{
  "type": "URL",
  "indicator": "https://v7.swiperjs.com/migration-guide",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://v7.swiperjs.com/migration-guide",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4114467944,
      "indicator": "https://v7.swiperjs.com/migration-guide",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69b1f368db0d00947ef729c2",
          "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8",
          "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted",
          "modified": "2026-04-10T22:04:28.607000",
          "created": "2026-03-11T22:57:44.584000",
          "tags": [
            "\u9ed1\u6599",
            "\u5403\u74dc",
            "\u5403\u74dc\u7f51",
            "51\u5403\u74dc",
            "\u9ed1\u6599\u4e0d\u6253\u70ca",
            "\u9ed1\u6599\u5403\u74dc\u7f51",
            "\u70ed\u95e8\u5927\u74dc",
            "\u660e\u661f\u8d44\u8baf",
            "\u7f51\u7ea2\u9ed1\u6599",
            "\u5185\u6db5\u6bb5\u5b50",
            "\u4eca\u65e5\u5403\u74dc",
            "\u5403\u74dc\u65b0\u95fb",
            "\u9ed1\u6599\u66dd\u5149",
            "\u516b\u5366\u65b0\u95fb",
            "\u793e\u4f1a\u70ed\u70b9",
            "\u5403\u74dc\u7fa4\u4f17",
            "\u70ed\u70b9\u4e8b\u4ef6",
            "\u6bcf\u65e5\u5403\u74dc",
            "\u7f51\u7ea2\u5403\u74dc",
            "\u4eca\u65e5\u5927\u74dc",
            "\u5403\u74dc\u7206\u6599",
            "\u5403\u74dc\u4e2d\u5fc3",
            "\u4eca\u65e5\u70ed\u74dc",
            "\u5403\u74dc\u9ed1\u6599",
            "\u9ed1\u6599\u6cc4\u5bc6",
            "\u91cd\u78c5\u9ed1\u6599",
            "\u5403\u74dc\u6cc4\u5bc6",
            "\u4eca\u65e5\u9ed1\u6599",
            "\u6700\u65b0\u9ed1\u6599",
            "\u5403\u74dc\u66dd\u5149",
            "\u5403\u74dc\u8d44\u6e90",
            "\u91cd\u78c5\u5403\u74dc",
            "\u5a31\u4e50\u70ed\u74dc",
            "chrome",
            "cos ai",
            "a serif",
            "sans serif",
            "top10",
            "openclaw",
            "21200",
            "onlyfans",
            "strong",
            "dmca copyright",
            "address google",
            "safe browsing",
            "data upload",
            "extraction",
            "lte all",
            "enter sc",
            "type o",
            "extra",
            "referen https",
            "lte o",
            "type",
            "extr data",
            "include review",
            "exclude sugges",
            "failed",
            "hong kong",
            "passive dns",
            "otx logo",
            "all ipv4",
            "url analysis",
            "urls",
            "files",
            "location hong",
            "value",
            "march",
            "0x1595 function",
            "0x19b5 object",
            "tracker",
            "base64 object",
            "cookie function",
            "mlog",
            "localconst",
            "style function",
            "reverse dns",
            "general full",
            "url https",
            "resource",
            "software",
            "hash",
            "security tls",
            "singapore",
            "asn139341",
            "aceasap ace",
            "ip address",
            "cloudflare",
            "report",
            "whois",
            "as13335",
            "name lookup",
            "website",
            "kong",
            "ssl certificate",
            "http",
            "request chain",
            "nl redirected",
            "http redirect",
            "kb script",
            "protocol h3",
            "security quic",
            "seychelles",
            "asn13335",
            "cloudflarenet",
            "js function",
            "portable descr",
            "internet",
            "iana",
            "iana web",
            "stepgo limited",
            "assigned pa",
            "afrinic",
            "filtered parent",
            "ebene",
            "mahe",
            "stepgo",
            "united",
            "unknown ns",
            "script script",
            "moved",
            "record value",
            "title",
            "0 lte",
            "find s",
            "size",
            "mitre att",
            "ck id",
            "ck matrix",
            "root",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "yrbyd",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "initial access",
            "lalal.ai",
            "record type",
            "ttl value",
            "thumbprint",
            "ios ping",
            "defense evasion",
            "id name",
            "malicious",
            "t1055.015 list planting",
            "sha1",
            "copy md5",
            "sha256",
            "pattern match",
            "show technique",
            "unknown",
            "accept",
            "date",
            "local",
            "starfield",
            "encrypt",
            "iframe",
            "prometheus intelligence technology",
            "apple",
            "cyber attacks",
            "usptracker.com",
            "android"
          ],
          "references": [
            "https://airline.cmntgoyq.com/  | Prometheus Intelligence Technology",
            "lalal.ai",
            "logstream-mystifying-tharp-7si72pw.cribl.cloud",
            "quantum-staging.emsbk.com",
            "spf.google.com",
            "Amazon.com",
            "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru",
            "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/",
            "api-cookie.click",
            "delete-me.bgs.beanie.cloud",
            "bridge-websocket-evolosciuc.devint01.goodleap.com",
            "https://bombing.gwuzafo.cc/",
            "test-ssa.pineapples.dev",
            "sso.dev.applemarketingtools.com",
            "containers-oceanus.palantirsec.com",
            "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
            "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com",
            "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject",
            "Will sort to identify malware",
            "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4097,
            "domain": 849,
            "hostname": 2440,
            "FileHash-MD5": 149,
            "FileHash-SHA1": 131,
            "FileHash-SHA256": 955,
            "CIDR": 5,
            "email": 6,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 8640,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "8 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b235439d56630943ea31e6",
          "name": "Clone by Q Vashti (excellent systemic analyzer I may add)",
          "description": "",
          "modified": "2026-04-10T22:04:28.607000",
          "created": "2026-03-12T03:38:43.171000",
          "tags": [
            "\u9ed1\u6599",
            "\u5403\u74dc",
            "\u5403\u74dc\u7f51",
            "51\u5403\u74dc",
            "\u9ed1\u6599\u4e0d\u6253\u70ca",
            "\u9ed1\u6599\u5403\u74dc\u7f51",
            "\u70ed\u95e8\u5927\u74dc",
            "\u660e\u661f\u8d44\u8baf",
            "\u7f51\u7ea2\u9ed1\u6599",
            "\u5185\u6db5\u6bb5\u5b50",
            "\u4eca\u65e5\u5403\u74dc",
            "\u5403\u74dc\u65b0\u95fb",
            "\u9ed1\u6599\u66dd\u5149",
            "\u516b\u5366\u65b0\u95fb",
            "\u793e\u4f1a\u70ed\u70b9",
            "\u5403\u74dc\u7fa4\u4f17",
            "\u70ed\u70b9\u4e8b\u4ef6",
            "\u6bcf\u65e5\u5403\u74dc",
            "\u7f51\u7ea2\u5403\u74dc",
            "\u4eca\u65e5\u5927\u74dc",
            "\u5403\u74dc\u7206\u6599",
            "\u5403\u74dc\u4e2d\u5fc3",
            "\u4eca\u65e5\u70ed\u74dc",
            "\u5403\u74dc\u9ed1\u6599",
            "\u9ed1\u6599\u6cc4\u5bc6",
            "\u91cd\u78c5\u9ed1\u6599",
            "\u5403\u74dc\u6cc4\u5bc6",
            "\u4eca\u65e5\u9ed1\u6599",
            "\u6700\u65b0\u9ed1\u6599",
            "\u5403\u74dc\u66dd\u5149",
            "\u5403\u74dc\u8d44\u6e90",
            "\u91cd\u78c5\u5403\u74dc",
            "\u5a31\u4e50\u70ed\u74dc",
            "chrome",
            "cos ai",
            "a serif",
            "sans serif",
            "top10",
            "openclaw",
            "21200",
            "onlyfans",
            "strong",
            "dmca copyright",
            "address google",
            "safe browsing",
            "data upload",
            "extraction",
            "lte all",
            "enter sc",
            "type o",
            "extra",
            "referen https",
            "lte o",
            "type",
            "extr data",
            "include review",
            "exclude sugges",
            "failed",
            "hong kong",
            "passive dns",
            "otx logo",
            "all ipv4",
            "url analysis",
            "urls",
            "files",
            "location hong",
            "value",
            "march",
            "0x1595 function",
            "0x19b5 object",
            "tracker",
            "base64 object",
            "cookie function",
            "mlog",
            "localconst",
            "style function",
            "reverse dns",
            "general full",
            "url https",
            "resource",
            "software",
            "hash",
            "security tls",
            "singapore",
            "asn139341",
            "aceasap ace",
            "ip address",
            "cloudflare",
            "report",
            "whois",
            "as13335",
            "name lookup",
            "website",
            "kong",
            "ssl certificate",
            "http",
            "request chain",
            "nl redirected",
            "http redirect",
            "kb script",
            "protocol h3",
            "security quic",
            "seychelles",
            "asn13335",
            "cloudflarenet",
            "js function",
            "portable descr",
            "internet",
            "iana",
            "iana web",
            "stepgo limited",
            "assigned pa",
            "afrinic",
            "filtered parent",
            "ebene",
            "mahe",
            "stepgo",
            "united",
            "unknown ns",
            "script script",
            "moved",
            "record value",
            "title",
            "0 lte",
            "find s",
            "size",
            "mitre att",
            "ck id",
            "ck matrix",
            "root",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "yrbyd",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "initial access",
            "lalal.ai",
            "record type",
            "ttl value",
            "thumbprint",
            "ios ping",
            "defense evasion",
            "id name",
            "malicious",
            "t1055.015 list planting",
            "sha1",
            "copy md5",
            "sha256",
            "pattern match",
            "show technique",
            "unknown",
            "accept",
            "date",
            "local",
            "starfield",
            "encrypt",
            "iframe",
            "prometheus intelligence technology",
            "apple",
            "cyber attacks",
            "usptracker.com",
            "android"
          ],
          "references": [
            "https://airline.cmntgoyq.com/  | Prometheus Intelligence Technology",
            "lalal.ai",
            "logstream-mystifying-tharp-7si72pw.cribl.cloud",
            "quantum-staging.emsbk.com",
            "spf.google.com",
            "Amazon.com",
            "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru",
            "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/",
            "api-cookie.click",
            "delete-me.bgs.beanie.cloud",
            "bridge-websocket-evolosciuc.devint01.goodleap.com",
            "https://bombing.gwuzafo.cc/",
            "test-ssa.pineapples.dev",
            "sso.dev.applemarketingtools.com",
            "containers-oceanus.palantirsec.com",
            "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
            "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com",
            "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject",
            "Will sort to identify malware",
            "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1048",
              "name": "Exfiltration Over Alternative Protocol",
              "display_name": "T1048 - Exfiltration Over Alternative Protocol"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1048.003",
              "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
              "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69b1f368db0d00947ef729c2",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4097,
            "domain": 849,
            "hostname": 2440,
            "FileHash-MD5": 149,
            "FileHash-SHA1": 131,
            "FileHash-SHA256": 955,
            "CIDR": 5,
            "email": 6,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 8640,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "8 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69aa41b0d714318bf8937184",
          "name": "W.Vashti .Net obfuscator clone",
          "description": "",
          "modified": "2026-04-04T00:06:41.423000",
          "created": "2026-03-06T02:53:36.216000",
          "tags": [
            "no expiration",
            "domain",
            "name",
            "control flow",
            "dlls",
            "method parent",
            "declarative",
            "ms build",
            "core",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "dock",
            "write",
            "execution",
            "capture",
            "endgame",
            "united",
            "moved",
            "ip address",
            "record value",
            "gate software",
            "newnham house",
            "expiration date",
            "urls",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "present aug",
            "present sep",
            "present nov",
            "present oct",
            "name servers",
            "emails",
            "present dec",
            "meta",
            "passive dns",
            "next associated",
            "ipv4",
            "url analysis",
            "files",
            "cookie",
            "subscribe",
            "unsubscribe",
            "s paris",
            "englewood",
            "state",
            "skip",
            "espaol",
            "summary",
            "filing history",
            "ireland",
            "title",
            "united states",
            "certificate",
            "colorado",
            "ipv4 add",
            "america flag",
            "showing",
            "pulse submit",
            "size",
            "pattern match",
            "mitre att",
            "ck id",
            "path",
            "hybrid",
            "general",
            "local",
            "iframe",
            "click",
            "strings",
            "cece",
            "mult",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "t1590 gather",
            "victim network",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "sha1",
            "sha256",
            "njmk",
            "kwruymy",
            "mime",
            "submitted",
            "process details",
            "calls",
            "apis",
            "reads",
            "defense evasion",
            "model",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "value",
            "api call",
            "open",
            "august",
            "format",
            "typeof symbol",
            "typeof s",
            "typeof c",
            "function",
            "symbol",
            "comenabled",
            "image path",
            "ndex",
            "ndroleextdll",
            "f0f0f0",
            "ff4b55",
            "stop",
            "span",
            "show process",
            "binary file",
            "file",
            "network traffic",
            "encrypt",
            "date",
            "found",
            "ssl certificate",
            "creation date",
            "hostname add",
            "pulse pulses",
            "files ip",
            "address domain",
            "data upload",
            "extraction",
            "ge6 mira",
            "failed",
            "ascii text",
            "development att",
            "hostname",
            "files domain",
            "files related",
            "pulses otx",
            "pulses",
            "unknown aaaa",
            "unknown ns",
            "united states",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "a domains",
            "search",
            "germany unknown",
            "win32",
            "lowfi",
            "chrome",
            "susp",
            "trojan",
            "backdoor",
            "twitter",
            "virtool",
            "worm",
            "exploit",
            "trojandropper",
            "win32upatre dec",
            "mtb dec",
            "reverse dns",
            "body",
            "location united",
            "asn as14618",
            "less whois",
            "files show",
            "date hash",
            "avast avg",
            "initial access",
            "javascript",
            "root",
            "enterprise",
            "form",
            "desktop",
            "command decode",
            "suricata ipv4",
            "spycloud",
            "robots",
            "bots",
            "chatbot",
            "bot network",
            "spy",
            "mixb",
            "a2fryx",
            "therahand",
            "typosquating"
          ],
          "references": [
            "https://www.red-gate.com/products/smartassembly",
            "spycloud.com \u2022 content.spycloud.com \u2022 email.spycloud.com\t hostname\tengage.spycloud.com \u2022 hello.spycloud.com \u2022portal.spycloud.com \u2022 https://email.spycloud",
            "https://email.spycloud.com/NzEzLVdJUC03MzcAAAGe67eM-W3qxAlVkEvZwfw1dWuwRdm0zVU5aMyOzUe2IkxAY3hDe8RfT27HnjgkvTk-uqIy6K0=",
            "https://spycloud.com/solutions/\t\u2022 104.18.26.108 ELF:Mirai-GH\\ [Trj] \u2022 Unix.Dropper.Mirai-7135870-0",
            "dasima-containers.palantirfoundry.com \u2022 blitzrobots.com",
            "https://blog.endgames.com/ \u2022 wg41xm05b3.endgamesystems.com",
            "https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&masterFileId=20221473927&entityId2=20221473927&fileId=20251525819&srchTyp=ENTITY",
            "www.onyx-ware.com \u2022 http://pages.endgames.com/ \u2022  http://www.endgamesystems.com/",
            "https://hybrid-analysis.com/sample/9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3/68a4adea30f7fafee90aefd3",
            "Malicious: http://developers.cloudfiare.com/support/troubleshooting/http-status-",
            "Typosquating: developers.cloudfiare.com \u2022 cloudfiare.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Unix.Dropper.Mirai-7135870-0",
              "display_name": "Unix.Dropper.Mirai-7135870-0",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6952d4fc6910b0b866746d8a",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 341,
            "FileHash-SHA1": 343,
            "FileHash-SHA256": 1332,
            "domain": 1062,
            "hostname": 1969,
            "URL": 5700,
            "email": 10,
            "SSLCertFingerprint": 21,
            "CVE": 1
          },
          "indicator_count": 10779,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "15 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6952d4fc6910b0b866746d8a",
          "name": ".NET Obfuscator, Error Reporting, DLL Merging | SmartAssembly | Spycloud",
          "description": "*Mirai | Currently being used maliciously. Mirai botnet work in place. Obfuscation, call redirection, evasion , chatbots, spyware , cal retrieval , typosquating , and other tactics used against victim.   Red hats being unethical is expected.. This team is attacking in this instance. Screen Capture 24/7. Malicious media +++ from Englewood, Co. \n\nWhen used ethically SmartAssembly protects your code and Intellectual Property with powerful obfuscation features, and provides error reports when your application crashes in the wild, as well as a range of other tools for database management and data management.\n#palantir #foundry #denver #englewood #colorado #spycloud #mirai #botnet",
          "modified": "2026-01-28T18:03:54.589000",
          "created": "2025-12-29T19:22:36.103000",
          "tags": [
            "no expiration",
            "domain",
            "name",
            "control flow",
            "dlls",
            "method parent",
            "declarative",
            "ms build",
            "core",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "dock",
            "write",
            "execution",
            "capture",
            "endgame",
            "united",
            "moved",
            "ip address",
            "record value",
            "gate software",
            "newnham house",
            "expiration date",
            "urls",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "present aug",
            "present sep",
            "present nov",
            "present oct",
            "name servers",
            "emails",
            "present dec",
            "meta",
            "passive dns",
            "next associated",
            "ipv4",
            "url analysis",
            "files",
            "cookie",
            "subscribe",
            "unsubscribe",
            "s paris",
            "englewood",
            "state",
            "skip",
            "espaol",
            "summary",
            "filing history",
            "ireland",
            "title",
            "united states",
            "certificate",
            "colorado",
            "ipv4 add",
            "america flag",
            "showing",
            "pulse submit",
            "size",
            "pattern match",
            "mitre att",
            "ck id",
            "path",
            "hybrid",
            "general",
            "local",
            "iframe",
            "click",
            "strings",
            "cece",
            "mult",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "t1590 gather",
            "victim network",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "sha1",
            "sha256",
            "njmk",
            "kwruymy",
            "mime",
            "submitted",
            "process details",
            "calls",
            "apis",
            "reads",
            "defense evasion",
            "model",
            "getprocaddress",
            "show technique",
            "ck matrix",
            "access type",
            "value",
            "api call",
            "open",
            "august",
            "format",
            "typeof symbol",
            "typeof s",
            "typeof c",
            "function",
            "symbol",
            "comenabled",
            "image path",
            "ndex",
            "ndroleextdll",
            "f0f0f0",
            "ff4b55",
            "stop",
            "span",
            "show process",
            "binary file",
            "file",
            "network traffic",
            "encrypt",
            "date",
            "found",
            "ssl certificate",
            "creation date",
            "hostname add",
            "pulse pulses",
            "files ip",
            "address domain",
            "data upload",
            "extraction",
            "ge6 mira",
            "failed",
            "ascii text",
            "development att",
            "hostname",
            "files domain",
            "files related",
            "pulses otx",
            "pulses",
            "unknown aaaa",
            "unknown ns",
            "united states",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "a domains",
            "search",
            "germany unknown",
            "win32",
            "lowfi",
            "chrome",
            "susp",
            "trojan",
            "backdoor",
            "twitter",
            "virtool",
            "worm",
            "exploit",
            "trojandropper",
            "win32upatre dec",
            "mtb dec",
            "reverse dns",
            "body",
            "location united",
            "asn as14618",
            "less whois",
            "files show",
            "date hash",
            "avast avg",
            "initial access",
            "javascript",
            "root",
            "enterprise",
            "form",
            "desktop",
            "command decode",
            "suricata ipv4",
            "spycloud",
            "robots",
            "bots",
            "chatbot",
            "bot network",
            "spy",
            "mixb",
            "a2fryx",
            "therahand",
            "typosquating"
          ],
          "references": [
            "https://www.red-gate.com/products/smartassembly",
            "spycloud.com \u2022 content.spycloud.com \u2022 email.spycloud.com\t hostname\tengage.spycloud.com \u2022 hello.spycloud.com \u2022portal.spycloud.com \u2022 https://email.spycloud",
            "https://email.spycloud.com/NzEzLVdJUC03MzcAAAGe67eM-W3qxAlVkEvZwfw1dWuwRdm0zVU5aMyOzUe2IkxAY3hDe8RfT27HnjgkvTk-uqIy6K0=",
            "https://spycloud.com/solutions/\t\u2022 104.18.26.108 ELF:Mirai-GH\\ [Trj] \u2022 Unix.Dropper.Mirai-7135870-0",
            "dasima-containers.palantirfoundry.com \u2022 blitzrobots.com",
            "https://blog.endgames.com/ \u2022 wg41xm05b3.endgamesystems.com",
            "https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&masterFileId=20221473927&entityId2=20221473927&fileId=20251525819&srchTyp=ENTITY",
            "www.onyx-ware.com \u2022 http://pages.endgames.com/ \u2022  http://www.endgamesystems.com/",
            "https://hybrid-analysis.com/sample/9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3/68a4adea30f7fafee90aefd3",
            "Malicious: http://developers.cloudfiare.com/support/troubleshooting/http-status-",
            "Typosquating: developers.cloudfiare.com \u2022 cloudfiare.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Unix.Dropper.Mirai-7135870-0",
              "display_name": "Unix.Dropper.Mirai-7135870-0",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1116",
              "name": "Code Signing",
              "display_name": "T1116 - Code Signing"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 341,
            "FileHash-SHA1": 343,
            "FileHash-SHA256": 1332,
            "domain": 1062,
            "hostname": 1967,
            "URL": 5699,
            "email": 10,
            "SSLCertFingerprint": 21,
            "CVE": 1
          },
          "indicator_count": 10776,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "80 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6892e73b32af18aa302df0dc",
          "name": "Part 1.5",
          "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
          "modified": "2025-09-05T04:03:06.929000",
          "created": "2025-08-06T05:25:15.369000",
          "tags": [
            "chromeua",
            "optout",
            "object",
            "path",
            "value",
            "access type",
            "setval",
            "windir",
            "localappdata",
            "null",
            "win64",
            "error",
            "generator",
            "close",
            "roboto",
            "date",
            "format",
            "light",
            "span",
            "template",
            "void",
            "android",
            "body",
            "trident",
            "mexico",
            "sonic",
            "black",
            "critical",
            "desktop",
            "dark",
            "meta",
            "this",
            "june",
            "hybrid",
            "apache",
            "write",
            "crypto",
            "autodetect",
            "face",
            "courier",
            "gigi",
            "impact",
            "shadow",
            "click",
            "strings",
            "cray",
            "smwg",
            "eret",
            "footer",
            "infinity",
            "window",
            "canvas",
            "legend",
            "nuke",
            "lion",
            "4629",
            "ahav",
            "olsa",
            "false",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "script",
            "mitre att",
            "pattern match",
            "show technique",
            "iframe",
            "refresh",
            "august",
            "general",
            "local",
            "tools",
            "demo",
            "look",
            "verify",
            "restart",
            "url http",
            "small",
            "pulses url",
            "tellyoun",
            "showing",
            "entries",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "cc08",
            "f06a6b",
            "sfurl",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "pulses",
            "filehashsha1",
            "adversaries",
            "found",
            "webp image",
            "ascii text",
            "riff",
            "size",
            "encrypt",
            "legacy",
            "filehashmd5",
            "united",
            "flag",
            "server",
            "markmonitor",
            "name server",
            "llc name",
            "overview dns",
            "requests domain",
            "country",
            "win32",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "medium risk",
            "yara",
            "detections",
            "malware",
            "copy",
            "show",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pdb path",
            "pe resource",
            "extraction",
            "data upload",
            "enter sc",
            "type",
            "extra data",
            "please",
            "failed",
            "review",
            "exclude data",
            "included review",
            "ic data",
            "suggeste",
            "stop",
            "type onow",
            "domain",
            "passive dns",
            "urls",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "safe browsing",
            "sc data",
            "extr amanuav",
            "review included",
            "manualy",
            "sugges excluded",
            "filehash",
            "md5 add",
            "pulse pulses",
            "url add",
            "http",
            "hostname",
            "files domain",
            "pulses otx",
            "virustotal",
            "hsmi192547107",
            "pulses hostname",
            "r dec",
            "customer dec",
            "iski dec",
            "decision dec",
            "va dec",
            "bitcoin",
            "bitcoin dec",
            "petra",
            "torstatus dec",
            "paul dec",
            "sodesc",
            "planet dec",
            "emilia",
            "heroin dec",
            "difference dec",
            "palantir dec",
            "loraxlive dec",
            "chaturbate dec",
            "sandra",
            "free dec",
            "marvel dec",
            "benjis dec",
            "fresh dec",
            "sodesc dec",
            "srdirport",
            "srhostname",
            "link dec",
            "types of",
            "italy",
            "china",
            "australia",
            "france",
            "turkey",
            "discovery",
            "information",
            "ck ids",
            "t1005",
            "local system",
            "t1007",
            "system service",
            "part",
            "track",
            "locate",
            "political",
            "civil society",
            "news",
            "created",
            "hours ago",
            "report spam",
            "t1555",
            "password",
            "t1560",
            "collected data",
            "t1573",
            "channel",
            "t1574",
            "execution flow",
            "scan",
            "iocs",
            "t1497",
            "u0lhmq",
            "mtawmq",
            "t1480",
            "guardrails",
            "t1486",
            "data encrypted",
            "learn more",
            "unsubscribe aug",
            "protocol",
            "t1074",
            "staged",
            "t1083",
            "t1102",
            "web service",
            "t1105",
            "tool transfer",
            "t1140",
            "data engineer",
            "candidate",
            "tlsv1",
            "odigicert inc",
            "stcalifornia",
            "lsan jose",
            "oadobe systems",
            "incorporated",
            "cndigicert sha2",
            "push",
            "next",
            "high",
            "write c",
            "ireland as16509",
            "delete",
            "dirty",
            "tags",
            "t1012",
            "flow endpoint",
            "security scan",
            "t1106",
            "copyright",
            "levelblue"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 608,
            "FileHash-SHA1": 433,
            "FileHash-SHA256": 3663,
            "URL": 17104,
            "domain": 1316,
            "email": 39,
            "hostname": 4208,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 27388,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/",
        "Typosquating: developers.cloudfiare.com \u2022 cloudfiare.com",
        "https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&masterFileId=20221473927&entityId2=20221473927&fileId=20251525819&srchTyp=ENTITY",
        "dasima-containers.palantirfoundry.com \u2022 blitzrobots.com",
        "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com",
        "https://blog.endgames.com/ \u2022 wg41xm05b3.endgamesystems.com",
        "bridge-websocket-evolosciuc.devint01.goodleap.com",
        "Malicious: http://developers.cloudfiare.com/support/troubleshooting/http-status-",
        "spycloud.com \u2022 content.spycloud.com \u2022 email.spycloud.com\t hostname\tengage.spycloud.com \u2022 hello.spycloud.com \u2022portal.spycloud.com \u2022 https://email.spycloud",
        "https://hybrid-analysis.com/sample/9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3/68a4adea30f7fafee90aefd3",
        "https://airline.cmntgoyq.com/  | Prometheus Intelligence Technology",
        "quantum-staging.emsbk.com",
        "www.onyx-ware.com \u2022 http://pages.endgames.com/ \u2022  http://www.endgamesystems.com/",
        "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru",
        "https://spycloud.com/solutions/\t\u2022 104.18.26.108 ELF:Mirai-GH\\ [Trj] \u2022 Unix.Dropper.Mirai-7135870-0",
        "https://www.red-gate.com/products/smartassembly",
        "test-ssa.pineapples.dev",
        "spf.google.com",
        "lalal.ai",
        "Amazon.com",
        "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject",
        "containers-oceanus.palantirsec.com",
        "https://bombing.gwuzafo.cc/",
        "Will sort to identify malware",
        "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "delete-me.bgs.beanie.cloud",
        "https://email.spycloud.com/NzEzLVdJUC03MzcAAAGe67eM-W3qxAlVkEvZwfw1dWuwRdm0zVU5aMyOzUe2IkxAY3hDe8RfT27HnjgkvTk-uqIy6K0=",
        "logstream-mystifying-tharp-7si72pw.cribl.cloud",
        "sso.dev.applemarketingtools.com",
        "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db",
        "api-cookie.click"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Malware",
            "Elf:mirai-gh\\ [trj]",
            "Unix.dropper.mirai-7135870-0"
          ],
          "industries": [],
          "unique_indicators": 46359
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/swiperjs.com",
    "whois": "http://whois.domaintools.com/swiperjs.com",
    "domain": "swiperjs.com",
    "hostname": "v7.swiperjs.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69b1f368db0d00947ef729c2",
      "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8",
      "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted",
      "modified": "2026-04-10T22:04:28.607000",
      "created": "2026-03-11T22:57:44.584000",
      "tags": [
        "\u9ed1\u6599",
        "\u5403\u74dc",
        "\u5403\u74dc\u7f51",
        "51\u5403\u74dc",
        "\u9ed1\u6599\u4e0d\u6253\u70ca",
        "\u9ed1\u6599\u5403\u74dc\u7f51",
        "\u70ed\u95e8\u5927\u74dc",
        "\u660e\u661f\u8d44\u8baf",
        "\u7f51\u7ea2\u9ed1\u6599",
        "\u5185\u6db5\u6bb5\u5b50",
        "\u4eca\u65e5\u5403\u74dc",
        "\u5403\u74dc\u65b0\u95fb",
        "\u9ed1\u6599\u66dd\u5149",
        "\u516b\u5366\u65b0\u95fb",
        "\u793e\u4f1a\u70ed\u70b9",
        "\u5403\u74dc\u7fa4\u4f17",
        "\u70ed\u70b9\u4e8b\u4ef6",
        "\u6bcf\u65e5\u5403\u74dc",
        "\u7f51\u7ea2\u5403\u74dc",
        "\u4eca\u65e5\u5927\u74dc",
        "\u5403\u74dc\u7206\u6599",
        "\u5403\u74dc\u4e2d\u5fc3",
        "\u4eca\u65e5\u70ed\u74dc",
        "\u5403\u74dc\u9ed1\u6599",
        "\u9ed1\u6599\u6cc4\u5bc6",
        "\u91cd\u78c5\u9ed1\u6599",
        "\u5403\u74dc\u6cc4\u5bc6",
        "\u4eca\u65e5\u9ed1\u6599",
        "\u6700\u65b0\u9ed1\u6599",
        "\u5403\u74dc\u66dd\u5149",
        "\u5403\u74dc\u8d44\u6e90",
        "\u91cd\u78c5\u5403\u74dc",
        "\u5a31\u4e50\u70ed\u74dc",
        "chrome",
        "cos ai",
        "a serif",
        "sans serif",
        "top10",
        "openclaw",
        "21200",
        "onlyfans",
        "strong",
        "dmca copyright",
        "address google",
        "safe browsing",
        "data upload",
        "extraction",
        "lte all",
        "enter sc",
        "type o",
        "extra",
        "referen https",
        "lte o",
        "type",
        "extr data",
        "include review",
        "exclude sugges",
        "failed",
        "hong kong",
        "passive dns",
        "otx logo",
        "all ipv4",
        "url analysis",
        "urls",
        "files",
        "location hong",
        "value",
        "march",
        "0x1595 function",
        "0x19b5 object",
        "tracker",
        "base64 object",
        "cookie function",
        "mlog",
        "localconst",
        "style function",
        "reverse dns",
        "general full",
        "url https",
        "resource",
        "software",
        "hash",
        "security tls",
        "singapore",
        "asn139341",
        "aceasap ace",
        "ip address",
        "cloudflare",
        "report",
        "whois",
        "as13335",
        "name lookup",
        "website",
        "kong",
        "ssl certificate",
        "http",
        "request chain",
        "nl redirected",
        "http redirect",
        "kb script",
        "protocol h3",
        "security quic",
        "seychelles",
        "asn13335",
        "cloudflarenet",
        "js function",
        "portable descr",
        "internet",
        "iana",
        "iana web",
        "stepgo limited",
        "assigned pa",
        "afrinic",
        "filtered parent",
        "ebene",
        "mahe",
        "stepgo",
        "united",
        "unknown ns",
        "script script",
        "moved",
        "record value",
        "title",
        "0 lte",
        "find s",
        "size",
        "mitre att",
        "ck id",
        "ck matrix",
        "root",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "yrbyd",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "initial access",
        "lalal.ai",
        "record type",
        "ttl value",
        "thumbprint",
        "ios ping",
        "defense evasion",
        "id name",
        "malicious",
        "t1055.015 list planting",
        "sha1",
        "copy md5",
        "sha256",
        "pattern match",
        "show technique",
        "unknown",
        "accept",
        "date",
        "local",
        "starfield",
        "encrypt",
        "iframe",
        "prometheus intelligence technology",
        "apple",
        "cyber attacks",
        "usptracker.com",
        "android"
      ],
      "references": [
        "https://airline.cmntgoyq.com/  | Prometheus Intelligence Technology",
        "lalal.ai",
        "logstream-mystifying-tharp-7si72pw.cribl.cloud",
        "quantum-staging.emsbk.com",
        "spf.google.com",
        "Amazon.com",
        "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru",
        "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/",
        "api-cookie.click",
        "delete-me.bgs.beanie.cloud",
        "bridge-websocket-evolosciuc.devint01.goodleap.com",
        "https://bombing.gwuzafo.cc/",
        "test-ssa.pineapples.dev",
        "sso.dev.applemarketingtools.com",
        "containers-oceanus.palantirsec.com",
        "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com",
        "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject",
        "Will sort to identify malware",
        "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4097,
        "domain": 849,
        "hostname": 2440,
        "FileHash-MD5": 149,
        "FileHash-SHA1": 131,
        "FileHash-SHA256": 955,
        "CIDR": 5,
        "email": 6,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 8640,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "8 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b235439d56630943ea31e6",
      "name": "Clone by Q Vashti (excellent systemic analyzer I may add)",
      "description": "",
      "modified": "2026-04-10T22:04:28.607000",
      "created": "2026-03-12T03:38:43.171000",
      "tags": [
        "\u9ed1\u6599",
        "\u5403\u74dc",
        "\u5403\u74dc\u7f51",
        "51\u5403\u74dc",
        "\u9ed1\u6599\u4e0d\u6253\u70ca",
        "\u9ed1\u6599\u5403\u74dc\u7f51",
        "\u70ed\u95e8\u5927\u74dc",
        "\u660e\u661f\u8d44\u8baf",
        "\u7f51\u7ea2\u9ed1\u6599",
        "\u5185\u6db5\u6bb5\u5b50",
        "\u4eca\u65e5\u5403\u74dc",
        "\u5403\u74dc\u65b0\u95fb",
        "\u9ed1\u6599\u66dd\u5149",
        "\u516b\u5366\u65b0\u95fb",
        "\u793e\u4f1a\u70ed\u70b9",
        "\u5403\u74dc\u7fa4\u4f17",
        "\u70ed\u70b9\u4e8b\u4ef6",
        "\u6bcf\u65e5\u5403\u74dc",
        "\u7f51\u7ea2\u5403\u74dc",
        "\u4eca\u65e5\u5927\u74dc",
        "\u5403\u74dc\u7206\u6599",
        "\u5403\u74dc\u4e2d\u5fc3",
        "\u4eca\u65e5\u70ed\u74dc",
        "\u5403\u74dc\u9ed1\u6599",
        "\u9ed1\u6599\u6cc4\u5bc6",
        "\u91cd\u78c5\u9ed1\u6599",
        "\u5403\u74dc\u6cc4\u5bc6",
        "\u4eca\u65e5\u9ed1\u6599",
        "\u6700\u65b0\u9ed1\u6599",
        "\u5403\u74dc\u66dd\u5149",
        "\u5403\u74dc\u8d44\u6e90",
        "\u91cd\u78c5\u5403\u74dc",
        "\u5a31\u4e50\u70ed\u74dc",
        "chrome",
        "cos ai",
        "a serif",
        "sans serif",
        "top10",
        "openclaw",
        "21200",
        "onlyfans",
        "strong",
        "dmca copyright",
        "address google",
        "safe browsing",
        "data upload",
        "extraction",
        "lte all",
        "enter sc",
        "type o",
        "extra",
        "referen https",
        "lte o",
        "type",
        "extr data",
        "include review",
        "exclude sugges",
        "failed",
        "hong kong",
        "passive dns",
        "otx logo",
        "all ipv4",
        "url analysis",
        "urls",
        "files",
        "location hong",
        "value",
        "march",
        "0x1595 function",
        "0x19b5 object",
        "tracker",
        "base64 object",
        "cookie function",
        "mlog",
        "localconst",
        "style function",
        "reverse dns",
        "general full",
        "url https",
        "resource",
        "software",
        "hash",
        "security tls",
        "singapore",
        "asn139341",
        "aceasap ace",
        "ip address",
        "cloudflare",
        "report",
        "whois",
        "as13335",
        "name lookup",
        "website",
        "kong",
        "ssl certificate",
        "http",
        "request chain",
        "nl redirected",
        "http redirect",
        "kb script",
        "protocol h3",
        "security quic",
        "seychelles",
        "asn13335",
        "cloudflarenet",
        "js function",
        "portable descr",
        "internet",
        "iana",
        "iana web",
        "stepgo limited",
        "assigned pa",
        "afrinic",
        "filtered parent",
        "ebene",
        "mahe",
        "stepgo",
        "united",
        "unknown ns",
        "script script",
        "moved",
        "record value",
        "title",
        "0 lte",
        "find s",
        "size",
        "mitre att",
        "ck id",
        "ck matrix",
        "root",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "yrbyd",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "initial access",
        "lalal.ai",
        "record type",
        "ttl value",
        "thumbprint",
        "ios ping",
        "defense evasion",
        "id name",
        "malicious",
        "t1055.015 list planting",
        "sha1",
        "copy md5",
        "sha256",
        "pattern match",
        "show technique",
        "unknown",
        "accept",
        "date",
        "local",
        "starfield",
        "encrypt",
        "iframe",
        "prometheus intelligence technology",
        "apple",
        "cyber attacks",
        "usptracker.com",
        "android"
      ],
      "references": [
        "https://airline.cmntgoyq.com/  | Prometheus Intelligence Technology",
        "lalal.ai",
        "logstream-mystifying-tharp-7si72pw.cribl.cloud",
        "quantum-staging.emsbk.com",
        "spf.google.com",
        "Amazon.com",
        "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru",
        "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/",
        "api-cookie.click",
        "delete-me.bgs.beanie.cloud",
        "bridge-websocket-evolosciuc.devint01.goodleap.com",
        "https://bombing.gwuzafo.cc/",
        "test-ssa.pineapples.dev",
        "sso.dev.applemarketingtools.com",
        "containers-oceanus.palantirsec.com",
        "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14",
        "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com",
        "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject",
        "Will sort to identify malware",
        "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1048",
          "name": "Exfiltration Over Alternative Protocol",
          "display_name": "T1048 - Exfiltration Over Alternative Protocol"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1048.003",
          "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol",
          "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69b1f368db0d00947ef729c2",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4097,
        "domain": 849,
        "hostname": 2440,
        "FileHash-MD5": 149,
        "FileHash-SHA1": 131,
        "FileHash-SHA256": 955,
        "CIDR": 5,
        "email": 6,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 8640,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "8 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69aa41b0d714318bf8937184",
      "name": "W.Vashti .Net obfuscator clone",
      "description": "",
      "modified": "2026-04-04T00:06:41.423000",
      "created": "2026-03-06T02:53:36.216000",
      "tags": [
        "no expiration",
        "domain",
        "name",
        "control flow",
        "dlls",
        "method parent",
        "declarative",
        "ms build",
        "core",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "dock",
        "write",
        "execution",
        "capture",
        "endgame",
        "united",
        "moved",
        "ip address",
        "record value",
        "gate software",
        "newnham house",
        "expiration date",
        "urls",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "present aug",
        "present sep",
        "present nov",
        "present oct",
        "name servers",
        "emails",
        "present dec",
        "meta",
        "passive dns",
        "next associated",
        "ipv4",
        "url analysis",
        "files",
        "cookie",
        "subscribe",
        "unsubscribe",
        "s paris",
        "englewood",
        "state",
        "skip",
        "espaol",
        "summary",
        "filing history",
        "ireland",
        "title",
        "united states",
        "certificate",
        "colorado",
        "ipv4 add",
        "america flag",
        "showing",
        "pulse submit",
        "size",
        "pattern match",
        "mitre att",
        "ck id",
        "path",
        "hybrid",
        "general",
        "local",
        "iframe",
        "click",
        "strings",
        "cece",
        "mult",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "t1590 gather",
        "victim network",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "sha1",
        "sha256",
        "njmk",
        "kwruymy",
        "mime",
        "submitted",
        "process details",
        "calls",
        "apis",
        "reads",
        "defense evasion",
        "model",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "value",
        "api call",
        "open",
        "august",
        "format",
        "typeof symbol",
        "typeof s",
        "typeof c",
        "function",
        "symbol",
        "comenabled",
        "image path",
        "ndex",
        "ndroleextdll",
        "f0f0f0",
        "ff4b55",
        "stop",
        "span",
        "show process",
        "binary file",
        "file",
        "network traffic",
        "encrypt",
        "date",
        "found",
        "ssl certificate",
        "creation date",
        "hostname add",
        "pulse pulses",
        "files ip",
        "address domain",
        "data upload",
        "extraction",
        "ge6 mira",
        "failed",
        "ascii text",
        "development att",
        "hostname",
        "files domain",
        "files related",
        "pulses otx",
        "pulses",
        "unknown aaaa",
        "unknown ns",
        "united states",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "a domains",
        "search",
        "germany unknown",
        "win32",
        "lowfi",
        "chrome",
        "susp",
        "trojan",
        "backdoor",
        "twitter",
        "virtool",
        "worm",
        "exploit",
        "trojandropper",
        "win32upatre dec",
        "mtb dec",
        "reverse dns",
        "body",
        "location united",
        "asn as14618",
        "less whois",
        "files show",
        "date hash",
        "avast avg",
        "initial access",
        "javascript",
        "root",
        "enterprise",
        "form",
        "desktop",
        "command decode",
        "suricata ipv4",
        "spycloud",
        "robots",
        "bots",
        "chatbot",
        "bot network",
        "spy",
        "mixb",
        "a2fryx",
        "therahand",
        "typosquating"
      ],
      "references": [
        "https://www.red-gate.com/products/smartassembly",
        "spycloud.com \u2022 content.spycloud.com \u2022 email.spycloud.com\t hostname\tengage.spycloud.com \u2022 hello.spycloud.com \u2022portal.spycloud.com \u2022 https://email.spycloud",
        "https://email.spycloud.com/NzEzLVdJUC03MzcAAAGe67eM-W3qxAlVkEvZwfw1dWuwRdm0zVU5aMyOzUe2IkxAY3hDe8RfT27HnjgkvTk-uqIy6K0=",
        "https://spycloud.com/solutions/\t\u2022 104.18.26.108 ELF:Mirai-GH\\ [Trj] \u2022 Unix.Dropper.Mirai-7135870-0",
        "dasima-containers.palantirfoundry.com \u2022 blitzrobots.com",
        "https://blog.endgames.com/ \u2022 wg41xm05b3.endgamesystems.com",
        "https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&masterFileId=20221473927&entityId2=20221473927&fileId=20251525819&srchTyp=ENTITY",
        "www.onyx-ware.com \u2022 http://pages.endgames.com/ \u2022  http://www.endgamesystems.com/",
        "https://hybrid-analysis.com/sample/9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3/68a4adea30f7fafee90aefd3",
        "Malicious: http://developers.cloudfiare.com/support/troubleshooting/http-status-",
        "Typosquating: developers.cloudfiare.com \u2022 cloudfiare.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Unix.Dropper.Mirai-7135870-0",
          "display_name": "Unix.Dropper.Mirai-7135870-0",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6952d4fc6910b0b866746d8a",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 341,
        "FileHash-SHA1": 343,
        "FileHash-SHA256": 1332,
        "domain": 1062,
        "hostname": 1969,
        "URL": 5700,
        "email": 10,
        "SSLCertFingerprint": 21,
        "CVE": 1
      },
      "indicator_count": 10779,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "15 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6952d4fc6910b0b866746d8a",
      "name": ".NET Obfuscator, Error Reporting, DLL Merging | SmartAssembly | Spycloud",
      "description": "*Mirai | Currently being used maliciously. Mirai botnet work in place. Obfuscation, call redirection, evasion , chatbots, spyware , cal retrieval , typosquating , and other tactics used against victim.   Red hats being unethical is expected.. This team is attacking in this instance. Screen Capture 24/7. Malicious media +++ from Englewood, Co. \n\nWhen used ethically SmartAssembly protects your code and Intellectual Property with powerful obfuscation features, and provides error reports when your application crashes in the wild, as well as a range of other tools for database management and data management.\n#palantir #foundry #denver #englewood #colorado #spycloud #mirai #botnet",
      "modified": "2026-01-28T18:03:54.589000",
      "created": "2025-12-29T19:22:36.103000",
      "tags": [
        "no expiration",
        "domain",
        "name",
        "control flow",
        "dlls",
        "method parent",
        "declarative",
        "ms build",
        "core",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "dock",
        "write",
        "execution",
        "capture",
        "endgame",
        "united",
        "moved",
        "ip address",
        "record value",
        "gate software",
        "newnham house",
        "expiration date",
        "urls",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "present aug",
        "present sep",
        "present nov",
        "present oct",
        "name servers",
        "emails",
        "present dec",
        "meta",
        "passive dns",
        "next associated",
        "ipv4",
        "url analysis",
        "files",
        "cookie",
        "subscribe",
        "unsubscribe",
        "s paris",
        "englewood",
        "state",
        "skip",
        "espaol",
        "summary",
        "filing history",
        "ireland",
        "title",
        "united states",
        "certificate",
        "colorado",
        "ipv4 add",
        "america flag",
        "showing",
        "pulse submit",
        "size",
        "pattern match",
        "mitre att",
        "ck id",
        "path",
        "hybrid",
        "general",
        "local",
        "iframe",
        "click",
        "strings",
        "cece",
        "mult",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "t1590 gather",
        "victim network",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "sha1",
        "sha256",
        "njmk",
        "kwruymy",
        "mime",
        "submitted",
        "process details",
        "calls",
        "apis",
        "reads",
        "defense evasion",
        "model",
        "getprocaddress",
        "show technique",
        "ck matrix",
        "access type",
        "value",
        "api call",
        "open",
        "august",
        "format",
        "typeof symbol",
        "typeof s",
        "typeof c",
        "function",
        "symbol",
        "comenabled",
        "image path",
        "ndex",
        "ndroleextdll",
        "f0f0f0",
        "ff4b55",
        "stop",
        "span",
        "show process",
        "binary file",
        "file",
        "network traffic",
        "encrypt",
        "date",
        "found",
        "ssl certificate",
        "creation date",
        "hostname add",
        "pulse pulses",
        "files ip",
        "address domain",
        "data upload",
        "extraction",
        "ge6 mira",
        "failed",
        "ascii text",
        "development att",
        "hostname",
        "files domain",
        "files related",
        "pulses otx",
        "pulses",
        "unknown aaaa",
        "unknown ns",
        "united states",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "a domains",
        "search",
        "germany unknown",
        "win32",
        "lowfi",
        "chrome",
        "susp",
        "trojan",
        "backdoor",
        "twitter",
        "virtool",
        "worm",
        "exploit",
        "trojandropper",
        "win32upatre dec",
        "mtb dec",
        "reverse dns",
        "body",
        "location united",
        "asn as14618",
        "less whois",
        "files show",
        "date hash",
        "avast avg",
        "initial access",
        "javascript",
        "root",
        "enterprise",
        "form",
        "desktop",
        "command decode",
        "suricata ipv4",
        "spycloud",
        "robots",
        "bots",
        "chatbot",
        "bot network",
        "spy",
        "mixb",
        "a2fryx",
        "therahand",
        "typosquating"
      ],
      "references": [
        "https://www.red-gate.com/products/smartassembly",
        "spycloud.com \u2022 content.spycloud.com \u2022 email.spycloud.com\t hostname\tengage.spycloud.com \u2022 hello.spycloud.com \u2022portal.spycloud.com \u2022 https://email.spycloud",
        "https://email.spycloud.com/NzEzLVdJUC03MzcAAAGe67eM-W3qxAlVkEvZwfw1dWuwRdm0zVU5aMyOzUe2IkxAY3hDe8RfT27HnjgkvTk-uqIy6K0=",
        "https://spycloud.com/solutions/\t\u2022 104.18.26.108 ELF:Mirai-GH\\ [Trj] \u2022 Unix.Dropper.Mirai-7135870-0",
        "dasima-containers.palantirfoundry.com \u2022 blitzrobots.com",
        "https://blog.endgames.com/ \u2022 wg41xm05b3.endgamesystems.com",
        "https://www.coloradosos.gov/biz/BusinessEntityDetail.do?quitButtonDestination=BusinessEntityResults&nameTyp=ENT&masterFileId=20221473927&entityId2=20221473927&fileId=20251525819&srchTyp=ENTITY",
        "www.onyx-ware.com \u2022 http://pages.endgames.com/ \u2022  http://www.endgamesystems.com/",
        "https://hybrid-analysis.com/sample/9a1e0d38b691f1d22a92cff65ec0439b428170ac39a4493c7ecb06d5585f56a3/68a4adea30f7fafee90aefd3",
        "Malicious: http://developers.cloudfiare.com/support/troubleshooting/http-status-",
        "Typosquating: developers.cloudfiare.com \u2022 cloudfiare.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Unix.Dropper.Mirai-7135870-0",
          "display_name": "Unix.Dropper.Mirai-7135870-0",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1116",
          "name": "Code Signing",
          "display_name": "T1116 - Code Signing"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 341,
        "FileHash-SHA1": 343,
        "FileHash-SHA256": 1332,
        "domain": 1062,
        "hostname": 1967,
        "URL": 5699,
        "email": 10,
        "SSLCertFingerprint": 21,
        "CVE": 1
      },
      "indicator_count": 10776,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "80 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6892e73b32af18aa302df0dc",
      "name": "Part 1.5",
      "description": "Dark web media \u2022 Political news \u2022 Malvertizing\nlocate \u2022\ntrack [stalk] \u2022 record calls \u2022 control media [youtube , etc] http://t.name?n[++i]=e:this.removeEventListener\t\t\nJeeng &\nPowebox [ accidentally left out in original post pulse]",
      "modified": "2025-09-05T04:03:06.929000",
      "created": "2025-08-06T05:25:15.369000",
      "tags": [
        "chromeua",
        "optout",
        "object",
        "path",
        "value",
        "access type",
        "setval",
        "windir",
        "localappdata",
        "null",
        "win64",
        "error",
        "generator",
        "close",
        "roboto",
        "date",
        "format",
        "light",
        "span",
        "template",
        "void",
        "android",
        "body",
        "trident",
        "mexico",
        "sonic",
        "black",
        "critical",
        "desktop",
        "dark",
        "meta",
        "this",
        "june",
        "hybrid",
        "apache",
        "write",
        "crypto",
        "autodetect",
        "face",
        "courier",
        "gigi",
        "impact",
        "shadow",
        "click",
        "strings",
        "cray",
        "smwg",
        "eret",
        "footer",
        "infinity",
        "window",
        "canvas",
        "legend",
        "nuke",
        "lion",
        "4629",
        "ahav",
        "olsa",
        "false",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "script",
        "mitre att",
        "pattern match",
        "show technique",
        "iframe",
        "refresh",
        "august",
        "general",
        "local",
        "tools",
        "demo",
        "look",
        "verify",
        "restart",
        "url http",
        "small",
        "pulses url",
        "tellyoun",
        "showing",
        "entries",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "cc08",
        "f06a6b",
        "sfurl",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "pulses",
        "filehashsha1",
        "adversaries",
        "found",
        "webp image",
        "ascii text",
        "riff",
        "size",
        "encrypt",
        "legacy",
        "filehashmd5",
        "united",
        "flag",
        "server",
        "markmonitor",
        "name server",
        "llc name",
        "overview dns",
        "requests domain",
        "country",
        "win32",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "medium risk",
        "yara",
        "detections",
        "malware",
        "copy",
        "show",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pdb path",
        "pe resource",
        "extraction",
        "data upload",
        "enter sc",
        "type",
        "extra data",
        "please",
        "failed",
        "review",
        "exclude data",
        "included review",
        "ic data",
        "suggeste",
        "stop",
        "type onow",
        "domain",
        "passive dns",
        "urls",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "safe browsing",
        "sc data",
        "extr amanuav",
        "review included",
        "manualy",
        "sugges excluded",
        "filehash",
        "md5 add",
        "pulse pulses",
        "url add",
        "http",
        "hostname",
        "files domain",
        "pulses otx",
        "virustotal",
        "hsmi192547107",
        "pulses hostname",
        "r dec",
        "customer dec",
        "iski dec",
        "decision dec",
        "va dec",
        "bitcoin",
        "bitcoin dec",
        "petra",
        "torstatus dec",
        "paul dec",
        "sodesc",
        "planet dec",
        "emilia",
        "heroin dec",
        "difference dec",
        "palantir dec",
        "loraxlive dec",
        "chaturbate dec",
        "sandra",
        "free dec",
        "marvel dec",
        "benjis dec",
        "fresh dec",
        "sodesc dec",
        "srdirport",
        "srhostname",
        "link dec",
        "types of",
        "italy",
        "china",
        "australia",
        "france",
        "turkey",
        "discovery",
        "information",
        "ck ids",
        "t1005",
        "local system",
        "t1007",
        "system service",
        "part",
        "track",
        "locate",
        "political",
        "civil society",
        "news",
        "created",
        "hours ago",
        "report spam",
        "t1555",
        "password",
        "t1560",
        "collected data",
        "t1573",
        "channel",
        "t1574",
        "execution flow",
        "scan",
        "iocs",
        "t1497",
        "u0lhmq",
        "mtawmq",
        "t1480",
        "guardrails",
        "t1486",
        "data encrypted",
        "learn more",
        "unsubscribe aug",
        "protocol",
        "t1074",
        "staged",
        "t1083",
        "t1102",
        "web service",
        "t1105",
        "tool transfer",
        "t1140",
        "data engineer",
        "candidate",
        "tlsv1",
        "odigicert inc",
        "stcalifornia",
        "lsan jose",
        "oadobe systems",
        "incorporated",
        "cndigicert sha2",
        "push",
        "next",
        "high",
        "write c",
        "ireland as16509",
        "delete",
        "dirty",
        "tags",
        "t1012",
        "flow endpoint",
        "security scan",
        "t1106",
        "copyright",
        "levelblue"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 608,
        "FileHash-SHA1": 433,
        "FileHash-SHA256": 3663,
        "URL": 17104,
        "domain": 1316,
        "email": 39,
        "hostname": 4208,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 27388,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://v7.swiperjs.com/migration-guide",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://v7.swiperjs.com/migration-guide",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776615739.8442361
}