{
  "type": "URL",
  "indicator": "https://ww38.darmedicus.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ww38.darmedicus.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3808651504,
      "indicator": "https://ww38.darmedicus.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6944ce38344ccded23df66f5",
          "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
          "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
          "modified": "2026-01-18T03:05:59.836000",
          "created": "2025-12-19T04:02:00.973000",
          "tags": [
            "intel",
            "ms windows",
            "write c",
            "pe32",
            "pe32 executable",
            "copy c",
            "free",
            "benjamin",
            "write",
            "worm",
            "win32",
            "code",
            "june",
            "delphi",
            "malware",
            "benjamin",
            "tulach",
            "state of colorado",
            "christopher p. \u2018buzz\u2019 ahmann",
            "danica implants",
            "nids_malware_alert",
            "bonu$",
            "network_icmp",
            "network_irc",
            "persistence_autorun",
            "network_http",
            "nids_alert",
            "allocates_rwx",
            "hackers",
            "creates_exe",
            "brian sabey",
            "sour del",
            "packer_entropy",
            "antivm_memory_available",
            "pe_features",
            "get key",
            "crime",
            "organized crime",
            "federal crime",
            "cyber crime",
            "piracy",
            "status",
            "china unknown",
            "name servers",
            "div div",
            "ip address",
            "domain",
            "creation date",
            "record value",
            "meta",
            "title",
            "hong kong",
            "passive dns",
            "gmt content",
            "type",
            "content length",
            "ipv4 add",
            "urls",
            "files",
            "location hong",
            "twitter",
            "youtube",
            "side 3 studios",
            "denver music",
            "infiltration",
            "whistleblower",
            "getkey",
            "cyber warfare",
            "fraud",
            "financial crimes",
            "pegasus",
            "music front",
            "france unknown",
            "present feb",
            "iran unknown",
            "present nov",
            "present jun",
            "present jan",
            "hidden",
            "present jul",
            "date",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "llc name",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "show technique",
            "ck matrix",
            "ascii text",
            "href",
            "show process",
            "file",
            "general",
            "local",
            "path",
            "memory dumping",
            "entries",
            "icmp delphi",
            "showing",
            "delete",
            "yara detections",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "dns query",
            "packing t1045",
            "ransom",
            "cve",
            "palantir",
            "remote",
            "graham"
          ],
          "references": [
            "Amnesty.org | remote.amnesty.org",
            "tulach.cc",
            "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
            "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
            "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
            "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
            "Delphi This program must be run under Win32 Compilers",
            "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
            "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
            "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
            "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
            "ipv4bot.whatismyipaddress.com",
            "helloprismatic.com",
            "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
            "Brian Sabey",
            "Christopher P. \u2018Buzz\u2019 Ahmann"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "Ransom:Win32/GandCrab",
              "display_name": "Ransom:Win32/GandCrab",
              "target": "/malware/Ransom:Win32/GandCrab"
            },
            {
              "id": "CVE-2023-2868",
              "display_name": "CVE-2023-2868",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 429,
            "FileHash-SHA1": 341,
            "FileHash-SHA256": 2766,
            "URL": 6976,
            "domain": 1151,
            "CVE": 2,
            "email": 3,
            "hostname": 2913,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14585,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "91 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a39f005c7f0a1c1eb33125",
          "name": "Formbook",
          "description": "FormBook is a data stealer that is being distributed as a MaaS. FormBook is available in the dark web market as a Malware-as-Service.\n I n known situations targets were contacted by bad actors  via social media accounts Twitter & Facebook.",
          "modified": "2024-03-21T10:00:24.070000",
          "created": "2024-01-14T08:44:48.297000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1708,
            "hostname": 1920,
            "domain": 2221,
            "URL": 4822,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10893,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "759 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a4880cf26f0feaf9a75648",
          "name": "Formbook",
          "description": "",
          "modified": "2024-02-13T08:03:20.064000",
          "created": "2024-01-15T01:19:08.041000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a39f005c7f0a1c1eb33125",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1650,
            "hostname": 1778,
            "domain": 2102,
            "URL": 4435,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10187,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "796 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a20ff8db3854e863dca324",
          "name": "Shared Modules | Hijacker | Masquerading",
          "description": "",
          "modified": "2024-02-12T04:01:56.040000",
          "created": "2024-01-13T04:22:16.961000",
          "tags": [
            "filehashmd5",
            "no expiration",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "hostname",
            "expiration",
            "domain",
            "url https",
            "url http",
            "source",
            "stix",
            "email",
            "email abuse",
            "goreasonlimited",
            "cc no",
            "tompc",
            "sum35",
            "domain xn",
            "searchbox0",
            "domainname0",
            "view",
            "apple",
            "apple id",
            "hijacking",
            "masquerading",
            "exploit",
            "cams",
            "monitoring",
            "loki bot",
            "dns",
            "open ports",
            "malvertizing",
            "malware hosting",
            "apple script",
            "js user",
            "dga",
            "dga domains",
            "malware",
            "multiple_versions",
            "wagersta",
            "decode",
            "system information discovery",
            "decrypt",
            "evasion",
            "defense evasion",
            "emotet",
            "android",
            "ios",
            "wannacry",
            "trojan",
            "worm",
            "cyber threat",
            "benjamin",
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "contacted urls",
            "execution",
            "whois whois",
            "whois sslcert",
            "and china",
            "drop",
            "uchealth",
            "university of cincinnati health"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 2296,
            "FileHash-SHA256": 3362,
            "URL": 6191,
            "domain": 2033,
            "hostname": 3097,
            "email": 37,
            "CVE": 2
          },
          "indicator_count": 19719,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "797 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "helloprismatic.com",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
        "ipv4bot.whatismyipaddress.com",
        "Brian Sabey",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "Amnesty.org | remote.amnesty.org",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "Christopher P. \u2018Buzz\u2019 Ahmann",
        "appleremote.net",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "FormBook",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "Delphi This program must be run under Win32 Compilers",
        "tulach.cc",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cve-2023-2868",
            "Exploit:win32/cve-2017-0147",
            "Ransom:win32/gandcrab",
            "Formbook",
            "Worm:win32/benjamin"
          ],
          "industries": [],
          "unique_indicators": 44295
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/darmedicus.org",
    "whois": "http://whois.domaintools.com/darmedicus.org",
    "domain": "darmedicus.org",
    "hostname": "ww38.darmedicus.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6944ce38344ccded23df66f5",
      "name": "Ransom - Amnesty.org - a single link in a Pegasus attack against a civilian.",
      "description": "I don\u2019t have the right words to put this together because it involves so much coercion, fraud, betrayal, manipulation , hacking, multiple business fronts, loud mouth mafia plants, working with someone under false pretenses, redhat security teams in Denver , Colorado, false implications of cyber attacks coming from foreign entities. \n\nTips come from a highly reliable sources. One link in a Pegasus attack .",
      "modified": "2026-01-18T03:05:59.836000",
      "created": "2025-12-19T04:02:00.973000",
      "tags": [
        "intel",
        "ms windows",
        "write c",
        "pe32",
        "pe32 executable",
        "copy c",
        "free",
        "benjamin",
        "write",
        "worm",
        "win32",
        "code",
        "june",
        "delphi",
        "malware",
        "benjamin",
        "tulach",
        "state of colorado",
        "christopher p. \u2018buzz\u2019 ahmann",
        "danica implants",
        "nids_malware_alert",
        "bonu$",
        "network_icmp",
        "network_irc",
        "persistence_autorun",
        "network_http",
        "nids_alert",
        "allocates_rwx",
        "hackers",
        "creates_exe",
        "brian sabey",
        "sour del",
        "packer_entropy",
        "antivm_memory_available",
        "pe_features",
        "get key",
        "crime",
        "organized crime",
        "federal crime",
        "cyber crime",
        "piracy",
        "status",
        "china unknown",
        "name servers",
        "div div",
        "ip address",
        "domain",
        "creation date",
        "record value",
        "meta",
        "title",
        "hong kong",
        "passive dns",
        "gmt content",
        "type",
        "content length",
        "ipv4 add",
        "urls",
        "files",
        "location hong",
        "twitter",
        "youtube",
        "side 3 studios",
        "denver music",
        "infiltration",
        "whistleblower",
        "getkey",
        "cyber warfare",
        "fraud",
        "financial crimes",
        "pegasus",
        "music front",
        "france unknown",
        "present feb",
        "iran unknown",
        "present nov",
        "present jun",
        "present jan",
        "hidden",
        "present jul",
        "date",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "llc name",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "show technique",
        "ck matrix",
        "ascii text",
        "href",
        "show process",
        "file",
        "general",
        "local",
        "path",
        "memory dumping",
        "entries",
        "icmp delphi",
        "showing",
        "delete",
        "yara detections",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "dns query",
        "packing t1045",
        "ransom",
        "cve",
        "palantir",
        "remote",
        "graham"
      ],
      "references": [
        "Amnesty.org | remote.amnesty.org",
        "tulach.cc",
        "Worm:Win32/Benjamin IDS Detections: Win32.Worm.Benjamin.A CnC Checkin ICMP",
        "Alerts : nids_malware_alert network_icmp network_irc persistence_autorun network_http",
        "Alerts :  nids_alert allocates_rwx creates_exe packer_entropy antivm_memory_available",
        "Delphi Likely Precursor to Scan PING Delphi-Piette Windows Yara Detections Delphi",
        "Delphi This program must be run under Win32 Compilers",
        "More IP\u2019s Contacted  74.6.143.26 Domains Contacted benjamin.xww.de",
        "http://www.yixun.com/getkey {\"privateKey\": \"JMVRar4COFWb3eKZ\"}",
        "Server: JFE https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://www.yixun.com/getkey",
        "http://www.shopsleuth.com/goal-academy/the-citadel/colorado-springs-co",
        "ipv4bot.whatismyipaddress.com",
        "helloprismatic.com",
        "https://palantir-staging.staging.candidate.app.paulsjob.ai/",
        "Brian Sabey",
        "Christopher P. \u2018Buzz\u2019 Ahmann"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "Ransom:Win32/GandCrab",
          "display_name": "Ransom:Win32/GandCrab",
          "target": "/malware/Ransom:Win32/GandCrab"
        },
        {
          "id": "CVE-2023-2868",
          "display_name": "CVE-2023-2868",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 429,
        "FileHash-SHA1": 341,
        "FileHash-SHA256": 2766,
        "URL": 6976,
        "domain": 1151,
        "CVE": 2,
        "email": 3,
        "hostname": 2913,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14585,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "91 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a39f005c7f0a1c1eb33125",
      "name": "Formbook",
      "description": "FormBook is a data stealer that is being distributed as a MaaS. FormBook is available in the dark web market as a Malware-as-Service.\n I n known situations targets were contacted by bad actors  via social media accounts Twitter & Facebook.",
      "modified": "2024-03-21T10:00:24.070000",
      "created": "2024-01-14T08:44:48.297000",
      "tags": [
        "ssl certificate",
        "contacted",
        "execution",
        "ah6itbtgl",
        "whois record",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "formbook",
        "threat roundup",
        "malware",
        "metro",
        "social engineering",
        "jansky",
        "script urls",
        "a domains",
        "united",
        "search",
        "date",
        "script domains",
        "creation date",
        "record value",
        "showing",
        "unknown",
        "meta",
        "body",
        "encrypt",
        "as63949 linode",
        "as41357",
        "united kingdom",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse submit",
        "url analysis",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "email",
        "registry domain",
        "win32 exe",
        "javascript",
        "eqsray",
        "zip blaze",
        "ms excel",
        "detections type",
        "name",
        "text",
        "csv order",
        "files",
        "microsoft",
        "dns replication",
        "bt6lcuigydc9yc",
        "jxaavf4jnzza0",
        "submission",
        "community score",
        "no security",
        "graph api",
        "status",
        "content type",
        "xcitium verdict",
        "cloud marketing",
        "history first",
        "thebrotherssabey",
        "passive dns",
        "gmt content",
        "plesklin",
        "ipv4",
        "pulse pulses",
        "urls",
        "vbs",
        "data center",
        "reverse dns",
        "first",
        "utc submissions",
        "submitters",
        "bbonline uk",
        "namecheap inc",
        "summary iocs",
        "graph community",
        "ionos se",
        "keysystems gmbh",
        "record type",
        "ttl value",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "sabey",
        "all search",
        "otx octoseek",
        "url http",
        "http",
        "hostname",
        "files domain",
        "msie",
        "chrome",
        "expiration date",
        "next",
        "whois lookup",
        "dnssec",
        "domain name",
        "abuse contact",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "cname",
        "as44273 host",
        "ip address"
      ],
      "references": [
        "appleremote.net",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "FormBook",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1708,
        "hostname": 1920,
        "domain": 2221,
        "URL": 4822,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 119,
        "email": 2,
        "CIDR": 1
      },
      "indicator_count": 10893,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "759 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a4880cf26f0feaf9a75648",
      "name": "Formbook",
      "description": "",
      "modified": "2024-02-13T08:03:20.064000",
      "created": "2024-01-15T01:19:08.041000",
      "tags": [
        "ssl certificate",
        "contacted",
        "execution",
        "ah6itbtgl",
        "whois record",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "formbook",
        "threat roundup",
        "malware",
        "metro",
        "social engineering",
        "jansky",
        "script urls",
        "a domains",
        "united",
        "search",
        "date",
        "script domains",
        "creation date",
        "record value",
        "showing",
        "unknown",
        "meta",
        "body",
        "encrypt",
        "as63949 linode",
        "as41357",
        "united kingdom",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse submit",
        "url analysis",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "email",
        "registry domain",
        "win32 exe",
        "javascript",
        "eqsray",
        "zip blaze",
        "ms excel",
        "detections type",
        "name",
        "text",
        "csv order",
        "files",
        "microsoft",
        "dns replication",
        "bt6lcuigydc9yc",
        "jxaavf4jnzza0",
        "submission",
        "community score",
        "no security",
        "graph api",
        "status",
        "content type",
        "xcitium verdict",
        "cloud marketing",
        "history first",
        "thebrotherssabey",
        "passive dns",
        "gmt content",
        "plesklin",
        "ipv4",
        "pulse pulses",
        "urls",
        "vbs",
        "data center",
        "reverse dns",
        "first",
        "utc submissions",
        "submitters",
        "bbonline uk",
        "namecheap inc",
        "summary iocs",
        "graph community",
        "ionos se",
        "keysystems gmbh",
        "record type",
        "ttl value",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "sabey",
        "all search",
        "otx octoseek",
        "url http",
        "http",
        "hostname",
        "files domain",
        "msie",
        "chrome",
        "expiration date",
        "next",
        "whois lookup",
        "dnssec",
        "domain name",
        "abuse contact",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "cname",
        "as44273 host",
        "ip address"
      ],
      "references": [
        "appleremote.net",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "FormBook",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65a39f005c7f0a1c1eb33125",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1650,
        "hostname": 1778,
        "domain": 2102,
        "URL": 4435,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 119,
        "email": 2,
        "CIDR": 1
      },
      "indicator_count": 10187,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "796 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a20ff8db3854e863dca324",
      "name": "Shared Modules | Hijacker | Masquerading",
      "description": "",
      "modified": "2024-02-12T04:01:56.040000",
      "created": "2024-01-13T04:22:16.961000",
      "tags": [
        "filehashmd5",
        "no expiration",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "hostname",
        "expiration",
        "domain",
        "url https",
        "url http",
        "source",
        "stix",
        "email",
        "email abuse",
        "goreasonlimited",
        "cc no",
        "tompc",
        "sum35",
        "domain xn",
        "searchbox0",
        "domainname0",
        "view",
        "apple",
        "apple id",
        "hijacking",
        "masquerading",
        "exploit",
        "cams",
        "monitoring",
        "loki bot",
        "dns",
        "open ports",
        "malvertizing",
        "malware hosting",
        "apple script",
        "js user",
        "dga",
        "dga domains",
        "malware",
        "multiple_versions",
        "wagersta",
        "decode",
        "system information discovery",
        "decrypt",
        "evasion",
        "defense evasion",
        "emotet",
        "android",
        "ios",
        "wannacry",
        "trojan",
        "worm",
        "cyber threat",
        "benjamin",
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "contacted urls",
        "execution",
        "whois whois",
        "whois sslcert",
        "and china",
        "drop",
        "uchealth",
        "university of cincinnati health"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 2296,
        "FileHash-SHA256": 3362,
        "URL": 6191,
        "domain": 2033,
        "hostname": 3097,
        "email": 37,
        "CVE": 2
      },
      "indicator_count": 19719,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "797 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ww38.darmedicus.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ww38.darmedicus.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641594.9790769
}