{
  "type": "URL",
  "indicator": "https://twitter.com/songculture",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://twitter.com/songculture",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #37",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #63",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain twitter.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain twitter.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4074165318,
      "indicator": "https://twitter.com/songculture",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "689af6a1704fa2745bc8c2a3",
          "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
          "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
          "modified": "2025-09-11T08:02:36.759000",
          "created": "2025-08-12T08:09:05.642000",
          "tags": [
            "log id",
            "gmtn",
            "secure",
            "tls web",
            "passive dns",
            "urls",
            "path",
            "self",
            "encrypt",
            "ca issuers",
            "false",
            "search",
            "read c",
            "united",
            "entries",
            "show",
            "showing",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "copy",
            "write",
            "suspicious",
            "malware",
            "unknown",
            "process32nextw",
            "shellexecuteexw",
            "medium process",
            "discovery t1057",
            "t1057",
            "discovery",
            "medium",
            "locally unique",
            "identifier",
            "veailmboprd",
            "next associated",
            "ipv4 add",
            "pulse pulses",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "smoke loader",
            "trojan",
            "body",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "show process",
            "programfiles",
            "command decode",
            "flag",
            "suricata ipv4",
            "mitre att",
            "show technique",
            "ck matrix",
            "date",
            "comspec",
            "model",
            "twitter",
            "august",
            "hybrid",
            "general",
            "click",
            "strings"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1504,
            "FileHash-SHA256": 1232,
            "SSLCertFingerprint": 14,
            "domain": 245,
            "hostname": 526,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 38
          },
          "indicator_count": 3602,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "262 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68451577ada8bb0aa0834edb",
          "name": "X - Business Social Media Account used to attack victim",
          "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
          "modified": "2025-07-08T04:03:04.386000",
          "created": "2025-06-08T04:45:43.423000",
          "tags": [
            "trojan",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "upxoepplace",
            "pulses none",
            "related tags",
            "none file",
            "markus",
            "april",
            "win32",
            "copy",
            "usvwu",
            "usvw",
            "high",
            "medium",
            "show",
            "uss c",
            "binary file",
            "yara",
            "write",
            "delphi",
            "enigma",
            "present mar",
            "aaaa",
            "united",
            "passive dns",
            "date",
            "present nov",
            "moved",
            "urls",
            "creation date",
            "entries",
            "body",
            "trojandropper",
            "susp",
            "msr jul",
            "next associated",
            "pulse pulses",
            "mtb jun",
            "backdoor",
            "content length",
            "html document",
            "ascii text",
            "search",
            "internalname",
            "entries pe",
            "showing",
            "filehash",
            "md5 add",
            "av detections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "encrypt",
            "june",
            "hybrid",
            "local",
            "path",
            "click",
            "twitter",
            "strings",
            "url https",
            "url http",
            "report spam",
            "created",
            "hours ago",
            "bad actor",
            "ck ids",
            "t1057",
            "discovery",
            "t1071",
            "amer",
            "ipv4",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "china",
            "hong kong",
            "russia",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "pulses url",
            "filehashsha256",
            "url add",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "domain",
            "hostname",
            "next",
            "filehashmd5",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 637,
            "FileHash-SHA1": 639,
            "FileHash-SHA256": 5380,
            "domain": 676,
            "hostname": 1120,
            "URL": 1031,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9487,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "327 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684522ae1f20db8b90ea41a4",
          "name": "Stealthy Nexus Australia -X.com attacks against monitored targets",
          "description": "Nexus-australia-websocket-Austraia .\n#malware  #injected #trojandropper #delf_deletes_spyware #spyware #malicious #badactor #backdoor #encrypts #warning_office_encrypted_doc",
          "modified": "2025-07-08T04:03:04.386000",
          "created": "2025-06-08T05:42:06.731000",
          "tags": [
            "url https",
            "url http",
            "united",
            "china",
            "hong kong",
            "russia",
            "search",
            "type indicator",
            "role title",
            "added active",
            "amer",
            "related pulses",
            "ipv4",
            "entries",
            "flag",
            "indicator role",
            "title added",
            "active related",
            "filehashmd5",
            "ck ids",
            "t1057",
            "discovery",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1553",
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "digicert tls",
            "rsa sha256",
            "tls web",
            "full name",
            "digicert inc",
            "organization",
            "false",
            "pulses hostname",
            "showing",
            "dynamicloader",
            "medium",
            "write c",
            "show",
            "yara detections",
            "copy",
            "high",
            "t1055",
            "write",
            "april",
            "report spam",
            "business social",
            "media account",
            "created",
            "minutes ago",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "detections name",
            "previous",
            "exif data",
            "value exe",
            "fileflags",
            "machinetype amd",
            "amd64 exe",
            "fileos windows",
            "pulse",
            "file score",
            "low risk",
            "pulses"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Financial"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 888,
            "domain": 115,
            "hostname": 275,
            "FileHash-MD5": 34,
            "FileHash-SHA256": 158,
            "FileHash-SHA1": 30,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 1502,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "327 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6843fe89793d0ef8e2afc34d",
          "name": "Deleted SocialMedia",
          "description": "Bad Actor Deleted SocialMedia account found in breach forum.",
          "modified": "2025-07-07T08:03:42.325000",
          "created": "2025-06-07T08:55:37.612000",
          "tags": [
            "body",
            "secure",
            "self",
            "path",
            "date sat",
            "gmt contenttype",
            "connection",
            "accept",
            "gmt pragma",
            "deny",
            "maxage34214400",
            "learn",
            "spawns",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "ssl certificate",
            "found",
            "copy sha256",
            "copy md5",
            "copy sha1",
            "sha1",
            "sha256",
            "size",
            "type data",
            "ascii text",
            "pattern match",
            "mitre att",
            "show technique",
            "ck matrix",
            "file",
            "indicator",
            "show process",
            "encrypt",
            "june",
            "hybrid",
            "local"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1628,
            "domain": 58,
            "URL": 390,
            "hostname": 204,
            "FileHash-MD5": 84,
            "FileHash-SHA1": 88,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 2456,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "328 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Financial"
          ],
          "unique_indicators": 14432
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/twitter.com",
    "whois": "http://whois.domaintools.com/twitter.com",
    "domain": "twitter.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "689af6a1704fa2745bc8c2a3",
      "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
      "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
      "modified": "2025-09-11T08:02:36.759000",
      "created": "2025-08-12T08:09:05.642000",
      "tags": [
        "log id",
        "gmtn",
        "secure",
        "tls web",
        "passive dns",
        "urls",
        "path",
        "self",
        "encrypt",
        "ca issuers",
        "false",
        "search",
        "read c",
        "united",
        "entries",
        "show",
        "showing",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "copy",
        "write",
        "suspicious",
        "malware",
        "unknown",
        "process32nextw",
        "shellexecuteexw",
        "medium process",
        "discovery t1057",
        "t1057",
        "discovery",
        "medium",
        "locally unique",
        "identifier",
        "veailmboprd",
        "next associated",
        "ipv4 add",
        "pulse pulses",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "smoke loader",
        "trojan",
        "body",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "show process",
        "programfiles",
        "command decode",
        "flag",
        "suricata ipv4",
        "mitre att",
        "show technique",
        "ck matrix",
        "date",
        "comspec",
        "model",
        "twitter",
        "august",
        "hybrid",
        "general",
        "click",
        "strings"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1504,
        "FileHash-SHA256": 1232,
        "SSLCertFingerprint": 14,
        "domain": 245,
        "hostname": 526,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 38
      },
      "indicator_count": 3602,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "262 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68451577ada8bb0aa0834edb",
      "name": "X - Business Social Media Account used to attack victim",
      "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
      "modified": "2025-07-08T04:03:04.386000",
      "created": "2025-06-08T04:45:43.423000",
      "tags": [
        "trojan",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "upxoepplace",
        "pulses none",
        "related tags",
        "none file",
        "markus",
        "april",
        "win32",
        "copy",
        "usvwu",
        "usvw",
        "high",
        "medium",
        "show",
        "uss c",
        "binary file",
        "yara",
        "write",
        "delphi",
        "enigma",
        "present mar",
        "aaaa",
        "united",
        "passive dns",
        "date",
        "present nov",
        "moved",
        "urls",
        "creation date",
        "entries",
        "body",
        "trojandropper",
        "susp",
        "msr jul",
        "next associated",
        "pulse pulses",
        "mtb jun",
        "backdoor",
        "content length",
        "html document",
        "ascii text",
        "search",
        "internalname",
        "entries pe",
        "showing",
        "filehash",
        "md5 add",
        "av detections",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "encrypt",
        "june",
        "hybrid",
        "local",
        "path",
        "click",
        "twitter",
        "strings",
        "url https",
        "url http",
        "report spam",
        "created",
        "hours ago",
        "bad actor",
        "ck ids",
        "t1057",
        "discovery",
        "t1071",
        "amer",
        "ipv4",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "china",
        "hong kong",
        "russia",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "pulses url",
        "filehashsha256",
        "url add",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "domain",
        "hostname",
        "next",
        "filehashmd5",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 637,
        "FileHash-SHA1": 639,
        "FileHash-SHA256": 5380,
        "domain": 676,
        "hostname": 1120,
        "URL": 1031,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9487,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "327 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684522ae1f20db8b90ea41a4",
      "name": "Stealthy Nexus Australia -X.com attacks against monitored targets",
      "description": "Nexus-australia-websocket-Austraia .\n#malware  #injected #trojandropper #delf_deletes_spyware #spyware #malicious #badactor #backdoor #encrypts #warning_office_encrypted_doc",
      "modified": "2025-07-08T04:03:04.386000",
      "created": "2025-06-08T05:42:06.731000",
      "tags": [
        "url https",
        "url http",
        "united",
        "china",
        "hong kong",
        "russia",
        "search",
        "type indicator",
        "role title",
        "added active",
        "amer",
        "related pulses",
        "ipv4",
        "entries",
        "flag",
        "indicator role",
        "title added",
        "active related",
        "filehashmd5",
        "ck ids",
        "t1057",
        "discovery",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1553",
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "digicert tls",
        "rsa sha256",
        "tls web",
        "full name",
        "digicert inc",
        "organization",
        "false",
        "pulses hostname",
        "showing",
        "dynamicloader",
        "medium",
        "write c",
        "show",
        "yara detections",
        "copy",
        "high",
        "t1055",
        "write",
        "april",
        "report spam",
        "business social",
        "media account",
        "created",
        "minutes ago",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "detections name",
        "previous",
        "exif data",
        "value exe",
        "fileflags",
        "machinetype amd",
        "amd64 exe",
        "fileos windows",
        "pulse",
        "file score",
        "low risk",
        "pulses"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Financial"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 888,
        "domain": 115,
        "hostname": 275,
        "FileHash-MD5": 34,
        "FileHash-SHA256": 158,
        "FileHash-SHA1": 30,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 1502,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "327 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6843fe89793d0ef8e2afc34d",
      "name": "Deleted SocialMedia",
      "description": "Bad Actor Deleted SocialMedia account found in breach forum.",
      "modified": "2025-07-07T08:03:42.325000",
      "created": "2025-06-07T08:55:37.612000",
      "tags": [
        "body",
        "secure",
        "self",
        "path",
        "date sat",
        "gmt contenttype",
        "connection",
        "accept",
        "gmt pragma",
        "deny",
        "maxage34214400",
        "learn",
        "spawns",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "ssl certificate",
        "found",
        "copy sha256",
        "copy md5",
        "copy sha1",
        "sha1",
        "sha256",
        "size",
        "type data",
        "ascii text",
        "pattern match",
        "mitre att",
        "show technique",
        "ck matrix",
        "file",
        "indicator",
        "show process",
        "encrypt",
        "june",
        "hybrid",
        "local"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1628,
        "domain": 58,
        "URL": 390,
        "hostname": 204,
        "FileHash-MD5": 84,
        "FileHash-SHA1": 88,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 2456,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "328 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://twitter.com/songculture",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://twitter.com/songculture",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780237757.173625
}