{
  "type": "URL",
  "indicator": "https://webmail.forbin.net/login.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://webmail.forbin.net/login.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3769643545,
      "indicator": "https://webmail.forbin.net/login.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69ded8198b25581a09b90824",
          "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
          "description": "",
          "modified": "2026-04-15T00:13:13.981000",
          "created": "2026-04-15T00:13:13.981000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "4 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69db05f833d3d6d2231fb201",
          "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
          "description": "",
          "modified": "2026-04-12T02:39:52.993000",
          "created": "2026-04-12T02:39:52.993000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": "69dab27a0493e0e80a0f35cd",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 49,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dab27a0493e0e80a0f35cd",
          "name": "SearchSuite \u2022 Healthcare Administration",
          "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
          "modified": "2026-04-11T20:43:38.695000",
          "created": "2026-04-11T20:43:38.695000",
          "tags": [
            "Win32/SearchSuite",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 installer",
            "install system",
            "compiler",
            "NSIS",
            "code signing",
            "serial number",
            "db d2",
            "de d3",
            "f3 e1",
            "issuer thawte",
            "primary root",
            "ca valid",
            "valid",
            "valid usage",
            "client auth",
            "algorithm",
            "rticon english",
            "type type",
            "chi2",
            "ico rtgroupicon",
            "english us",
            "capa",
            "c2 antianalysis",
            "executable",
            "sample appears",
            "installer",
            "installers well",
            "results may",
            "be misleading",
            "or incomplete",
            "analyze created",
            "techniques",
            "info modify",
            "files",
            "modify registry",
            "directory permi",
            "techniques none",
            "info",
            "scripting inte",
            "shared modules",
            "Bear Share",
            "urls",
            "ip address",
            "asn as8075",
            "united",
            "flag united",
            "name servers",
            "name domain",
            "org apple",
            "infinite loop",
            "city cupertino",
            "country us",
            "dnssec",
            "urlmailto",
            "urlhttps",
            "search",
            "urlhttp",
            "moved",
            "title",
            "encrypt",
            "certificate",
            "segoe ui",
            "otx logo",
            "url analysis",
            "tokyo",
            "msie",
            "chrome",
            "gmt content",
            "all ipv4",
            "zeppelin",
            "trojandropper",
            "cookie",
            "backdoor",
            "hash avast",
            "avg clamav",
            "msdefender feb",
            "k oct",
            "k may",
            "mtb feb",
            "mtb jan",
            "k aug",
            "windows nt",
            "dynamicloader",
            "unknown",
            "medium",
            "default",
            "as16509",
            "show",
            "powershell",
            "write",
            "xserver",
            "bearshar data",
            "passive dns",
            "pulse submit",
            "port",
            "destination",
            "high",
            "displayname",
            "windows",
            "win64",
            "tofsee",
            "stream",
            "malware",
            "push",
            "next",
            "asnone",
            "germany as8560",
            "russia as198610",
            "strings",
            "is__elf",
            "systembc_linux_variant",
            "khtml",
            "gecko",
            "acceptencoding",
            "get na",
            "macintosh",
            "intel mac",
            "accept",
            "france as16276",
            "yara detections",
            "contacted",
            "all filehash",
            "sha256",
            "pulse pulses",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "tls sni",
            "less see",
            "all ip",
            "Apple",
            "xordata",
            "United States"
          ],
          "references": [
            "b9e4e47c3f96846c30581c08acf5bc56.virus",
            "BearShare Install File Version 12.0.0.135802",
            "Musiclab, LLC",
            "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
            "gateway.fe.apple-dns.net \u2022 apple-dns.net",
            "africa.konnect.com",
            "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
            "euw-serp-dev-testing19.duck.ai",
            "account-apple.com",
            "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
            "Yara Detections: Tofsee",
            "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
            "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
            "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
            "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
            "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
            "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
            "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
            "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
            "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
            "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
            "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
            "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
            "ids-apple.com \u2022 itunes.org",
            "xn--cloud-4sa.com",
            "http://cab.applemarketingtools.com",
            "http://console.applemarketingtools.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Spain",
            "France",
            "United Kingdom of Great Britain and Northern Ireland",
            "Netherlands",
            "Japan",
            "Switzerland",
            "Madagascar",
            "Finland",
            "Germany",
            "Russian Federation"
          ],
          "malware_families": [
            {
              "id": "Win32/SearchSuite",
              "display_name": "Win32/SearchSuite",
              "target": null
            },
            {
              "id": "Win32.Application.BearShare.A",
              "display_name": "Win32.Application.BearShare.A",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "CVE-2023-22518",
              "display_name": "CVE-2023-22518",
              "target": null
            },
            {
              "id": "Win.Packed.Bandook-9882274-1",
              "display_name": "Win.Packed.Bandook-9882274-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-7102058-0",
              "display_name": "Win.Trojan.Tofsee-7102058-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 138,
            "FileHash-SHA1": 119,
            "FileHash-SHA256": 3553,
            "IPv4": 633,
            "CVE": 2,
            "URL": 6134,
            "domain": 2439,
            "hostname": 2271,
            "email": 9,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 15300,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be56d257bb241c4fa3f68d",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:02.291000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be56d6df9d36bac14ccd87",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:06.808000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8134,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "imp.fusioninstall.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "24-70mm.camera",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "ww16.porn-community.porn25.com",
        "account-apple.com",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "http://cab.applemarketingtools.com",
        "ids-apple.com \u2022 itunes.org",
        "http://xred.mooo.com",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "https://severeporn-com.pornproxy.page/",
        "xn--cloud-4sa.com",
        "http://45.159.189.105/bot/regex",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "www.redtube.comyouporn.com",
        "yoursexy.porn | indianyouporn.com",
        "africa.konnect.com",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "euw-serp-dev-testing19.duck.ai",
        "cdn.pornsocket.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "xhamster.comyouporn.com",
        "watchhers.net",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "static-push-preprod.porndig.com",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "https://mylegalbid.com/malwarebytes",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "qbot.zip",
        "weconnect.com",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "Yara Detections: Tofsee",
        "www.anyxxxtube.net",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "jimgaffigan.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "https://twitter.com/PORNO_SEXYBABES",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "cams4all.com",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "Musiclab, LLC",
        "838114.parkingcrew.net",
        "mwilliams.dev@gmail.com | piratepages.com",
        "campaign-manager.sharecare.com",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "BearShare Install File Version 12.0.0.135802",
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "ns2.abovedomains.com",
        "dropboxpayments.com",
        "pirateproxy.cc",
        "http://console.applemarketingtools.com/",
        "youramateuporn.com",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojandownloader:win32/cutwail",
            "Possible",
            "Adware affiliate",
            "Win32.application.bearshare.a",
            "Win.packed.bandook-9882274-1",
            "Virtool",
            "Win32/searchsuite",
            "Exploit:win32/cve-2017-0147",
            "Cve-2023-22518",
            "Backdoor:win32/tofsee.t",
            "Win.trojan.tofsee-7102058-0",
            "Azorult cnc"
          ],
          "industries": [
            "Government",
            "Healthcare",
            "Technology"
          ],
          "unique_indicators": 40507
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/forbin.net",
    "whois": "http://whois.domaintools.com/forbin.net",
    "domain": "forbin.net",
    "hostname": "webmail.forbin.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69ded8198b25581a09b90824",
      "name": "BearShare \u2022 Solarwinds? \u2022 SearchSuite \u2022 Healthcare Administration",
      "description": "",
      "modified": "2026-04-15T00:13:13.981000",
      "created": "2026-04-15T00:13:13.981000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "4 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69db05f833d3d6d2231fb201",
      "name": "CREDIT: Q.Vashti's research: SearchSuite \u2022 Healthcare Administration CREATED 6 HOURS AGO by Q.Vashti",
      "description": "",
      "modified": "2026-04-12T02:39:52.993000",
      "created": "2026-04-12T02:39:52.993000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": "69dab27a0493e0e80a0f35cd",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 49,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dab27a0493e0e80a0f35cd",
      "name": "SearchSuite \u2022 Healthcare Administration",
      "description": "Embedded in communication between a healthcare system and a client. \n\nThis is just one of countless internal issues causing a gap in communication, malicious adware, spyware, system sweeps, injection, system modification, downloads , call failures.",
      "modified": "2026-04-11T20:43:38.695000",
      "created": "2026-04-11T20:43:38.695000",
      "tags": [
        "Win32/SearchSuite",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 installer",
        "install system",
        "compiler",
        "NSIS",
        "code signing",
        "serial number",
        "db d2",
        "de d3",
        "f3 e1",
        "issuer thawte",
        "primary root",
        "ca valid",
        "valid",
        "valid usage",
        "client auth",
        "algorithm",
        "rticon english",
        "type type",
        "chi2",
        "ico rtgroupicon",
        "english us",
        "capa",
        "c2 antianalysis",
        "executable",
        "sample appears",
        "installer",
        "installers well",
        "results may",
        "be misleading",
        "or incomplete",
        "analyze created",
        "techniques",
        "info modify",
        "files",
        "modify registry",
        "directory permi",
        "techniques none",
        "info",
        "scripting inte",
        "shared modules",
        "Bear Share",
        "urls",
        "ip address",
        "asn as8075",
        "united",
        "flag united",
        "name servers",
        "name domain",
        "org apple",
        "infinite loop",
        "city cupertino",
        "country us",
        "dnssec",
        "urlmailto",
        "urlhttps",
        "search",
        "urlhttp",
        "moved",
        "title",
        "encrypt",
        "certificate",
        "segoe ui",
        "otx logo",
        "url analysis",
        "tokyo",
        "msie",
        "chrome",
        "gmt content",
        "all ipv4",
        "zeppelin",
        "trojandropper",
        "cookie",
        "backdoor",
        "hash avast",
        "avg clamav",
        "msdefender feb",
        "k oct",
        "k may",
        "mtb feb",
        "mtb jan",
        "k aug",
        "windows nt",
        "dynamicloader",
        "unknown",
        "medium",
        "default",
        "as16509",
        "show",
        "powershell",
        "write",
        "xserver",
        "bearshar data",
        "passive dns",
        "pulse submit",
        "port",
        "destination",
        "high",
        "displayname",
        "windows",
        "win64",
        "tofsee",
        "stream",
        "malware",
        "push",
        "next",
        "asnone",
        "germany as8560",
        "russia as198610",
        "strings",
        "is__elf",
        "systembc_linux_variant",
        "khtml",
        "gecko",
        "acceptencoding",
        "get na",
        "macintosh",
        "intel mac",
        "accept",
        "france as16276",
        "yara detections",
        "contacted",
        "all filehash",
        "sha256",
        "pulse pulses",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "tls sni",
        "less see",
        "all ip",
        "Apple",
        "xordata",
        "United States"
      ],
      "references": [
        "b9e4e47c3f96846c30581c08acf5bc56.virus",
        "BearShare Install File Version 12.0.0.135802",
        "Musiclab, LLC",
        "msoid.applemanic.com \u2022 msoid.giftcardapple.shop \u2022 msoid.appleportconsulting.com",
        "gateway.fe.apple-dns.net \u2022 apple-dns.net",
        "africa.konnect.com",
        "http://scratch-mit-edu.027.cloudns.asia/users/alessandrito123",
        "euw-serp-dev-testing19.duck.ai",
        "account-apple.com",
        "Win.Trojan.Tofsee-7102058-0 ,  Backdoor:Win32/Tofsee.T",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check Observed Telegram Domain (t .me in TLS SNI)",
        "Yara Detections: Tofsee",
        "Alerts: behavior_tofsee creates_largekey injection_write_exe_process network_bind",
        "Alerts: persistence_autorun persistence_autorun_tasks procmem_yara static_pe_anomaly",
        "Alerts: suricata_alert antivm_generic_services physical_drive_access deletes_executed_files",
        "Alerts: deletes_self injection_runpe persistence_ads suspicious_command_tools",
        "Alerts: anomalous_deletefile antisandbox_sleep dead_connect dynamic_function_loading",
        "IP\u2019s Contacted: 47.43.26.4  195.35.13.119  149.154.167.99  185.138.56.214  142.250.147.26  81.88.48.101",
        "IP\u2019s Contacted: 104.21.72.117  172.66.156.195  157.240.200.174  141.193.213.20",
        "Domains Contacted: microsoft.com microsoft-com.mail.protection.outlook.com vanaheim.cn yahoo.com mta6.am0.yahoodns.net 13.205.167.198.dnsbl.sorbs.net 13.205.167.198.bl.spamcop.net 13.205.167.198.zen.spamhaus.org 13.205.167.198.sbl-xbl.spamhaus.org 13.205.167.198.cbl.abuseat.org",
        "https://perigon-one.au.itglue.com/password_shared_links/52f082d3-d889-4db5-ae03-c7bfcbe5aa21",
        "https://identity.prd-cdc.jemena.com.au/pages/jemena-reset-password",
        "https://in2it.itglue.com/password_shared_links/9b0e2a1d-b554-4f0c-a333-390e41defe8e",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback&response_type=code&scope=openid+email+profile&state=uJZE80MW6TdJQjbI0RWXhnF3SpYZXckLkfafnEHgr_I:",
        "https://oauth2.admin.p4d-1.p4d.aks.lightops.cloud.slb-ds.com/lightops-auth/callback",
        "ids-apple.com \u2022 itunes.org",
        "xn--cloud-4sa.com",
        "http://cab.applemarketingtools.com",
        "http://console.applemarketingtools.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Spain",
        "France",
        "United Kingdom of Great Britain and Northern Ireland",
        "Netherlands",
        "Japan",
        "Switzerland",
        "Madagascar",
        "Finland",
        "Germany",
        "Russian Federation"
      ],
      "malware_families": [
        {
          "id": "Win32/SearchSuite",
          "display_name": "Win32/SearchSuite",
          "target": null
        },
        {
          "id": "Win32.Application.BearShare.A",
          "display_name": "Win32.Application.BearShare.A",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "CVE-2023-22518",
          "display_name": "CVE-2023-22518",
          "target": null
        },
        {
          "id": "Win.Packed.Bandook-9882274-1",
          "display_name": "Win.Packed.Bandook-9882274-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-7102058-0",
          "display_name": "Win.Trojan.Tofsee-7102058-0",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Government",
        "Healthcare",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 138,
        "FileHash-SHA1": 119,
        "FileHash-SHA256": 3553,
        "IPv4": 633,
        "CVE": 2,
        "URL": 6134,
        "domain": 2439,
        "hostname": 2271,
        "email": 9,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 15300,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be56d257bb241c4fa3f68d",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:02.291000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be56d6df9d36bac14ccd87",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:06.808000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8134,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://webmail.forbin.net/login.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://webmail.forbin.net/login.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641162.0690465
}