "phishing",
            "engineering",
            "covid19",
            "telefonica co",
            "malicious",
            "zbot",
            "zeus",
            "betabot",
            "suppobox",
            "citadel",
            "pony",
            "kraken",
            "redline stealer",
            "ransomware",
            "vawtrak",
            "athena",
            "neutrino",
            "alina",
            "andromeda",
            "dexter",
            "unknown",
            "keylogger",
            "hawkeye",
            "phase",
            "jackpos",
            "plasma",
            "spyeye",
            "spitmo",
            "slingshot",
            "ramnit",
            "emotet",
            "pykspa",
            "virut",
            "installcore",
            "dorkbot",
            "bondat",
            "union",
            "vskimmer",
            "xtrat",
            "solar",
            "grandcrab",
            "nymaim",
            "matsnu",
            "cutwail",
            "cobalt strike",
            "hydra",
            "tinba",
            "nsis",
            "memscan",
            "deepscan",
            "runescape",
            "backdoor",
            "reddit",
            "tulach"
          ],
          "references": [
            "https://seedbeej.pk/tin/index.php?QBOT.zip",
            "https://tulach.cc/ [phishing, exploits, malware spreader]",
            "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
            "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
            "198.54.115.46            [exploit_source]",
            "gadyniw.com          [command_and_control]",
            "gahyqah.com          [command_and_control]",
            "galyqaz.com            [command_and_control]",
            "lyvyxor.com             [command_and_control]",
            "puzylyp.com           [command_and_control]",
            "malicious.high.ml   [dropper]",
            "https://www.reddit.com/user"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Gregory",
              "display_name": "Gregory",
              "target": null
            },
            {
              "id": "Cutwail",
              "display_name": "Cutwail",
              "target": null
            },
            {
              "id": "Matsnu",
              "display_name": "Matsnu",
              "target": null
            },
            {
              "id": "Vawtrak",
              "display_name": "Vawtrak",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "vSkimmer",
              "display_name": "vSkimmer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "SpyEye",
              "display_name": "SpyEye",
              "target": null
            },
            {
              "id": "Spitmo",
              "display_name": "Spitmo",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "DorkBot",
              "display_name": "DorkBot",
              "target": null
            },
            {
              "id": "Slingshot",
              "display_name": "Slingshot",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Plasma RAT",
              "display_name": "Plasma RAT",
              "target": null
            },
            {
              "id": "Neutrino",
              "display_name": "Neutrino",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            },
            {
              "id": "GrandCrab",
              "display_name": "GrandCrab",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Alinaos",
              "display_name": "Alinaos",
              "target": null
            },
            {
              "id": "HawkEye",
              "display_name": "HawkEye",
              "target": null
            },
            {
              "id": "Kraken",
              "display_name": "Kraken",
              "target": null
            },
            {
              "id": "Infy",
              "display_name": "Infy",
              "target": null
            },
            {
              "id": "Dexter",
              "display_name": "Dexter",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "ASCII",
              "display_name": "ASCII",
              "target": null
            },
            {
              "id": "Athena",
              "display_name": "Athena",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "BetaBot",
              "display_name": "BetaBot",
              "target": null
            },
            {
              "id": "COVID19",
              "display_name": "COVID19",
              "target": null
            },
            {
              "id": "Citadel",
              "display_name": "Citadel",
              "target": null
            },
            {
              "id": "Bondat",
              "display_name": "Bondat",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Hydra",
              "display_name": "Hydra",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 98,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8343,
            "FileHash-MD5": 953,
            "FileHash-SHA1": 489,
            "FileHash-SHA256": 3565,
            "domain": 1494,
            "hostname": 2218,
            "CVE": 6
          },
          "indicator_count": 17068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "865 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6583e3acc7f464d48a3503d1",
          "name": "Qkbot | Reddit",
          "description": "Qbot URL:  https://seedbeej.pk/tin/index.php?QBOT.zip found in Reddit Honeypot link: https://www.reddit.com/user\nbackdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork  with many capabilities, attack methods and demands.  An unsuspecting victim  always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware, malvertizing, fraud services, full control of badly compromised digital profiles which have been discovered.",
          "modified": "2024-01-20T02:02:19.559000",
          "created": "2023-12-21T07:05:16.695000",
          "tags": [
            "ssl certificate",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "threat",
            "paste",
            "blacklist https",
            "qakbot",
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "ascii text",
            "pattern match",
            "file",
            "windows nt",
            "appdata",
            "indicator",
            "crlf line",
            "unicode text",
            "jpeg image",
            "mitre att",
            "hybrid",
            "general",
            "local",
            "error",
            "click",
            "strings",
            "microsoft",
            "threat analyzer",
            "urls https",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "heur",
            "malware site",
            "malicious site",
            "safe site",
            "malware",
            "html",
            "phishing site",
            "site top",
            "riskware",
            "unsafe",
            "artemis",
            "quasar rat",
            "downldr",
            "agent",
            "presenoker",
            "applicunwnt",
            "crack",
            "cve201711882",
            "win64",
            "iframe",
            "quasar",
            "trojanspy",
            "exit",
            "node tcp",
            "tor known",
            "tor relayrouter",
            "traffic",
            "anonymizer",
            "brasil",
            "phishing three",
            "united",
            "phishing bank",
            "virustotal",
            "tech",
            "bank",
            "maltiverse",
            "hidelink",
            "samples",
            "spyware",
            "injector",
            "mon jan",
            "tld count",
            "wed dec",
            "download",
            "first",
            "team",
            "simda",
            "bambernek",
            "simda simda",
            "infy",
            "alexa",
            "gregory",
            "cyber threat",
            "phishing",
            "engineering",
            "covid19",
            "telefonica co",
            "malicious",
            "zbot",
            "zeus",
            "betabot",
            "suppobox",
            "citadel",
            "pony",
            "kraken",
            "redline stealer",
            "ransomware",
            "vawtrak",
            "athena",
            "neutrino",
            "alina",
            "andromeda",
            "dexter",
            "unknown",
            "keylogger",
            "hawkeye",
            "phase",
            "jackpos",
            "plasma",
            "spyeye",
            "spitmo",
            "slingshot",
            "ramnit",
            "emotet",
            "pykspa",
            "virut",
            "installcore",
            "dorkbot",
            "bondat",
            "union",
            "vskimmer",
            "xtrat",
            "solar",
            "grandcrab",
            "nymaim",
            "matsnu",
            "cutwail",
            "cobalt strike",
            "hydra",
            "tinba",
            "nsis",
            "memscan",
            "deepscan",
            "runescape",
            "backdoor",
            "reddit",
            "tulach"
          ],
          "references": [
            "https://seedbeej.pk/tin/index.php?QBOT.zip",
            "https://tulach.cc/ [phishing, exploits, malware spreader]",
            "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
            "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
            "198.54.115.46            [exploit_source]",
            "gadyniw.com          [command_and_control]",
            "gahyqah.com          [command_and_control]",
            "galyqaz.com            [command_and_control]",
            "lyvyxor.com             [command_and_control]",
            "puzylyp.com           [command_and_control]",
            "malicious.high.ml   [dropper]",
            "https://www.reddit.com/user"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Gregory",
              "display_name": "Gregory",
              "target": null
            },
            {
              "id": "Cutwail",
              "display_name": "Cutwail",
              "target": null
            },
            {
              "id": "Matsnu",
              "display_name": "Matsnu",
              "target": null
            },
            {
              "id": "Vawtrak",
              "display_name": "Vawtrak",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "vSkimmer",
              "display_name": "vSkimmer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "SpyEye",
              "display_name": "SpyEye",
              "target": null
            },
            {
              "id": "Spitmo",
              "display_name": "Spitmo",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "DorkBot",
              "display_name": "DorkBot",
              "target": null
            },
            {
              "id": "Slingshot",
              "display_name": "Slingshot",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Plasma RAT",
              "display_name": "Plasma RAT",
              "target": null
            },
            {
              "id": "Neutrino",
              "display_name": "Neutrino",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            },
            {
              "id": "GrandCrab",
              "display_name": "GrandCrab",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Alinaos",
              "display_name": "Alinaos",
              "target": null
            },
            {
              "id": "HawkEye",
              "display_name": "HawkEye",
              "target": null
            },
            {
              "id": "Kraken",
              "display_name": "Kraken",
              "target": null
            },
            {
              "id": "Infy",
              "display_name": "Infy",
              "target": null
            },
            {
              "id": "Dexter",
              "display_name": "Dexter",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "ASCII",
              "display_name": "ASCII",
              "target": null
            },
            {
              "id": "Athena",
              "display_name": "Athena",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "BetaBot",
              "display_name": "BetaBot",
              "target": null
            },
            {
              "id": "COVID19",
              "display_name": "COVID19",
              "target": null
            },
            {
              "id": "Citadel",
              "display_name": "Citadel",
              "target": null
            },
            {
              "id": "Bondat",
              "display_name": "Bondat",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Hydra",
              "display_name": "Hydra",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 101,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8343,
            "FileHash-MD5": 953,
            "FileHash-SHA1": 489,
            "FileHash-SHA256": 3565,
            "domain": 1494,
            "hostname": 2218,
            "CVE": 6
          },
          "indicator_count": 17068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "865 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658449d3f6ec1af2f3aace46",
          "name": "Qakbot | Reddit",
          "description": "Qbot URL: https://seedbeej.pk/tin/index.php?QBOT.zip Qbot zip found in Reddit Honeypot link: https://www.reddit.com/user backdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork with many capabilities, attack methods and demands. An unsuspecting victim always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware  malvertizing, fraud services, leads to full control of badly compromised digital profile.",
          "modified": "2024-01-20T02:02:19.559000",
          "created": "2023-12-21T14:21:07.435000",
          "tags": [
            "ssl certificate",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "threat",
            "paste",
            "blacklist https",
            "qakbot",
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "ascii text",
            "pattern match",
            "file",
            "windows nt",
            "appdata",
            "indicator",
            "crlf line",
            "unicode text",
            "jpeg image",
            "mitre att",
            "hybrid",
            "general",
            "local",
            "error",
            "click",
            "strings",
            "microsoft",
            "threat analyzer",
            "urls https",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "heur",
            "malware site",
            "malicious site",
            "safe site",
            "malware",
            "html",
            "phishing site",
            "site top",
            "riskware",
            "unsafe",
            "artemis",
            "quasar rat",
            "downldr",
            "agent",
            "presenoker",
            "applicunwnt",
            "crack",
            "cve201711882",
            "win64",
            "iframe",
            "quasar",
            "trojanspy",
            "exit",
            "node tcp",
            "tor known",
            "tor relayrouter",
            "traffic",
            "anonymizer",
            "brasil",
            "phishing three",
            "united",
            "phishing bank",
            "virustotal",
            "tech",
            "bank",
            "maltiverse",
            "hidelink",
            "samples",
            "spyware",
            "injector",
            "mon jan",
            "tld count",
            "wed dec",
            "download",
            "first",
            "team",
            "simda",
            "bambernek",
            "simda simda",
            "infy",
            "alexa",
            "gregory",
            "cyber threat",
            "phishing",
            "engineering",
            "covid19",
            "telefonica co",
            "malicious",
            "zbot",
            "zeus",
            "betabot",
            "suppobox",
            "citadel",
            "pony",
            "kraken",
            "redline stealer",
            "ransomware",
            "vawtrak",
            "athena",
            "neutrino",
            "alina",
            "andromeda",
            "dexter",
            "unknown",
            "keylogger",
            "hawkeye",
            "phase",
            "jackpos",
            "plasma",
            "spyeye",
            "spitmo",
            "slingshot",
            "ramnit",
            "emotet",
            "pykspa",
            "virut",
            "installcore",
            "dorkbot",
            "bondat",
            "union",
            "vskimmer",
            "xtrat",
            "solar",
            "grandcrab",
            "nymaim",
            "matsnu",
            "cutwail",
            "cobalt strike",
            "hydra",
            "tinba",
            "nsis",
            "memscan",
            "deepscan",
            "runescape",
            "backdoor",
            "reddit",
            "tulach",
            "password stealer",
            "active threat",
            "apple",
            "pinkslipbot",
            "icloud",
            "free",
            "apple"
          ],
          "references": [
            "https://seedbeej.pk/tin/index.php?QBOT.zip.  [Qbot zip]",
            "https://tulach.cc/  [Botnet phishing]",
            "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
            "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
            "198.54.115.46            [exploit_source]",
            "gadyniw.com          [command_and_control]",
            "gahyqah.com          [command_and_control]",
            "galyqaz.com            [command_and_control]",
            "lyvyxor.com             [command_and_control]",
            "puzylyp.com           [command_and_control]",
            "malicious.high.ml   [dropper]",
            "https://www.reddit.com/user [honeypot]",
            "beacons.bcp.gvt.com   [tracking]",
            "https://www.norad.mil/   [tracking]",
            "www.norad.mil   [tracking]",
            "www.apple.com  [API property call]",
            "https://www.apple.com/qtactivex/qtplugin.cab   [https://www.icloud.com .cab]",
            "yesporn.fun",
            "http://114.114.114.114:90/p/cdbdd4a09a64909694281aec503746fd/mobile_index.html?MTE0LjExNC4xMTQuMTE0L2xvZ2luP2hhc19vcmlfdXJp [Tulach | Malicious]",
            "114.114.114.114  [Tulach | Virus Network IP]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Gregory",
              "display_name": "Gregory",
              "target": null
            },
            {
              "id": "Cutwail",
              "display_name": "Cutwail",
              "target": null
            },
            {
              "id": "Matsnu",
              "display_name": "Matsnu",
              "target": null
            },
            {
              "id": "Vawtrak",
              "display_name": "Vawtrak",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "vSkimmer",
              "display_name": "vSkimmer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "SpyEye",
              "display_name": "SpyEye",
              "target": null
            },
            {
              "id": "Spitmo",
              "display_name": "Spitmo",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "DorkBot",
              "display_name": "DorkBot",
              "target": null
            },
            {
              "id": "Slingshot",
              "display_name": "Slingshot",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Plasma RAT",
              "display_name": "Plasma RAT",
              "target": null
            },
            {
              "id": "Neutrino",
              "display_name": "Neutrino",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            },
            {
              "id": "GrandCrab",
              "display_name": "GrandCrab",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Alinaos",
              "display_name": "Alinaos",
              "target": null
            },
            {
              "id": "HawkEye",
              "display_name": "HawkEye",
              "target": null
            },
            {
              "id": "Kraken",
              "display_name": "Kraken",
              "target": null
            },
            {
              "id": "Infy",
              "display_name": "Infy",
              "target": null
            },
            {
              "id": "Dexter",
              "display_name": "Dexter",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "ASCII",
              "display_name": "ASCII",
              "target": null
            },
            {
              "id": "Athena",
              "display_name": "Athena",
              "target": null
            },
            {
              "id": "Bambernek",
              "display_name": "Bambernek",
              "target": null
            },
            {
              "id": "BetaBot",
              "display_name": "BetaBot",
              "target": null
            },
            {
              "id": "COVID19",
              "display_name": "COVID19",
              "target": null
            },
            {
              "id": "Citadel",
              "display_name": "Citadel",
              "target": null
            },
            {
              "id": "Bondat",
              "display_name": "Bondat",
              "target": null
            },
            {
              "id": "HideLink",
              "display_name": "HideLink",
              "target": null
            },
            {
              "id": "Hydra",
              "display_name": "Hydra",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Pinkslipbot",
              "display_name": "Pinkslipbot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 124,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8736,
            "FileHash-MD5": 953,
            "FileHash-SHA1": 489,
            "FileHash-SHA256": 3566,
            "domain": 1516,
            "hostname": 2221,
            "CVE": 6
          },
          "indicator_count": 17487,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "865 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709650a15a2c71ea7d2a81",
          "name": "iPhone 23_01_2023 16_08.chlsj - Ref otx indicator url and its contained strings/ip's",
          "description": "",
          "modified": "2023-12-06T15:42:06.201000",
          "created": "2023-12-06T15:42:06.201000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 388,
            "URL": 351,
            "domain": 36,
            "hostname": 153,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 937,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63d125de2d5234198f9a7eb5",
          "name": "iPhone 23_01_2023 16_08.chlsj - Ref otx indicator url and its contained strings/ip's",
          "description": "As unable to extract this 3.8mb data file directly to otx, hybrid and vt, so via submit file as linked in references",
          "modified": "2023-02-24T12:01:57.417000",
          "created": "2023-01-25T12:51:42.344000",
          "tags": [
            "sha1",
            "sha256",
            "log id",
            "gmtn",
            "geotrust ev",
            "rsa ca",
            "organization",
            "tls web",
            "digicert inc",
            "london",
            "ca issuers",
            "bd6en timestamp",
            "false",
            "json",
            "proxy settings",
            "host",
            "scan endpoints",
            "create pulse",
            "submit sample",
            "api integration",
            "all callmedoris",
            "filehash",
            "pulse pulses",
            "strings",
            "path"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/file/7989730738aeb80f64192cbaa8f289efaca313a3f32a9e3034b89140c45d2e9a",
            "The full text of the full report on the \u00c2\u00a31.2m   \"Pulses\" that can detect and identify malware has been published on Facebook, Twitter and Facebook.",
            "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT",
            "\u817e\u8baf\u5fae\u4e91",
            "iPhone 23_01_2023 16_08.chlsj"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 388,
            "URL": 351,
            "hostname": 153,
            "domain": 36,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 937,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "1195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "malicious.high.ml   [dropper]",
        "https://tulach.cc/ [phishing, exploits, malware spreader]",
        "https://otx.alienvault.com/indicator/file/7989730738aeb80f64192cbaa8f289efaca313a3f32a9e3034b89140c45d2e9a",
        "lyvyxor.com             [command_and_control]",
        "beacons.bcp.gvt.com   [tracking]",
        "198.54.115.46            [exploit_source]",
        "https://www.norad.mil/   [tracking]",
        "http://114.114.114.114:90/p/cdbdd4a09a64909694281aec503746fd/mobile_index.html?MTE0LjExNC4xMTQuMTE0L2xvZ2luP2hhc19vcmlfdXJp [Tulach | Malicious]",
        "www.norad.mil   [tracking]",
        "gahyqah.com          [command_and_control]",
        "https://www.apple.com/qtactivex/qtplugin.cab   [https://www.icloud.com .cab]",
        "https://tulach.cc/  [Botnet phishing]",
        "https://seedbeej.pk/tin/index.php?QBOT.zip.  [Qbot zip]",
        "https://hybrid-analysis.com/sample/3fb8f0af07a9e94045be0f592c675e4f6146c95523f1774bc03f8eb5cf8c7d4e/65951c3d58467c9eb00f69dc",
        "puzylyp.com           [command_and_control]",
        "www.apple.com  [API property call]",
        "114.114.114.114  [Tulach | Virus Network IP]",
        "The full text of the full report on the \u00c2\u00a31.2m   \"Pulses\" that can detect and identify malware has been published on Facebook, Twitter and Facebook.",
        "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
        "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
        "yesporn.fun",
        "https://seedbeej.pk/tin/index.php?QBOT.zip",
        "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT",
        "https://www.reddit.com/user [honeypot]",
        "gadyniw.com          [command_and_control]",
        "galyqaz.com            [command_and_control]",
        "\u817e\u8baf\u5fae\u4e91",
        "https://www.reddit.com/user",
        "iPhone 23_01_2023 16_08.chlsj"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "'win32:trojan-gen",
            "Slingshot",
            "Kraken",
            "Tulach",
            "Installcore",
            "Vskimmer",
            "Cobalt strike",
            "Trojanspy",
            "Win.trojan.zbot-9880005-0",
            "Cutwail",
            "Neutrino",
            "Hacktool",
            "Athena",
            "Pws:win32/vb.cu",
            "Zbot",
            "Spitmo",
            "Worm:logo/logic",
            "Ransomware",
            "Redline stealer",
            "#lowfi:scpt:kiraasciiobfuscator",
            "Citadel",
            "Pykspa",
            "Tel:trojandownloader:o97m/msiexecabuse",
            "Virut",
            "Andromeda",
            "Dorkbot",
            "Betabot",
            "Hawkeye",
            "Ascii",
            "Bondat",
            "Spyeye",
            "Quasar",
            "Quasar rat",
            "Zeus",
            "Nsis",
            "Trojan:msil/clipbanker.gb!mtb",
            "Win.packed.zusy-7170176-0",
            "Grandcrab",
            "Qakbot",
            "Pony",
            "Nymaim",
            "Covid19",
            "Emotet",
            "Trojan:win32/comspec",
            "Ramnit",
            "Hydra",
            "Suppobox",
            "Solar",
            "Vawtrak",
            "Infy",
            "Bambernek",
            "Backdoor:win32/simda",
            "Virus:win32/floxif.h",
            "Worm:win32/mofksys.b",
            "Xrat",
            "Pinkslipbot",
            "Crypt3.blxp",
            "Etpro trojan",
            "Lolkek",
            "Trojanspy:win32/swisyn",
            "Matsnu",
            "Dark power",
            "Maltiverse",
            "Simda",
            "Plasma rat",
            "Alinaos",
            "Artemis",
            "Gregory",
            "Artro",
            "Dexter",
            "Hidelink",
            "Worm:win32/mofksys.rnd!mtb"
          ],
          "industries": [
            "Telecommunications"
          ],
          "unique_indicators": 55099
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/twitmazeed.com",
    "whois": "http://whois.domaintools.com/twitmazeed.com",
    "domain": "twitmazeed.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "659560d63178b32f07838efb",
      "name": "Covert | Big O Tires active cyber threat | Dark Power | Emotet|",
      "description": "Active, ongoing cyber threat, multiple malicious activities including, network rat, ransomware encryption, social engineering,  spammers, infostealer, botnet activity.\nConsumers may also be contacted by mail or phone or find account seized. I haven't benn able to properly access the magnitude of the issue, there has been at least a handful of customers in good standing , with higher limits on paid of cards that ended up being stolen or according to Big O Representatives 'closed' for unfounded reasons; failure to confirm citizenship, identity, unknown patriot act offences, failure to comply Big O Tires via mail.",
      "modified": "2024-02-02T12:04:41.638000",
      "created": "2024-01-03T13:27:50.685000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "unsafeeval",
        "path",
        "expiressat",
        "auto",
        "wheels online",
        "o tires",
        "shop tires",
        "html info",
        "title shop",
        "tires",
        "meta tags",
        "big o",
        "tires language",
        "name verdict",
        "falcon sandbox",
        "samples",
        "localappdata",
        "json data",
        "temp",
        "getprocaddress",
        "ascii text",
        "windir",
        "file",
        "indicator",
        "mitre att",
        "ck id",
        "factory",
        "hybrid",
        "model",
        "comspec",
        "ssl certificate",
        "whois record",
        "execution",
        "contacted",
        "historical ssl",
        "whois whois",
        "simda http",
        "collections",
        "historical",
        "dropped",
        "backdoor",
        "unknown",
        "united",
        "asnone",
        "show",
        "entries",
        "search",
        "intel",
        "ms windows",
        "pe32",
        "windows nt",
        "copy",
        "write",
        "logic",
        "download",
        "malware",
        "suspicious",
        "next",
        "destination",
        "port",
        "components",
        "globalnpf",
        "china as23724",
        "music",
        "data c",
        "mexico",
        "as15169 google",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "win32",
        "united kingdom",
        "explorer",
        "xserver",
        "mtb aug",
        "location united",
        "america asn",
        "open",
        "trojan",
        "worm",
        "dataadobereader",
        "as397240",
        "msie",
        "etpro trojan",
        "virgin islands",
        "script urls",
        "creation date",
        "record value",
        "date",
        "a domains",
        "all search",
        "otx octoseek",
        "url http",
        "http",
        "related nids",
        "pulse http",
        "url https",
        "files location",
        "as20940",
        "aaaa",
        "as2914 ntt",
        "canada unknown",
        "japan unknown",
        "as16625 akamai",
        "domain",
        "hostname",
        "gmt content",
        "gmt report",
        "0 report",
        "sea alt",
        "body",
        "encrypt",
        "social engineering",
        "revenge rat",
        "rat",
        "identity theft",
        "credit card",
        "referrer",
        "communicating",
        "bundled",
        "family",
        "roots",
        "lolkek",
        "tzw variants",
        "quasar rat",
        "dark power",
        "swisyn",
        "wiper",
        "ransomware",
        "cobalt strike",
        "attack",
        "core",
        "emotet",
        "exploit",
        "hacktool",
        "mail spammer",
        "as63949 linode",
        "mtb dec",
        "checkin m1",
        "trojanspy",
        "artro",
        "remote",
        "infostealer"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/3fb8f0af07a9e94045be0f592c675e4f6146c95523f1774bc03f8eb5cf8c7d4e/65951c3d58467c9eb00f69dc"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ukraine",
        "Georgia",
        "India",
        "Hong Kong",
        "Canada",
        "China",
        "Indonesia",
        "South Africa",
        "Germany",
        "Slovenia",
        "Mexico",
        "Netherlands",
        "Japan",
        "Spain",
        "Argentina",
        "France",
        "Chile",
        "Italy",
        "Aruba",
        "Switzerland",
        "United Kingdom of Great Britain and Northern Ireland",
        "Denmark",
        "Poland",
        "Colombia",
        "Taiwan",
        "Bulgaria",
        "Austria",
        "Russian Federation",
        "Australia",
        "Philippines",
        "Norway",
        "Sweden"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Comspec",
          "display_name": "Trojan:Win32/Comspec",
          "target": "/malware/Trojan:Win32/Comspec"
        },
        {
          "id": "#Lowfi:SCPT:KiraAsciiObfuscator",
          "display_name": "#Lowfi:SCPT:KiraAsciiObfuscator",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Simda",
          "display_name": "Backdoor:Win32/Simda",
          "target": "/malware/Backdoor:Win32/Simda"
        },
        {
          "id": "Crypt3.BLXP",
          "display_name": "Crypt3.BLXP",
          "target": null
        },
        {
          "id": "PWS:Win32/VB.CU",
          "display_name": "PWS:Win32/VB.CU",
          "target": "/malware/PWS:Win32/VB.CU"
        },
        {
          "id": "Trojan:MSIL/ClipBanker.GB!MTB",
          "display_name": "Trojan:MSIL/ClipBanker.GB!MTB",
          "target": "/malware/Trojan:MSIL/ClipBanker.GB!MTB"
        },
        {
          "id": "Virus:Win32/Floxif.H",
          "display_name": "Virus:Win32/Floxif.H",
          "target": "/malware/Virus:Win32/Floxif.H"
        },
        {
          "id": "Win.Packed.Zusy-7170176-0",
          "display_name": "Win.Packed.Zusy-7170176-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Zbot-9880005-0",
          "display_name": "Win.Trojan.Zbot-9880005-0",
          "target": null
        },
        {
          "id": "'Win32:Trojan-gen",
          "display_name": "'Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "TEL:TrojanDownloader:O97M/MsiexecAbuse",
          "display_name": "TEL:TrojanDownloader:O97M/MsiexecAbuse",
          "target": null
        },
        {
          "id": "Worm:Win32/Mofksys.B",
          "display_name": "Worm:Win32/Mofksys.B",
          "target": "/malware/Worm:Win32/Mofksys.B"
        },
        {
          "id": "Worm:Win32/Mofksys.RND!MTB",
          "display_name": "Worm:Win32/Mofksys.RND!MTB",
          "target": "/malware/Worm:Win32/Mofksys.RND!MTB"
        },
        {
          "id": "Worm:LOGO/Logic",
          "display_name": "Worm:LOGO/Logic",
          "target": "/malware/Worm:LOGO/Logic"
        },
        {
          "id": "ETPro Trojan",
          "display_name": "ETPro Trojan",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Swisyn",
          "display_name": "TrojanSpy:Win32/Swisyn",
          "target": "/malware/TrojanSpy:Win32/Swisyn"
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [
        "Telecommunications"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 560,
        "FileHash-SHA1": 350,
        "FileHash-SHA256": 4371,
        "URL": 8165,
        "domain": 2548,
        "hostname": 2813,
        "CVE": 4,
        "email": 3
      },
      "indicator_count": 18814,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658b9e86f7a149333882bfb9",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
      "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T03:48:22.319000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "859 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658ca3f53717bb3a25e96065",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
      "description": "",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T22:23:49.562000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658b9e86f7a149333882bfb9",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "859 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6583e3a2d1432cbf9054d26d",
      "name": "Qkbot | Reddit",
      "description": "Qbot URL:  https://seedbeej.pk/tin/index.php?QBOT.zip found in Reddit Honeypot link: https://www.reddit.com/user\nbackdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork  with many capabilities, attack methods and demands.  An unsuspecting victim  always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware, malvertizing, fraud services, full control of badly compromised digital profiles which have been discovered.",
      "modified": "2024-01-20T02:02:19.559000",
      "created": "2023-12-21T07:05:06.936000",
      "tags": [
        "ssl certificate",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "threat",
        "paste",
        "blacklist https",
        "qakbot",
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "ascii text",
        "pattern match",
        "file",
        "windows nt",
        "appdata",
        "indicator",
        "crlf line",
        "unicode text",
        "jpeg image",
        "mitre att",
        "hybrid",
        "general",
        "local",
        "error",
        "click",
        "strings",
        "microsoft",
        "threat analyzer",
        "urls https",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "heur",
        "malware site",
        "malicious site",
        "safe site",
        "malware",
        "html",
        "phishing site",
        "site top",
        "riskware",
        "unsafe",
        "artemis",
        "quasar rat",
        "downldr",
        "agent",
        "presenoker",
        "applicunwnt",
        "crack",
        "cve201711882",
        "win64",
        "iframe",
        "quasar",
        "trojanspy",
        "exit",
        "node tcp",
        "tor known",
        "tor relayrouter",
        "traffic",
        "anonymizer",
        "brasil",
        "phishing three",
        "united",
        "phishing bank",
        "virustotal",
        "tech",
        "bank",
        "maltiverse",
        "hidelink",
        "samples",
        "spyware",
        "injector",
        "mon jan",
        "tld count",
        "wed dec",
        "download",
        "first",
        "team",
        "simda",
        "bambernek",
        "simda simda",
        "infy",
        "alexa",
        "gregory",
        "cyber threat",
        "phishing",
        "engineering",
        "covid19",
        "telefonica co",
        "malicious",
        "zbot",
        "zeus",
        "betabot",
        "suppobox",
        "citadel",
        "pony",
        "kraken",
        "redline stealer",
        "ransomware",
        "vawtrak",
        "athena",
        "neutrino",
        "alina",
        "andromeda",
        "dexter",
        "unknown",
        "keylogger",
        "hawkeye",
        "phase",
        "jackpos",
        "plasma",
        "spyeye",
        "spitmo",
        "slingshot",
        "ramnit",
        "emotet",
        "pykspa",
        "virut",
        "installcore",
        "dorkbot",
        "bondat",
        "union",
        "vskimmer",
        "xtrat",
        "solar",
        "grandcrab",
        "nymaim",
        "matsnu",
        "cutwail",
        "cobalt strike",
        "hydra",
        "tinba",
        "nsis",
        "memscan",
        "deepscan",
        "runescape",
        "backdoor",
        "reddit",
        "tulach"
      ],
      "references": [
        "https://seedbeej.pk/tin/index.php?QBOT.zip",
        "https://tulach.cc/ [phishing, exploits, malware spreader]",
        "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
        "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
        "198.54.115.46            [exploit_source]",
        "gadyniw.com          [command_and_control]",
        "gahyqah.com          [command_and_control]",
        "galyqaz.com            [command_and_control]",
        "lyvyxor.com             [command_and_control]",
        "puzylyp.com           [command_and_control]",
        "malicious.high.ml   [dropper]",
        "https://www.reddit.com/user"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Gregory",
          "display_name": "Gregory",
          "target": null
        },
        {
          "id": "Cutwail",
          "display_name": "Cutwail",
          "target": null
        },
        {
          "id": "Matsnu",
          "display_name": "Matsnu",
          "target": null
        },
        {
          "id": "Vawtrak",
          "display_name": "Vawtrak",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "vSkimmer",
          "display_name": "vSkimmer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "SpyEye",
          "display_name": "SpyEye",
          "target": null
        },
        {
          "id": "Spitmo",
          "display_name": "Spitmo",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "DorkBot",
          "display_name": "DorkBot",
          "target": null
        },
        {
          "id": "Slingshot",
          "display_name": "Slingshot",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Plasma RAT",
          "display_name": "Plasma RAT",
          "target": null
        },
        {
          "id": "Neutrino",
          "display_name": "Neutrino",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        },
        {
          "id": "GrandCrab",
          "display_name": "GrandCrab",
          "target": null
        },
        {
          "id": "Andromeda",
          "display_name": "Andromeda",
          "target": null
        },
        {
          "id": "Alinaos",
          "display_name": "Alinaos",
          "target": null
        },
        {
          "id": "HawkEye",
          "display_name": "HawkEye",
          "target": null
        },
        {
          "id": "Kraken",
          "display_name": "Kraken",
          "target": null
        },
        {
          "id": "Infy",
          "display_name": "Infy",
          "target": null
        },
        {
          "id": "Dexter",
          "display_name": "Dexter",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "ASCII",
          "display_name": "ASCII",
          "target": null
        },
        {
          "id": "Athena",
          "display_name": "Athena",
          "target": null
        },
        {
          "id": "Bambernek",
          "display_name": "Bambernek",
          "target": null
        },
        {
          "id": "BetaBot",
          "display_name": "BetaBot",
          "target": null
        },
        {
          "id": "COVID19",
          "display_name": "COVID19",
          "target": null
        },
        {
          "id": "Citadel",
          "display_name": "Citadel",
          "target": null
        },
        {
          "id": "Bondat",
          "display_name": "Bondat",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Hydra",
          "display_name": "Hydra",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 98,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8343,
        "FileHash-MD5": 953,
        "FileHash-SHA1": 489,
        "FileHash-SHA256": 3565,
        "domain": 1494,
        "hostname": 2218,
        "CVE": 6
      },
      "indicator_count": 17068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "865 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6583e3acc7f464d48a3503d1",
      "name": "Qkbot | Reddit",
      "description": "Qbot URL:  https://seedbeej.pk/tin/index.php?QBOT.zip found in Reddit Honeypot link: https://www.reddit.com/user\nbackdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork  with many capabilities, attack methods and demands.  An unsuspecting victim  always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware, malvertizing, fraud services, full control of badly compromised digital profiles which have been discovered.",
      "modified": "2024-01-20T02:02:19.559000",
      "created": "2023-12-21T07:05:16.695000",
      "tags": [
        "ssl certificate",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "threat",
        "paste",
        "blacklist https",
        "qakbot",
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "ascii text",
        "pattern match",
        "file",
        "windows nt",
        "appdata",
        "indicator",
        "crlf line",
        "unicode text",
        "jpeg image",
        "mitre att",
        "hybrid",
        "general",
        "local",
        "error",
        "click",
        "strings",
        "microsoft",
        "threat analyzer",
        "urls https",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "heur",
        "malware site",
        "malicious site",
        "safe site",
        "malware",
        "html",
        "phishing site",
        "site top",
        "riskware",
        "unsafe",
        "artemis",
        "quasar rat",
        "downldr",
        "agent",
        "presenoker",
        "applicunwnt",
        "crack",
        "cve201711882",
        "win64",
        "iframe",
        "quasar",
        "trojanspy",
        "exit",
        "node tcp",
        "tor known",
        "tor relayrouter",
        "traffic",
        "anonymizer",
        "brasil",
        "phishing three",
        "united",
        "phishing bank",
        "virustotal",
        "tech",
        "bank",
        "maltiverse",
        "hidelink",
        "samples",
        "spyware",
        "injector",
        "mon jan",
        "tld count",
        "wed dec",
        "download",
        "first",
        "team",
        "simda",
        "bambernek",
        "simda simda",
        "infy",
        "alexa",
        "gregory",
        "cyber threat",
        "phishing",
        "engineering",
        "covid19",
        "telefonica co",
        "malicious",
        "zbot",
        "zeus",
        "betabot",
        "suppobox",
        "citadel",
        "pony",
        "kraken",
        "redline stealer",
        "ransomware",
        "vawtrak",
        "athena",
        "neutrino",
        "alina",
        "andromeda",
        "dexter",
        "unknown",
        "keylogger",
        "hawkeye",
        "phase",
        "jackpos",
        "plasma",
        "spyeye",
        "spitmo",
        "slingshot",
        "ramnit",
        "emotet",
        "pykspa",
        "virut",
        "installcore",
        "dorkbot",
        "bondat",
        "union",
        "vskimmer",
        "xtrat",
        "solar",
        "grandcrab",
        "nymaim",
        "matsnu",
        "cutwail",
        "cobalt strike",
        "hydra",
        "tinba",
        "nsis",
        "memscan",
        "deepscan",
        "runescape",
        "backdoor",
        "reddit",
        "tulach"
      ],
      "references": [
        "https://seedbeej.pk/tin/index.php?QBOT.zip",
        "https://tulach.cc/ [phishing, exploits, malware spreader]",
        "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
        "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
        "198.54.115.46            [exploit_source]",
        "gadyniw.com          [command_and_control]",
        "gahyqah.com          [command_and_control]",
        "galyqaz.com            [command_and_control]",
        "lyvyxor.com             [command_and_control]",
        "puzylyp.com           [command_and_control]",
        "malicious.high.ml   [dropper]",
        "https://www.reddit.com/user"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Gregory",
          "display_name": "Gregory",
          "target": null
        },
        {
          "id": "Cutwail",
          "display_name": "Cutwail",
          "target": null
        },
        {
          "id": "Matsnu",
          "display_name": "Matsnu",
          "target": null
        },
        {
          "id": "Vawtrak",
          "display_name": "Vawtrak",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "vSkimmer",
          "display_name": "vSkimmer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "SpyEye",
          "display_name": "SpyEye",
          "target": null
        },
        {
          "id": "Spitmo",
          "display_name": "Spitmo",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "DorkBot",
          "display_name": "DorkBot",
          "target": null
        },
        {
          "id": "Slingshot",
          "display_name": "Slingshot",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Plasma RAT",
          "display_name": "Plasma RAT",
          "target": null
        },
        {
          "id": "Neutrino",
          "display_name": "Neutrino",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        },
        {
          "id": "GrandCrab",
          "display_name": "GrandCrab",
          "target": null
        },
        {
          "id": "Andromeda",
          "display_name": "Andromeda",
          "target": null
        },
        {
          "id": "Alinaos",
          "display_name": "Alinaos",
          "target": null
        },
        {
          "id": "HawkEye",
          "display_name": "HawkEye",
          "target": null
        },
        {
          "id": "Kraken",
          "display_name": "Kraken",
          "target": null
        },
        {
          "id": "Infy",
          "display_name": "Infy",
          "target": null
        },
        {
          "id": "Dexter",
          "display_name": "Dexter",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "ASCII",
          "display_name": "ASCII",
          "target": null
        },
        {
          "id": "Athena",
          "display_name": "Athena",
          "target": null
        },
        {
          "id": "Bambernek",
          "display_name": "Bambernek",
          "target": null
        },
        {
          "id": "BetaBot",
          "display_name": "BetaBot",
          "target": null
        },
        {
          "id": "COVID19",
          "display_name": "COVID19",
          "target": null
        },
        {
          "id": "Citadel",
          "display_name": "Citadel",
          "target": null
        },
        {
          "id": "Bondat",
          "display_name": "Bondat",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Hydra",
          "display_name": "Hydra",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 101,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8343,
        "FileHash-MD5": 953,
        "FileHash-SHA1": 489,
        "FileHash-SHA256": 3565,
        "domain": 1494,
        "hostname": 2218,
        "CVE": 6
      },
      "indicator_count": 17068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "865 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658449d3f6ec1af2f3aace46",
      "name": "Qakbot | Reddit",
      "description": "Qbot URL: https://seedbeej.pk/tin/index.php?QBOT.zip Qbot zip found in Reddit Honeypot link: https://www.reddit.com/user backdoor second stage developed for distribution as a password stealer. Qbot, seemingly common; is a large botnetwork with many capabilities, attack methods and demands. An unsuspecting victim always be in botnetwork. Qbot encompasses many other bot networks, trojans, network rats, spyware  malvertizing, fraud services, leads to full control of badly compromised digital profile.",
      "modified": "2024-01-20T02:02:19.559000",
      "created": "2023-12-21T14:21:07.435000",
      "tags": [
        "ssl certificate",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "threat",
        "paste",
        "blacklist https",
        "qakbot",
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "ascii text",
        "pattern match",
        "file",
        "windows nt",
        "appdata",
        "indicator",
        "crlf line",
        "unicode text",
        "jpeg image",
        "mitre att",
        "hybrid",
        "general",
        "local",
        "error",
        "click",
        "strings",
        "microsoft",
        "threat analyzer",
        "urls https",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "heur",
        "malware site",
        "malicious site",
        "safe site",
        "malware",
        "html",
        "phishing site",
        "site top",
        "riskware",
        "unsafe",
        "artemis",
        "quasar rat",
        "downldr",
        "agent",
        "presenoker",
        "applicunwnt",
        "crack",
        "cve201711882",
        "win64",
        "iframe",
        "quasar",
        "trojanspy",
        "exit",
        "node tcp",
        "tor known",
        "tor relayrouter",
        "traffic",
        "anonymizer",
        "brasil",
        "phishing three",
        "united",
        "phishing bank",
        "virustotal",
        "tech",
        "bank",
        "maltiverse",
        "hidelink",
        "samples",
        "spyware",
        "injector",
        "mon jan",
        "tld count",
        "wed dec",
        "download",
        "first",
        "team",
        "simda",
        "bambernek",
        "simda simda",
        "infy",
        "alexa",
        "gregory",
        "cyber threat",
        "phishing",
        "engineering",
        "covid19",
        "telefonica co",
        "malicious",
        "zbot",
        "zeus",
        "betabot",
        "suppobox",
        "citadel",
        "pony",
        "kraken",
        "redline stealer",
        "ransomware",
        "vawtrak",
        "athena",
        "neutrino",
        "alina",
        "andromeda",
        "dexter",
        "unknown",
        "keylogger",
        "hawkeye",
        "phase",
        "jackpos",
        "plasma",
        "spyeye",
        "spitmo",
        "slingshot",
        "ramnit",
        "emotet",
        "pykspa",
        "virut",
        "installcore",
        "dorkbot",
        "bondat",
        "union",
        "vskimmer",
        "xtrat",
        "solar",
        "grandcrab",
        "nymaim",
        "matsnu",
        "cutwail",
        "cobalt strike",
        "hydra",
        "tinba",
        "nsis",
        "memscan",
        "deepscan",
        "runescape",
        "backdoor",
        "reddit",
        "tulach",
        "password stealer",
        "active threat",
        "apple",
        "pinkslipbot",
        "icloud",
        "free",
        "apple"
      ],
      "references": [
        "https://seedbeej.pk/tin/index.php?QBOT.zip.  [Qbot zip]",
        "https://tulach.cc/  [Botnet phishing]",
        "https://www.hybrid-analysis.com/sample/a8decf589e5ec26f1e994a3923fc245db98f681f951d2bb8e1fcce1d8fef5293",
        "https://www.virustotal.com/gui/url/000c01d40db51f156933c624f23e776cb2c1fd60b8f1840b13b9622886a8e918/community",
        "198.54.115.46            [exploit_source]",
        "gadyniw.com          [command_and_control]",
        "gahyqah.com          [command_and_control]",
        "galyqaz.com            [command_and_control]",
        "lyvyxor.com             [command_and_control]",
        "puzylyp.com           [command_and_control]",
        "malicious.high.ml   [dropper]",
        "https://www.reddit.com/user [honeypot]",
        "beacons.bcp.gvt.com   [tracking]",
        "https://www.norad.mil/   [tracking]",
        "www.norad.mil   [tracking]",
        "www.apple.com  [API property call]",
        "https://www.apple.com/qtactivex/qtplugin.cab   [https://www.icloud.com .cab]",
        "yesporn.fun",
        "http://114.114.114.114:90/p/cdbdd4a09a64909694281aec503746fd/mobile_index.html?MTE0LjExNC4xMTQuMTE0L2xvZ2luP2hhc19vcmlfdXJp [Tulach | Malicious]",
        "114.114.114.114  [Tulach | Virus Network IP]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Gregory",
          "display_name": "Gregory",
          "target": null
        },
        {
          "id": "Cutwail",
          "display_name": "Cutwail",
          "target": null
        },
        {
          "id": "Matsnu",
          "display_name": "Matsnu",
          "target": null
        },
        {
          "id": "Vawtrak",
          "display_name": "Vawtrak",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "vSkimmer",
          "display_name": "vSkimmer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "SpyEye",
          "display_name": "SpyEye",
          "target": null
        },
        {
          "id": "Spitmo",
          "display_name": "Spitmo",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "DorkBot",
          "display_name": "DorkBot",
          "target": null
        },
        {
          "id": "Slingshot",
          "display_name": "Slingshot",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Plasma RAT",
          "display_name": "Plasma RAT",
          "target": null
        },
        {
          "id": "Neutrino",
          "display_name": "Neutrino",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        },
        {
          "id": "GrandCrab",
          "display_name": "GrandCrab",
          "target": null
        },
        {
          "id": "Andromeda",
          "display_name": "Andromeda",
          "target": null
        },
        {
          "id": "Alinaos",
          "display_name": "Alinaos",
          "target": null
        },
        {
          "id": "HawkEye",
          "display_name": "HawkEye",
          "target": null
        },
        {
          "id": "Kraken",
          "display_name": "Kraken",
          "target": null
        },
        {
          "id": "Infy",
          "display_name": "Infy",
          "target": null
        },
        {
          "id": "Dexter",
          "display_name": "Dexter",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "ASCII",
          "display_name": "ASCII",
          "target": null
        },
        {
          "id": "Athena",
          "display_name": "Athena",
          "target": null
        },
        {
          "id": "Bambernek",
          "display_name": "Bambernek",
          "target": null
        },
        {
          "id": "BetaBot",
          "display_name": "BetaBot",
          "target": null
        },
        {
          "id": "COVID19",
          "display_name": "COVID19",
          "target": null
        },
        {
          "id": "Citadel",
          "display_name": "Citadel",
          "target": null
        },
        {
          "id": "Bondat",
          "display_name": "Bondat",
          "target": null
        },
        {
          "id": "HideLink",
          "display_name": "HideLink",
          "target": null
        },
        {
          "id": "Hydra",
          "display_name": "Hydra",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Pinkslipbot",
          "display_name": "Pinkslipbot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 124,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8736,
        "FileHash-MD5": 953,
        "FileHash-SHA1": 489,
        "FileHash-SHA256": 3566,
        "domain": 1516,
        "hostname": 2221,
        "CVE": 6
      },
      "indicator_count": 17487,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "865 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709650a15a2c71ea7d2a81",
      "name": "iPhone 23_01_2023 16_08.chlsj - Ref otx indicator url and its contained strings/ip's",
      "description": "",
      "modified": "2023-12-06T15:42:06.201000",
      "created": "2023-12-06T15:42:06.201000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 388,
        "URL": 351,
        "domain": 36,
        "hostname": 153,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 937,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "63d125de2d5234198f9a7eb5",
      "name": "iPhone 23_01_2023 16_08.chlsj - Ref otx indicator url and its contained strings/ip's",
      "description": "As unable to extract this 3.8mb data file directly to otx, hybrid and vt, so via submit file as linked in references",
      "modified": "2023-02-24T12:01:57.417000",
      "created": "2023-01-25T12:51:42.344000",
      "tags": [
        "sha1",
        "sha256",
        "log id",
        "gmtn",
        "geotrust ev",
        "rsa ca",
        "organization",
        "tls web",
        "digicert inc",
        "london",
        "ca issuers",
        "bd6en timestamp",
        "false",
        "json",
        "proxy settings",
        "host",
        "scan endpoints",
        "create pulse",
        "submit sample",
        "api integration",
        "all callmedoris",
        "filehash",
        "pulse pulses",
        "strings",
        "path"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/file/7989730738aeb80f64192cbaa8f289efaca313a3f32a9e3034b89140c45d2e9a",
        "The full text of the full report on the \u00c2\u00a31.2m   \"Pulses\" that can detect and identify malware has been published on Facebook, Twitter and Facebook.",
        "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT",
        "\u817e\u8baf\u5fae\u4e91",
        "iPhone 23_01_2023 16_08.chlsj"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 388,
        "URL": 351,
        "hostname": 153,
        "domain": 36,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 937,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "1195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://twitmazeed.com/show/djP",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://twitmazeed.com/show/djP",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780513595.036051
}