{
  "type": "URL",
  "indicator": "https://warp.plus/jCz5v",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://warp.plus/jCz5v",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4124439380,
      "indicator": "https://warp.plus/jCz5v",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68d37e35f99d852d38beb769",
          "name": "Cryptex Port Key  \u2022 RedLine Stealer affects Threat Research Platform/s",
          "description": "#attack?  #honeypot?",
          "modified": "2025-10-24T04:02:54.218000",
          "created": "2025-09-24T05:14:28.101000",
          "tags": [
            "x00x00n",
            "memcommit",
            "regopenkeyexw",
            "regsz",
            "else",
            "ipnnoysrdi tr",
            "writeconsolew",
            "cryptexportkey",
            "invalid pointer",
            "x1ex00x00n",
            "redline stealer",
            "service",
            "powershell",
            "tools",
            "persistence",
            "execution",
            "dock",
            "write",
            "updater",
            "malware",
            "passive dns",
            "urls",
            "url add",
            "ip address",
            "related nids",
            "files location",
            "hong kong",
            "united",
            "present jul",
            "present dec",
            "search",
            "present may",
            "a domains",
            "name servers",
            "unknown aaaa",
            "trojan",
            "present jan",
            "present sep",
            "moved",
            "title",
            "span td",
            "td td",
            "tr tr",
            "a li",
            "ipv4 internet",
            "span",
            "meta",
            "gmt content",
            "ipv4 add",
            "reverse dns",
            "trojanx",
            "location hong kong",
            "software",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "development att",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck matrix",
            "sha1",
            "odigicert inc",
            "network traffic",
            "general",
            "local",
            "path",
            "encrypt",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "crlf line",
            "urlhttps",
            "extracted files",
            "acquires",
            "networking",
            "readiness"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1086",
              "name": "PowerShell",
              "display_name": "T1086 - PowerShell"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 150,
            "FileHash-SHA1": 148,
            "FileHash-SHA256": 3059,
            "domain": 1277,
            "URL": 4166,
            "hostname": 1251,
            "SSLCertFingerprint": 10,
            "email": 1
          },
          "indicator_count": 10062,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "177 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68cd76f1888c22a2e105e524",
          "name": "Sign in - Google Accounts | Ransomware G3nasom",
          "description": "Needs to more research due to how malicious it is. Did attack a monitored target via Google search.\n\nI haven\u2019t put the time into naming all vulnerabilities. Positive for ransomware ALF:Trojan:Win32/G3nasom formerly named \u201c Win.Ransomware.Gandcrab-10044141-0\u201d",
          "modified": "2025-10-19T14:00:01.535000",
          "created": "2025-09-19T15:29:53.126000",
          "tags": [
            "sign",
            "google account",
            "email",
            "forgot email",
            "private window",
            "learn",
            "guest mode",
            "next create",
            "dynamicloader",
            "windows nt",
            "msie",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "owotrus ca",
            "limited",
            "server ca",
            "python",
            "write",
            "trojan",
            "guard",
            "win64",
            "accept",
            "updater",
            "launcher",
            "malware",
            "contacted",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "passive dns",
            "google trust",
            "ip address",
            "related nids",
            "united",
            "url http",
            "present aug",
            "present sep",
            "present jul",
            "unknown aaaa",
            "domain",
            "title",
            "body",
            "trojandropper",
            "mtb sep",
            "meta",
            "next associated",
            "win32upatre sep",
            "backdoor",
            "ipv4",
            "moved",
            "ddos",
            "data upload",
            "extraction",
            "iocs",
            "failed",
            "source url",
            "indicato",
            "mat my",
            "data",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "found",
            "command",
            "initial access",
            "spawns",
            "chrome",
            "gmt content",
            "avast avg",
            "next http",
            "ascii text",
            "size",
            "pattern match",
            "mitre att",
            "error",
            "null",
            "android",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "trident",
            "write c",
            "medium",
            "search",
            "show",
            "high",
            "push",
            "service",
            "ms defender",
            "files matching",
            "number",
            "hide samples",
            "date hash",
            "next yara",
            "emotet",
            "g3nasom",
            "entries",
            "alerts show",
            "ck technique",
            "technique id",
            "io control",
            "anomalous",
            "geofencing",
            "sha256 add",
            "pulse pulses",
            "copy"
          ],
          "references": [
            "http://accounts.google.com/v3/signin/identifier",
            "Yara Detection: Cabinet _Archive",
            "Banking Malware"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/G3nasom",
              "display_name": "ALF:Trojan:Win32/G3nasom",
              "target": null
            },
            {
              "id": "Win.Ransomware.Gandcrab-10044141-0\t(renamed G3nasom)",
              "display_name": "Win.Ransomware.Gandcrab-10044141-0\t(renamed G3nasom)",
              "target": null
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/Muldrop.V!MTB",
              "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
              "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Backdoor:Win32/Berbew",
              "display_name": "Backdoor:Win32/Berbew",
              "target": "/malware/Backdoor:Win32/Berbew"
            },
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Trojan:Win32/Emotet.KDS!MTB",
              "display_name": "Trojan:Win32/Emotet.KDS!MTB",
              "target": "/malware/Trojan:Win32/Emotet.KDS!MTB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 531,
            "FileHash-SHA256": 1069,
            "URL": 1607,
            "FileHash-MD5": 275,
            "FileHash-SHA1": 187,
            "SSLCertFingerprint": 25,
            "domain": 188,
            "email": 2
          },
          "indicator_count": 3884,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "182 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ae5b9ef87646927a236b61",
          "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
          "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
          "modified": "2025-09-26T00:01:12.214000",
          "created": "2025-08-27T01:13:02.780000",
          "tags": [
            "google",
            "mullvad browser",
            "value",
            "incognito mode",
            "mine",
            "unix time",
            "friday",
            "january",
            "does",
            "tor browser",
            "search",
            "show",
            "langchinese",
            "packing t1045",
            "t1045",
            "medium",
            "pe resource",
            "module load",
            "t1129",
            "service",
            "trojan",
            "copy",
            "dock",
            "write",
            "malware",
            "clock",
            "united",
            "passive dns",
            "urls",
            "next associated",
            "gmt cache",
            "ipv4 add",
            "pulse pulses",
            "files",
            "reverse dns",
            "win32",
            "title",
            "location united",
            "america flag",
            "america asn",
            "as15169 google",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "present aug",
            "china unknown",
            "creation date",
            "date",
            "domain",
            "ip address",
            "domain name",
            "expiration date",
            "status ok",
            "nanjing",
            "accept",
            "body",
            "div td",
            "td tr",
            "div div",
            "span span",
            "a li",
            "span p",
            "p div",
            "moved",
            "a domains",
            "open",
            "span",
            "uuupupu",
            "t1055",
            "process32nextw",
            "high",
            "windows",
            "high defense",
            "evasion",
            "delphi",
            "google gmail",
            "images sign",
            "advanced search",
            "solutions",
            "privacy",
            "store gmail",
            "delete delete",
            "report",
            "how search",
            "applying ai",
            "settings search",
            "advanced",
            "search search",
            "search help",
            "domainabuse",
            "showing",
            "hostname add",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "read c",
            "tlsv1",
            "whitelisted",
            "port",
            "destination",
            "ascii text",
            "next",
            "encrypt",
            "script urls",
            "msie",
            "chrome",
            "bad gateway",
            "script domains",
            "present feb",
            "link",
            "meta",
            "digital",
            "language",
            "body doctype",
            "ghost",
            "present jun",
            "aaaa",
            "present jul",
            "present oct",
            "record value",
            "yara detections",
            "dock zone",
            "top source",
            "top destination",
            "source source",
            "filehash",
            "code",
            "error",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "execution",
            "persistence",
            "tulach",
            "brian sabey",
            "dod network",
            "orgtechref",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity dnic",
            "handle",
            "whois lookup",
            "dod",
            "et trojan",
            "server header",
            "suspicious",
            "et info",
            "unknown",
            "virustotal",
            "specified",
            "download",
            "et",
            "please",
            "type size",
            "first seen",
            "loading",
            "python wheel",
            "dynamicloader",
            "intel",
            "ms windows",
            "pe32",
            "entries",
            "user agent",
            "powershell",
            "agent",
            "yara rule",
            "checks",
            "levelblue",
            "open threat",
            "observed dns",
            "query",
            "dns lookup",
            "msdos",
            "wannacry dns",
            "lookup",
            "wannacry",
            "worm",
            "explorer",
            "msil",
            "darkcomet",
            "ping",
            "tools",
            "capture",
            "hallrender",
            "dga domains",
            "unfurl sites",
            "honey net",
            "bot",
            "nxdomain",
            "potential-c2"
          ],
          "references": [
            "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
            "DoD Network Information Center (DNIC)",
            "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
            "Python Wheel package",
            "https://www.google.com/search",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Magania.DSK!MTB",
              "display_name": "Trojan:Win32/Magania.DSK!MTB",
              "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "a variant of Win32/Kryptik.DEOA",
              "display_name": "a variant of Win32/Kryptik.DEOA",
              "target": null
            },
            {
              "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "target": null
            },
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Civilian"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8221,
            "domain": 1216,
            "FileHash-SHA256": 2434,
            "FileHash-MD5": 296,
            "FileHash-SHA1": 155,
            "hostname": 2939,
            "email": 7,
            "SSLCertFingerprint": 8,
            "CIDR": 2
          },
          "indicator_count": 15278,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "206 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Python Wheel package",
        "https://www.google.com/search",
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "http://accounts.google.com/v3/signin/identifier",
        "DoD Network Information Center (DNIC)",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "Banking Malware",
        "Yara Detection: Cabinet _Archive",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan:win32/magania.dsk!mtb",
            "Trojan:win32/zusy",
            "Alf:trojan:win32/g3nasom",
            "Win.trojan.barys-10005825-0",
            "Emotet",
            "Alf:exploit:win32/gsharedinforef.a",
            "Trojandropper:win32/muldrop.v!mtb",
            "Backdoor:win32/berbew",
            "Win.ransomware.gandcrab-10044141-0\t(renamed g3nasom)",
            "Upatre",
            "Wannacry",
            "Trojan:win32/emotet.kds!mtb",
            "Et",
            "A variant of win32/kryptik.deoa"
          ],
          "industries": [
            "Civilian",
            "Telecommunications",
            "Technology"
          ],
          "unique_indicators": 29243
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/warp.plus",
    "whois": "http://whois.domaintools.com/warp.plus",
    "domain": "warp.plus",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68d37e35f99d852d38beb769",
      "name": "Cryptex Port Key  \u2022 RedLine Stealer affects Threat Research Platform/s",
      "description": "#attack?  #honeypot?",
      "modified": "2025-10-24T04:02:54.218000",
      "created": "2025-09-24T05:14:28.101000",
      "tags": [
        "x00x00n",
        "memcommit",
        "regopenkeyexw",
        "regsz",
        "else",
        "ipnnoysrdi tr",
        "writeconsolew",
        "cryptexportkey",
        "invalid pointer",
        "x1ex00x00n",
        "redline stealer",
        "service",
        "powershell",
        "tools",
        "persistence",
        "execution",
        "dock",
        "write",
        "updater",
        "malware",
        "passive dns",
        "urls",
        "url add",
        "ip address",
        "related nids",
        "files location",
        "hong kong",
        "united",
        "present jul",
        "present dec",
        "search",
        "present may",
        "a domains",
        "name servers",
        "unknown aaaa",
        "trojan",
        "present jan",
        "present sep",
        "moved",
        "title",
        "span td",
        "td td",
        "tr tr",
        "a li",
        "ipv4 internet",
        "span",
        "meta",
        "gmt content",
        "ipv4 add",
        "reverse dns",
        "trojanx",
        "location hong kong",
        "software",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "development att",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck matrix",
        "sha1",
        "odigicert inc",
        "network traffic",
        "general",
        "local",
        "path",
        "encrypt",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "crlf line",
        "urlhttps",
        "extracted files",
        "acquires",
        "networking",
        "readiness"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1086",
          "name": "PowerShell",
          "display_name": "T1086 - PowerShell"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 150,
        "FileHash-SHA1": 148,
        "FileHash-SHA256": 3059,
        "domain": 1277,
        "URL": 4166,
        "hostname": 1251,
        "SSLCertFingerprint": 10,
        "email": 1
      },
      "indicator_count": 10062,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "177 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68cd76f1888c22a2e105e524",
      "name": "Sign in - Google Accounts | Ransomware G3nasom",
      "description": "Needs to more research due to how malicious it is. Did attack a monitored target via Google search.\n\nI haven\u2019t put the time into naming all vulnerabilities. Positive for ransomware ALF:Trojan:Win32/G3nasom formerly named \u201c Win.Ransomware.Gandcrab-10044141-0\u201d",
      "modified": "2025-10-19T14:00:01.535000",
      "created": "2025-09-19T15:29:53.126000",
      "tags": [
        "sign",
        "google account",
        "email",
        "forgot email",
        "private window",
        "learn",
        "guest mode",
        "next create",
        "dynamicloader",
        "windows nt",
        "msie",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "owotrus ca",
        "limited",
        "server ca",
        "python",
        "write",
        "trojan",
        "guard",
        "win64",
        "accept",
        "updater",
        "launcher",
        "malware",
        "contacted",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "passive dns",
        "google trust",
        "ip address",
        "related nids",
        "united",
        "url http",
        "present aug",
        "present sep",
        "present jul",
        "unknown aaaa",
        "domain",
        "title",
        "body",
        "trojandropper",
        "mtb sep",
        "meta",
        "next associated",
        "win32upatre sep",
        "backdoor",
        "ipv4",
        "moved",
        "ddos",
        "data upload",
        "extraction",
        "iocs",
        "failed",
        "source url",
        "indicato",
        "mat my",
        "data",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "found",
        "command",
        "initial access",
        "spawns",
        "chrome",
        "gmt content",
        "avast avg",
        "next http",
        "ascii text",
        "size",
        "pattern match",
        "mitre att",
        "error",
        "null",
        "android",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "trident",
        "write c",
        "medium",
        "search",
        "show",
        "high",
        "push",
        "service",
        "ms defender",
        "files matching",
        "number",
        "hide samples",
        "date hash",
        "next yara",
        "emotet",
        "g3nasom",
        "entries",
        "alerts show",
        "ck technique",
        "technique id",
        "io control",
        "anomalous",
        "geofencing",
        "sha256 add",
        "pulse pulses",
        "copy"
      ],
      "references": [
        "http://accounts.google.com/v3/signin/identifier",
        "Yara Detection: Cabinet _Archive",
        "Banking Malware"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/G3nasom",
          "display_name": "ALF:Trojan:Win32/G3nasom",
          "target": null
        },
        {
          "id": "Win.Ransomware.Gandcrab-10044141-0\t(renamed G3nasom)",
          "display_name": "Win.Ransomware.Gandcrab-10044141-0\t(renamed G3nasom)",
          "target": null
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/Muldrop.V!MTB",
          "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
          "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Backdoor:Win32/Berbew",
          "display_name": "Backdoor:Win32/Berbew",
          "target": "/malware/Backdoor:Win32/Berbew"
        },
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Trojan:Win32/Emotet.KDS!MTB",
          "display_name": "Trojan:Win32/Emotet.KDS!MTB",
          "target": "/malware/Trojan:Win32/Emotet.KDS!MTB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 531,
        "FileHash-SHA256": 1069,
        "URL": 1607,
        "FileHash-MD5": 275,
        "FileHash-SHA1": 187,
        "SSLCertFingerprint": 25,
        "domain": 188,
        "email": 2
      },
      "indicator_count": 3884,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "182 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ae5b9ef87646927a236b61",
      "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
      "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
      "modified": "2025-09-26T00:01:12.214000",
      "created": "2025-08-27T01:13:02.780000",
      "tags": [
        "google",
        "mullvad browser",
        "value",
        "incognito mode",
        "mine",
        "unix time",
        "friday",
        "january",
        "does",
        "tor browser",
        "search",
        "show",
        "langchinese",
        "packing t1045",
        "t1045",
        "medium",
        "pe resource",
        "module load",
        "t1129",
        "service",
        "trojan",
        "copy",
        "dock",
        "write",
        "malware",
        "clock",
        "united",
        "passive dns",
        "urls",
        "next associated",
        "gmt cache",
        "ipv4 add",
        "pulse pulses",
        "files",
        "reverse dns",
        "win32",
        "title",
        "location united",
        "america flag",
        "america asn",
        "as15169 google",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "present aug",
        "china unknown",
        "creation date",
        "date",
        "domain",
        "ip address",
        "domain name",
        "expiration date",
        "status ok",
        "nanjing",
        "accept",
        "body",
        "div td",
        "td tr",
        "div div",
        "span span",
        "a li",
        "span p",
        "p div",
        "moved",
        "a domains",
        "open",
        "span",
        "uuupupu",
        "t1055",
        "process32nextw",
        "high",
        "windows",
        "high defense",
        "evasion",
        "delphi",
        "google gmail",
        "images sign",
        "advanced search",
        "solutions",
        "privacy",
        "store gmail",
        "delete delete",
        "report",
        "how search",
        "applying ai",
        "settings search",
        "advanced",
        "search search",
        "search help",
        "domainabuse",
        "showing",
        "hostname add",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "read c",
        "tlsv1",
        "whitelisted",
        "port",
        "destination",
        "ascii text",
        "next",
        "encrypt",
        "script urls",
        "msie",
        "chrome",
        "bad gateway",
        "script domains",
        "present feb",
        "link",
        "meta",
        "digital",
        "language",
        "body doctype",
        "ghost",
        "present jun",
        "aaaa",
        "present jul",
        "present oct",
        "record value",
        "yara detections",
        "dock zone",
        "top source",
        "top destination",
        "source source",
        "filehash",
        "code",
        "error",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "execution",
        "persistence",
        "tulach",
        "brian sabey",
        "dod network",
        "orgtechref",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity dnic",
        "handle",
        "whois lookup",
        "dod",
        "et trojan",
        "server header",
        "suspicious",
        "et info",
        "unknown",
        "virustotal",
        "specified",
        "download",
        "et",
        "please",
        "type size",
        "first seen",
        "loading",
        "python wheel",
        "dynamicloader",
        "intel",
        "ms windows",
        "pe32",
        "entries",
        "user agent",
        "powershell",
        "agent",
        "yara rule",
        "checks",
        "levelblue",
        "open threat",
        "observed dns",
        "query",
        "dns lookup",
        "msdos",
        "wannacry dns",
        "lookup",
        "wannacry",
        "worm",
        "explorer",
        "msil",
        "darkcomet",
        "ping",
        "tools",
        "capture",
        "hallrender",
        "dga domains",
        "unfurl sites",
        "honey net",
        "bot",
        "nxdomain",
        "potential-c2"
      ],
      "references": [
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "DoD Network Information Center (DNIC)",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
        "Python Wheel package",
        "https://www.google.com/search",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Magania.DSK!MTB",
          "display_name": "Trojan:Win32/Magania.DSK!MTB",
          "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "a variant of Win32/Kryptik.DEOA",
          "display_name": "a variant of Win32/Kryptik.DEOA",
          "target": null
        },
        {
          "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "target": null
        },
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Civilian"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8221,
        "domain": 1216,
        "FileHash-SHA256": 2434,
        "FileHash-MD5": 296,
        "FileHash-SHA1": 155,
        "hostname": 2939,
        "email": 7,
        "SSLCertFingerprint": 8,
        "CIDR": 2
      },
      "indicator_count": 15278,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "206 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://warp.plus/jCz5v",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://warp.plus/jCz5v",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643791.3527677
}