{
  "type": "URL",
  "indicator": "https://woc.cl668.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://woc.cl668.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4105049114,
      "indicator": "https://woc.cl668.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6946fdbb4a22dc28d60d6ca2",
          "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
          "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
          "modified": "2026-01-19T19:04:41.997000",
          "created": "2025-12-20T19:49:15.713000",
          "tags": [
            "doomscroller",
            "browsehappy",
            "xpirat",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "united",
            "tlsv1",
            "execution",
            "dock",
            "write",
            "persistence",
            "encrypt",
            "meta",
            "browse happy",
            "worry",
            "body doctype",
            "online",
            "gmt server",
            "a domains",
            "ipv4 add",
            "win32",
            "trojandropper",
            "title",
            "date",
            "unknown",
            "post http",
            "cryptexportkey",
            "cryptgenkey",
            "calgrc4",
            "expiro",
            "temple",
            "xserver",
            "adversaries",
            "worry wordpress"
          ],
          "references": [
            "Xpirat = doomscroller.io"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Xpirat",
              "display_name": "Xpirat",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1423",
              "name": "Network Service Scanning",
              "display_name": "T1423 - Network Service Scanning"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5576,
            "domain": 1502,
            "FileHash-MD5": 116,
            "FileHash-SHA1": 73,
            "FileHash-SHA256": 1041,
            "SSLCertFingerprint": 1,
            "hostname": 1951
          },
          "indicator_count": 10260,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6944ce38344ccded23df66f5",
          "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
          "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
          "modified": "2026-01-18T03:05:59.836000",
          "created": "2025-12-19T04:02:00.973000",
          "tags": [
            "intel",
            "ms windows",
            "write c",
            "pe32",
            "pe32 executable",
            "copy c",
            "free",
            "benjamin",
            "write",
            "worm",
            "win32",
            "code",
            "june",
            "delphi",
            "malware",
            "benjamin",
            "tulach",
            "state of colorado",
            "christopher p. \u2018buzz\u2019 ahmann",
            "danica implants",
            "nids_malware_alert",
            "bonu$",
            "network_icmp",
            "network_irc",
            "persistence_autorun",
            "network_http",
            "nids_alert",
            "allocates_rwx",
            "hackers",
            "creates_exe",
            "brian sabey",
            "sour del",
            "packer_entropy",
            "antivm_memory_available",
            "pe_features",
            "get key",
            "crime",
            "organized crime",
            "federal crime",
            "cyber crime",
            "piracy",
            "status",
            "china unknown",
            "name servers",
            "div div",
            "ip address",
            "domain",
            "creation date",
            "record value",
            "meta",
            "title",
            "hong kong",
            "passive dns",
            "gmt content",
            "type",
            "content length",
            "ipv4 add",
            "urls",
            "files",
            "location hong",
            "twitter",
            "youtube",
            "side 3 studios",
            "denver music",
            "infiltration",
            "whistleblower",
            "getkey",
            "cyber warfare",
            "fraud",
            "financial crimes",
            "pegasus",
            "music front",
            "france unknown",
            "present feb",
            "iran unknown",
            "present nov",
            "present jun",
            "present jan",
            "hidden",
            "present jul",
            "date",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "llc name",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "show technique",
            "ck matrix",
            "ascii text",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "memory dumping",
            "entries",
            "icmp delphi",
            "showing",
            "delete",
            "yara detections",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "dns query",
            "packing t1045",
            "ransom",
            "cve",
            "palantir",
            "remote",
            "graham"
          ],
          "references": [
            "Amnesty.org | remote.amnesty.org",
            "tulach.cc",
            "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
            "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
            "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
            "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
            "Delphi This program must be run under Win32 Compilers",
            "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
            "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
            "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
            "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
            "ipv4bot.whatismyipaddress.com",
            "helloprismatic.com",
            "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
            "Brian Sabey",
            "Christopher P. \u2018Buzz\u2019 Ahmann"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "Ransom:Win32/GandCrab",
              "display_name": "Ransom:Win32/GandCrab",
              "target": "/malware/Ransom:Win32/GandCrab"
            },
            {
              "id": "CVE-2023-2868",
              "display_name": "CVE-2023-2868",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 429,
            "FileHash-SHA1": 341,
            "FileHash-SHA256": 2766,
            "URL": 6976,
            "domain": 1151,
            "CVE": 2,
            "email": 3,
            "hostname": 2913,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14585,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "91 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893032410060f658d862c60",
          "name": "Hosting App - Partial research | Emotet Worm",
          "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:24:20.645000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68930449988277cd29c25cb7",
          "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
          "description": "",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:29:13.136000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6893032410060f658d862c60",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "tulach.cc",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "Xpirat = doomscroller.io",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "Brian Sabey",
        "Amnesty.org | remote.amnesty.org",
        "Delphi This program must be run under Win32 Compilers",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
        "ipv4bot.whatismyipaddress.com",
        "Christopher P. \u2018Buzz\u2019 Ahmann",
        "helloprismatic.com",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Exploit:win32/cve-2017-0147",
            "Cve-2023-2868",
            "Xpirat",
            "Ransom:win32/gandcrab",
            "Worm:win32/benjamin",
            "Expiro"
          ],
          "industries": [],
          "unique_indicators": 40760
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/cl668.com",
    "whois": "http://whois.domaintools.com/cl668.com",
    "domain": "cl668.com",
    "hostname": "woc.cl668.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6946fdbb4a22dc28d60d6ca2",
      "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
      "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
      "modified": "2026-01-19T19:04:41.997000",
      "created": "2025-12-20T19:49:15.713000",
      "tags": [
        "doomscroller",
        "browsehappy",
        "xpirat",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "united",
        "tlsv1",
        "execution",
        "dock",
        "write",
        "persistence",
        "encrypt",
        "meta",
        "browse happy",
        "worry",
        "body doctype",
        "online",
        "gmt server",
        "a domains",
        "ipv4 add",
        "win32",
        "trojandropper",
        "title",
        "date",
        "unknown",
        "post http",
        "cryptexportkey",
        "cryptgenkey",
        "calgrc4",
        "expiro",
        "temple",
        "xserver",
        "adversaries",
        "worry wordpress"
      ],
      "references": [
        "Xpirat = doomscroller.io"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Xpirat",
          "display_name": "Xpirat",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1423",
          "name": "Network Service Scanning",
          "display_name": "T1423 - Network Service Scanning"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5576,
        "domain": 1502,
        "FileHash-MD5": 116,
        "FileHash-SHA1": 73,
        "FileHash-SHA256": 1041,
        "SSLCertFingerprint": 1,
        "hostname": 1951
      },
      "indicator_count": 10260,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6944ce38344ccded23df66f5",
      "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
      "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
      "modified": "2026-01-18T03:05:59.836000",
      "created": "2025-12-19T04:02:00.973000",
      "tags": [
        "intel",
        "ms windows",
        "write c",
        "pe32",
        "pe32 executable",
        "copy c",
        "free",
        "benjamin",
        "write",
        "worm",
        "win32",
        "code",
        "june",
        "delphi",
        "malware",
        "benjamin",
        "tulach",
        "state of colorado",
        "christopher p. \u2018buzz\u2019 ahmann",
        "danica implants",
        "nids_malware_alert",
        "bonu$",
        "network_icmp",
        "network_irc",
        "persistence_autorun",
        "network_http",
        "nids_alert",
        "allocates_rwx",
        "hackers",
        "creates_exe",
        "brian sabey",
        "sour del",
        "packer_entropy",
        "antivm_memory_available",
        "pe_features",
        "get key",
        "crime",
        "organized crime",
        "federal crime",
        "cyber crime",
        "piracy",
        "status",
        "china unknown",
        "name servers",
        "div div",
        "ip address",
        "domain",
        "creation date",
        "record value",
        "meta",
        "title",
        "hong kong",
        "passive dns",
        "gmt content",
        "type",
        "content length",
        "ipv4 add",
        "urls",
        "files",
        "location hong",
        "twitter",
        "youtube",
        "side 3 studios",
        "denver music",
        "infiltration",
        "whistleblower",
        "getkey",
        "cyber warfare",
        "fraud",
        "financial crimes",
        "pegasus",
        "music front",
        "france unknown",
        "present feb",
        "iran unknown",
        "present nov",
        "present jun",
        "present jan",
        "hidden",
        "present jul",
        "date",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "llc name",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "show technique",
        "ck matrix",
        "ascii text",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "memory dumping",
        "entries",
        "icmp delphi",
        "showing",
        "delete",
        "yara detections",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "dns query",
        "packing t1045",
        "ransom",
        "cve",
        "palantir",
        "remote",
        "graham"
      ],
      "references": [
        "Amnesty.org | remote.amnesty.org",
        "tulach.cc",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "Delphi This program must be run under Win32 Compilers",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "ipv4bot.whatismyipaddress.com",
        "helloprismatic.com",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "Brian Sabey",
        "Christopher P. \u2018Buzz\u2019 Ahmann"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "Ransom:Win32/GandCrab",
          "display_name": "Ransom:Win32/GandCrab",
          "target": "/malware/Ransom:Win32/GandCrab"
        },
        {
          "id": "CVE-2023-2868",
          "display_name": "CVE-2023-2868",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 429,
        "FileHash-SHA1": 341,
        "FileHash-SHA256": 2766,
        "URL": 6976,
        "domain": 1151,
        "CVE": 2,
        "email": 3,
        "hostname": 2913,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14585,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "91 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893032410060f658d862c60",
      "name": "Hosting App - Partial research | Emotet Worm",
      "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:24:20.645000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68930449988277cd29c25cb7",
      "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
      "description": "",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:29:13.136000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6893032410060f658d862c60",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://woc.cl668.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://woc.cl668.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776618313.253088
}