{
  "type": "URL",
  "indicator": "https://viz.greynoise.io/query/haivanship.com.vn",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://viz.greynoise.io/query/haivanship.com.vn",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3898790875,
      "indicator": "https://viz.greynoise.io/query/haivanship.com.vn",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a056cacb981e6f3b2dd4647",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:28:01.780000",
          "created": "2026-05-14T06:33:16.946000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1521,
            "FileHash-SHA1": 1395,
            "FileHash-SHA256": 6084,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1361,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13826,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a056cac80d9b80eb1a97e29",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:14:09.098000",
          "created": "2026-05-14T06:33:16.505000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13592,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb3ef6d765187a437767e4",
          "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
          "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
          "modified": "2024-10-18T20:04:41.836000",
          "created": "2024-09-18T20:58:30.691000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1495,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13588,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "590 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665bb7679843a6dabe4560e3",
          "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
          "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
          "modified": "2024-09-05T06:11:17.325000",
          "created": "2024-06-02T00:05:59.160000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 2008,
            "URL": 11241,
            "domain": 1853,
            "hostname": 4198,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 19615,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "634 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f6738d3aa876f83738d0",
          "name": "USZoom [New York , USA] | iPostal1",
          "description": "",
          "modified": "2024-07-01T23:00:42.052000",
          "created": "2024-07-01T00:21:07.491000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": "665bb7679843a6dabe4560e3",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1890,
            "URL": 10360,
            "domain": 1799,
            "hostname": 3994,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 18358,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "699 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Yara Detections: DotNET_Reactor",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://uszoom.com/",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Malicious Score: 10",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Worm:win32/fesber.a",
            "Mal/generic-s",
            "Worm:win32/macoute.a",
            "Win.keylogger.susppack-9876601-0",
            "Alf:heraklezeval:rogue:win32/fakerean",
            "Ransom:win32/eniqma.a",
            "Tofsee",
            "#lowfi:hstr:trojanspy:win32/bancos",
            "Pdf.phishing.ttraffrobotinstall-7605656-0",
            "Win.trojan.sdum-9807706-0",
            "Trojanspy:win32/nivdort",
            "Trojandownloader:win32/nemucod",
            "Upackv037dwing",
            "Cryp_xed-12",
            "Win32.meredrop checkin"
          ],
          "industries": [
            "Civil society",
            "Telecommunications",
            "Technology"
          ],
          "unique_indicators": 34338
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/greynoise.io",
    "whois": "http://whois.domaintools.com/greynoise.io",
    "domain": "greynoise.io",
    "hostname": "viz.greynoise.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a056cacb981e6f3b2dd4647",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:28:01.780000",
      "created": "2026-05-14T06:33:16.946000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1521,
        "FileHash-SHA1": 1395,
        "FileHash-SHA256": 6084,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1361,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13826,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a056cac80d9b80eb1a97e29",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:14:09.098000",
      "created": "2026-05-14T06:33:16.505000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13592,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb3ef6d765187a437767e4",
      "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
      "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
      "modified": "2024-10-18T20:04:41.836000",
      "created": "2024-09-18T20:58:30.691000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1495,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13588,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "590 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665bb7679843a6dabe4560e3",
      "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
      "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
      "modified": "2024-09-05T06:11:17.325000",
      "created": "2024-06-02T00:05:59.160000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 2008,
        "URL": 11241,
        "domain": 1853,
        "hostname": 4198,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 19615,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "634 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f6738d3aa876f83738d0",
      "name": "USZoom [New York , USA] | iPostal1",
      "description": "",
      "modified": "2024-07-01T23:00:42.052000",
      "created": "2024-07-01T00:21:07.491000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": "665bb7679843a6dabe4560e3",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1890,
        "URL": 10360,
        "domain": 1799,
        "hostname": 3994,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 18358,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "699 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://viz.greynoise.io/query/haivanship.com.vn",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://viz.greynoise.io/query/haivanship.com.vn",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780342216.123804
}