{
  "type": "URL",
  "indicator": "https://vpn.valuedapps.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://vpn.valuedapps.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4136927009,
      "indicator": "https://vpn.valuedapps.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69a1a73eb0578b92962dae97",
          "name": "FBI Link (Ransomware)sent to a device. opened on its own. Why?",
          "description": "I wouldn\u2019t typically search an alleged authentic government site , except it opened on a device, no prompt. TrojanDownloader:Win32/Dalexis!rfn!rfn\nIDS Detections\nMaktub Locker TOR Status Check\nTOR Consensus Data Requested\nTOR 1.0 Server Key Retrieval\nTor Get Server Request\nTLS Handshake Failure\nYara Detections\nstack_string\nWho is : [URL\n[https://tor-dirauth.sebastianhahn.net/]\n[https://tor.sebastianhahn.net]\n[tor-dirauth.sebastianhahn.net]\n->gitbot.faui2k9.de\n[Status faui2k9.de -connect] connects to device \n100% Malicious | https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70 |  [External resources discovered in HTML content:\ndap.digitalgov.gov | Pattern match: \"fbi.gov/contact-us/field-offices/denver/news/pr\"\nHeuristic match: \"x.com\" | will revisit",
          "modified": "2026-03-29T13:04:34.750000",
          "created": "2026-02-27T14:16:30.498000",
          "tags": [
            "regopenkeyexw",
            "port",
            "destination",
            "cryptexportkey",
            "search",
            "show",
            "entries",
            "windows nt",
            "regsetvalueexa",
            "ip address",
            "malware",
            "copy",
            "write",
            "win32",
            "next",
            "format",
            "contacted",
            "less ip",
            "server",
            "organization",
            "city",
            "stateprovince",
            "postal code",
            "phone",
            "date",
            "registrar abuse",
            "privacy admin",
            "paris admin",
            "april",
            "february",
            "failed",
            "enter",
            "data upload",
            "passive dns",
            "urls",
            "aaaa",
            "certificate",
            "otx logo",
            "all hostname",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "title",
            "body",
            "encrypt",
            "netherlands",
            "gmt content",
            "all ipv4",
            "amsterdam",
            "hetzner online",
            "gmbh",
            "summary",
            "url age",
            "de seen",
            "general info",
            "geo germany",
            "as as24940",
            "de note",
            "route",
            "direct",
            "pro platform",
            "logs",
            "suricata alert",
            "et info",
            "tls handshake",
            "bad traffic",
            "suricata alerts",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "size",
            "sha256",
            "pattern match",
            "ascii text",
            "mitre att",
            "ck id",
            "path",
            "unknown",
            "stop",
            "root",
            "hybrid",
            "general",
            "local",
            "form",
            "click",
            "strings",
            "9999",
            "learn",
            "adversaries",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "show technique",
            "ck matrix",
            "href",
            "antivirus",
            "maktub locker",
            "tor status",
            "check"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1129,
            "domain": 148,
            "hostname": 753,
            "FileHash-SHA256": 548,
            "FileHash-MD5": 90,
            "FileHash-SHA1": 71,
            "SSLCertFingerprint": 8,
            "CIDR": 1,
            "email": 4
          },
          "indicator_count": 2752,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "21 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68dd9423f9208dcc8701e12e",
          "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
          "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
          "modified": "2025-10-31T19:03:21.338000",
          "created": "2025-10-01T20:50:43.002000",
          "tags": [
            "iocs",
            "logo",
            "passive dns",
            "related tags",
            "none google",
            "ipv4",
            "gogle",
            "twitter",
            "x.com",
            "ransomware",
            "fbi \u2019site\u2019",
            "python",
            "cloud",
            "regopenkeyexw",
            "read c",
            "port",
            "destination",
            "cryptexportkey",
            "count read",
            "tor get",
            "malware",
            "write",
            "format",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "country",
            "postal code",
            "organization",
            "date",
            "email",
            "code",
            "aaaa",
            "value a",
            "key identifier",
            "v3 serial",
            "number",
            "cus ogoogle",
            "trust",
            "cnwe1 validity",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "maktub",
            "cnc",
            "python-projekt",
            "x post",
            "link",
            "android",
            "iphone",
            "google",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "ssl certificate",
            "spawns",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "mitre att",
            "show technique",
            "ck matrix",
            "title",
            "path",
            "hybrid",
            "general",
            "local",
            "form",
            "click",
            "strings",
            "body"
          ],
          "references": [
            "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
            "Entity CLOUD14",
            "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
            "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
            "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
            "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
            "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
            "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
            "Yara Detections: stack_string Alerts: dead_host",
            "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
            "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
            "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Code Virus Ransomware",
              "display_name": "Code Virus Ransomware",
              "target": null
            },
            {
              "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
              "target": null
            },
            {
              "id": "CLAMAV - Win.Malware.Cabby-6803812",
              "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
              "target": null
            },
            {
              "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
              "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 574,
            "domain": 147,
            "FileHash-MD5": 156,
            "FileHash-SHA1": 130,
            "FileHash-SHA256": 539,
            "URL": 982,
            "SSLCertFingerprint": 4,
            "email": 2
          },
          "indicator_count": 2534,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "170 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception",
        "Entity CLOUD14",
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "Yara Detections: stack_string Alerts: dead_host",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Code virus ransomware",
            "Ms defender - trojandownloader:win32/dalexis!rfn!rfn",
            "Clamav - win.malware.cabby-6803812",
            "Avast- win32:filecoder-ad\\ [trj]"
          ],
          "industries": [],
          "unique_indicators": 4164
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/valuedapps.com",
    "whois": "http://whois.domaintools.com/valuedapps.com",
    "domain": "valuedapps.com",
    "hostname": "vpn.valuedapps.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69a1a73eb0578b92962dae97",
      "name": "FBI Link (Ransomware)sent to a device. opened on its own. Why?",
      "description": "I wouldn\u2019t typically search an alleged authentic government site , except it opened on a device, no prompt. TrojanDownloader:Win32/Dalexis!rfn!rfn\nIDS Detections\nMaktub Locker TOR Status Check\nTOR Consensus Data Requested\nTOR 1.0 Server Key Retrieval\nTor Get Server Request\nTLS Handshake Failure\nYara Detections\nstack_string\nWho is : [URL\n[https://tor-dirauth.sebastianhahn.net/]\n[https://tor.sebastianhahn.net]\n[tor-dirauth.sebastianhahn.net]\n->gitbot.faui2k9.de\n[Status faui2k9.de -connect] connects to device \n100% Malicious | https://hybrid-analysis.com/sample/c8e97fd85003de128ef716093cc1ec68f676c737b614f4a55c75c5c0f837de70 |  [External resources discovered in HTML content:\ndap.digitalgov.gov | Pattern match: \"fbi.gov/contact-us/field-offices/denver/news/pr\"\nHeuristic match: \"x.com\" | will revisit",
      "modified": "2026-03-29T13:04:34.750000",
      "created": "2026-02-27T14:16:30.498000",
      "tags": [
        "regopenkeyexw",
        "port",
        "destination",
        "cryptexportkey",
        "search",
        "show",
        "entries",
        "windows nt",
        "regsetvalueexa",
        "ip address",
        "malware",
        "copy",
        "write",
        "win32",
        "next",
        "format",
        "contacted",
        "less ip",
        "server",
        "organization",
        "city",
        "stateprovince",
        "postal code",
        "phone",
        "date",
        "registrar abuse",
        "privacy admin",
        "paris admin",
        "april",
        "february",
        "failed",
        "enter",
        "data upload",
        "passive dns",
        "urls",
        "aaaa",
        "certificate",
        "otx logo",
        "all hostname",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "title",
        "body",
        "encrypt",
        "netherlands",
        "gmt content",
        "all ipv4",
        "amsterdam",
        "hetzner online",
        "gmbh",
        "summary",
        "url age",
        "de seen",
        "general info",
        "geo germany",
        "as as24940",
        "de note",
        "route",
        "direct",
        "pro platform",
        "logs",
        "suricata alert",
        "et info",
        "tls handshake",
        "bad traffic",
        "suricata alerts",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "size",
        "sha256",
        "pattern match",
        "ascii text",
        "mitre att",
        "ck id",
        "path",
        "unknown",
        "stop",
        "root",
        "hybrid",
        "general",
        "local",
        "form",
        "click",
        "strings",
        "9999",
        "learn",
        "adversaries",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "show technique",
        "ck matrix",
        "href",
        "antivirus",
        "maktub locker",
        "tor status",
        "check"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1129,
        "domain": 148,
        "hostname": 753,
        "FileHash-SHA256": 548,
        "FileHash-MD5": 90,
        "FileHash-SHA1": 71,
        "SSLCertFingerprint": 8,
        "CIDR": 1,
        "email": 4
      },
      "indicator_count": 2752,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "21 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68dd9423f9208dcc8701e12e",
      "name": "Maktub Locker TOR Status Check \u2022 Cab \\ Drive by( dbi.com) Malicious pic",
      "description": "After 911 told me I was bounced to the Denver, Co Station 5 , located 45 & Peoria in Denver , Colorado , not even close. \nThe phone number changed, only 911 access. Clue: I saw an Amber alert in n target phone when I powered it on. No all notices always turned off. Made a call\non contact list and screen changed to a plain faced interface. \n\nAfter finding a mother foundry link on targets phone I grew curious about a CEO\u2019s strange story of Palantir\u2019s Karp Theil roommate situation in Law School but I could only find one picture on of them on a campus in their late 40\u2019s. He\u2019s African American mixed. The picture of his mother in hacked phone is 215 yo. No information federal oversight as CEO right? Or limited information on crazy hacked device? \n\nClicked on link then OMGness\n\n#whatIfind #onhackeddevice #targeting",
      "modified": "2025-10-31T19:03:21.338000",
      "created": "2025-10-01T20:50:43.002000",
      "tags": [
        "iocs",
        "logo",
        "passive dns",
        "related tags",
        "none google",
        "ipv4",
        "gogle",
        "twitter",
        "x.com",
        "ransomware",
        "fbi \u2019site\u2019",
        "python",
        "cloud",
        "regopenkeyexw",
        "read c",
        "port",
        "destination",
        "cryptexportkey",
        "count read",
        "tor get",
        "malware",
        "write",
        "format",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "country",
        "postal code",
        "organization",
        "date",
        "email",
        "code",
        "aaaa",
        "value a",
        "key identifier",
        "v3 serial",
        "number",
        "cus ogoogle",
        "trust",
        "cnwe1 validity",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "maktub",
        "cnc",
        "python-projekt",
        "x post",
        "link",
        "android",
        "iphone",
        "google",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "ssl certificate",
        "spawns",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "mitre att",
        "show technique",
        "ck matrix",
        "title",
        "path",
        "hybrid",
        "general",
        "local",
        "form",
        "click",
        "strings",
        "body"
      ],
      "references": [
        "FBI.GOV - VT I\u2019m looking @ says website is legitimate & not misused - hmm",
        "Entity CLOUD14",
        "CLOUDFLARENET - 104.16.148.244 , 104.19.148.244",
        "https://otx.alienvault.com/indicator/file/ba30376f915afa868763f84299fae5d2",
        "https://hybrid-analysis.com/sample/f2b943e81f1b284cf9dabb4ff156526a02ecca485ac117714867d92b262c8fdd/68dd867e3bc50d9068072c05",
        "Hashtags left on Hybrid Analysis (above) weren\u2019t posted by me",
        "Maktub Locker TOR Status Check \u2022 TOR Consensus Data Requested \u2022 TOR 1.0 Server Key Retrieval",
        "Tor Get Server Request \u2022 TLS Handshake Failure High Priority",
        "Yara Detections: stack_string Alerts: dead_host",
        "Alerts: network_icmp nolookup_communication modifies_proxy_wpad network_cnc_http network_http",
        "Alerts: allocates_rwx creates_hidden_file dropper has_wmi protection_rx antivm_network_adapters",
        "Alerts: packer_entropy queries_programs wmi_antivm checks_debugger generates_crypto_key recon_fingerprint pe_unknown_resource_name raises_exception"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Code Virus Ransomware",
          "display_name": "Code Virus Ransomware",
          "target": null
        },
        {
          "id": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "display_name": "AVAST- Win32:Filecoder-AD\\ [Trj]",
          "target": null
        },
        {
          "id": "CLAMAV - Win.Malware.Cabby-6803812",
          "display_name": "CLAMAV - Win.Malware.Cabby-6803812",
          "target": null
        },
        {
          "id": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "display_name": "Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn",
          "target": "/malware/Ms Defender - TrojanDownloader:Win32/Dalexis!rfn!rfn"
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 574,
        "domain": 147,
        "FileHash-MD5": 156,
        "FileHash-SHA1": 130,
        "FileHash-SHA256": 539,
        "URL": 982,
        "SSLCertFingerprint": 4,
        "email": 2
      },
      "indicator_count": 2534,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "170 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://vpn.valuedapps.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://vpn.valuedapps.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638779.5249128
}