{
  "type": "URL",
  "indicator": "https://www.mindlightg.info/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.mindlightg.info/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4156167359,
      "indicator": "https://www.mindlightg.info/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "692f04e9fa3d782118e94aac",
          "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
          "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
          "modified": "2026-01-01T15:04:20.907000",
          "created": "2025-12-02T15:25:29.158000",
          "tags": [
            "levelblue",
            "open threat",
            "dynamicloader",
            "tlsv1",
            "high",
            "msie",
            "windows nt",
            "delete c",
            "fwlink",
            "stream",
            "powershell",
            "write",
            "malware",
            "local",
            "united",
            "flag",
            "date",
            "server",
            "crazy egg",
            "name server",
            "gmt flag",
            "domain address",
            "markmonitor",
            "enom",
            "sugges",
            "onv incude",
            "data upload",
            "find s",
            "extraction",
            "types",
            "type",
            "indicator",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "contacted hosts",
            "search",
            "entries",
            "read c",
            "medium",
            "memcommit",
            "tls handshake",
            "failure",
            "module load",
            "next",
            "execution",
            "dock",
            "capture",
            "persistence",
            "copy",
            "unknown",
            "suricata alert",
            "et info",
            "bad traffic",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "t1480 execution",
            "file defense",
            "write c",
            "x02x82",
            "xe6x15c6",
            "x16f",
            "xc0xc0xc0",
            "revengerat",
            "guard",
            "service",
            "encrypt",
            "entries yara",
            "delphi",
            "win32",
            "jordan",
            "delete app"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
            "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
            "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Vmprotect-9880726-0",
              "display_name": "Win.Malware.Vmprotect-9880726-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4624,
            "FileHash-SHA256": 2021,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 20,
            "SSLCertFingerprint": 10,
            "hostname": 1433,
            "domain": 728
          },
          "indicator_count": 8887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e8cd886e0bb692e8a9d08",
          "name": "Blocker Ransomware affecting Apple and iCloud  | Injection",
          "description": "Wild! Hackers attack-ack-acking!\nThey\u2019re quite good. Persistent. Angry. \nIt\u2019s the same group of hackers.",
          "modified": "2026-01-01T06:01:02.583000",
          "created": "2025-12-02T06:53:12.823000",
          "tags": [
            "url https",
            "url http",
            "domain",
            "fh no",
            "ipv4",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "pattern match",
            "mitre att",
            "ck id",
            "ck matrix",
            "ascii text",
            "href",
            "network traffic",
            "general",
            "local",
            "click",
            "strings",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "found",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "dynamicloader",
            "windows nt",
            "wow64",
            "khtml",
            "gecko",
            "write c",
            "unknown",
            "virtool",
            "write",
            "defender",
            "malware",
            "delete",
            "alerts",
            "backdoor",
            "high",
            "ip address",
            "t1045",
            "packing",
            "t1055",
            "injection",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1119",
            "t1027",
            "tools",
            "families",
            "mirai",
            "indicator role",
            "active related",
            "hackers",
            "ahmann",
            "usual suspects"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Drixed",
              "display_name": "Backdoor:Win32/Drixed",
              "target": "/malware/Backdoor:Win32/Drixed"
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector",
              "display_name": "VirTool:Win32/Injector",
              "target": "/malware/VirTool:Win32/Injector"
            },
            {
              "id": "Ransom:Win32/Blocker.NN!MTB",
              "display_name": "Ransom:Win32/Blocker.NN!MTB",
              "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
            },
            {
              "id": "Unix.Trojan.Mirai-7135937-0",
              "display_name": "Unix.Trojan.Mirai-7135937-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1470",
              "name": "Obtain Device Cloud Backups",
              "display_name": "T1470 - Obtain Device Cloud Backups"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1066",
              "name": "Indicator Removal from Tools",
              "display_name": "T1066 - Indicator Removal from Tools"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1408",
              "name": "Disguise Root/Jailbreak Indicators",
              "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1590.002",
              "name": "DNS",
              "display_name": "T1590.002 - DNS"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 234,
            "FileHash-SHA1": 219,
            "FileHash-SHA256": 841,
            "URL": 2606,
            "domain": 298,
            "hostname": 772,
            "SSLCertFingerprint": 2,
            "CVE": 1
          },
          "indicator_count": 4973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e7870eb1d3db6241c7771",
          "name": "Apple iCloud Stealer  \u2022 Mirai",
          "description": "*Mirai - Absolutely adventurous attack! They don\u2019t forget. |\nObserved. Targeted iPhone  remotely attacked. RMS user? . Fully updated device. with only one iOS application downloaded. Chaerged iOS was powered on to research suspicious activity. \nThe phone was powered off after glitched. Reset itself ,  presents a new device , icons and apps changed. Passwords stolen. Barely noticeable side drive by. iCloud unavailable. Hackers are logging in frequently, I cannot change password. The cloud is not accessible. Device has some accounts with threat research on it. Hacker is wiping. Hackers are answering the phone. Phone does not ring for other team members. Much more. Device unlocked since 10/2024. Fixed , hacked repeatedly.\nUsed to examine hacker behavior. It\u2019s  pretty sad. The ability for this level of hacker to infect other devices around devices is high / risky. \n\nHosts contacted.",
          "modified": "2026-01-01T04:03:48.354000",
          "created": "2025-12-02T05:26:08.084000",
          "tags": [
            "no expiration",
            "url http",
            "url https",
            "iocs",
            "domain",
            "enter source",
            "url or",
            "urls",
            "url add",
            "http",
            "files domain",
            "files related",
            "related tags",
            "present dec",
            "present nov",
            "united",
            "ip address",
            "tpp wholesale",
            "pty ltd",
            "unknown soa",
            "passive dns",
            "ostname add",
            "files",
            "files ip",
            "address",
            "related nids",
            "files location",
            "australia flag",
            "gmt server",
            "unix",
            "gmt etag",
            "avast avg",
            "scans record",
            "value",
            "mirai",
            "ipv4",
            "reverse dns",
            "australia asn",
            "dns resolutions",
            "domains top",
            "level",
            "twitter",
            "present jun",
            "present oct",
            "present jul",
            "proxy error",
            "web address",
            "search",
            "apache",
            "next associated",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "mtb oct",
            "toolbar",
            "ransom",
            "click",
            "yara detections",
            "alerts",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "analysis date",
            "file score",
            "delphi",
            "dns query",
            "dyndns domain",
            "delphi alerts",
            "contacted",
            "pulses",
            "date june",
            "dynamicloader",
            "medium",
            "high",
            "yara rule",
            "write c",
            "win32",
            "entries",
            "write",
            "guard",
            "next",
            "code",
            "malware",
            "local",
            "unknown",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "javascript",
            "spawns",
            "ck techniques",
            "initial access",
            "defense evasion",
            "ltd flag",
            "contacted hosts",
            "network related",
            "response risk",
            "mitre att",
            "detection",
            "detected",
            "external",
            "detected text",
            "general",
            "possible http",
            "xss attempt",
            "local source",
            "possible",
            "sinkhole cookie",
            "value snkz",
            "forbidden tls",
            "virtool",
            "copy",
            "geodata",
            "hacking",
            "cloud id"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Unix.Trojan.Mirai-7135937-0",
              "display_name": "Unix.Trojan.Mirai-7135937-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/Blocker.NN!MTB",
              "display_name": "Ransom:Win32/Blocker.NN!MTB",
              "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
            },
            {
              "id": "VirTool:Win32/Injector.CL",
              "display_name": "VirTool:Win32/Injector.CL",
              "target": "/malware/VirTool:Win32/Injector.CL"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1066",
              "name": "Indicator Removal from Tools",
              "display_name": "T1066 - Indicator Removal from Tools"
            },
            {
              "id": "T1408",
              "name": "Disguise Root/Jailbreak Indicators",
              "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1647,
            "FileHash-MD5": 196,
            "FileHash-SHA1": 187,
            "FileHash-SHA256": 450,
            "domain": 211,
            "hostname": 779
          },
          "indicator_count": 3470,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e2d950ac7d1e2a3454a4f",
          "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack",
          "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers",
          "modified": "2025-12-31T23:04:59.378000",
          "created": "2025-12-02T00:06:45.807000",
          "tags": [
            "iocs",
            "drop",
            "network traffic",
            "ck id",
            "mitre att",
            "ck matrix",
            "network related",
            "detected",
            "t1566",
            "t1204",
            "united",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "tor analysis",
            "dns requests",
            "learn",
            "suspicious",
            "informative",
            "name tactics",
            "adversaries",
            "command",
            "initial access",
            "spawns",
            "found",
            "binary file",
            "t1189",
            "regsetvalueexa",
            "regdword",
            "post http",
            "medium",
            "high",
            "regbinary",
            "loader",
            "dock",
            "write",
            "malware",
            "unknown",
            "romania unknown",
            "present may",
            "msie",
            "chrome",
            "body",
            "passive dns",
            "ip address",
            "present jun",
            "welcome",
            "accept",
            "encrypt",
            "gmt content",
            "ipv4 add",
            "url analysis",
            "urls",
            "files",
            "reverse dns",
            "unknown aaaa",
            "certificate",
            "hostname add",
            "error",
            "flag",
            "domain address",
            "contacted hosts",
            "type",
            "india unknown",
            "record value",
            "body html",
            "head title",
            "title",
            "entries",
            "read c",
            "high defense",
            "evasion",
            "yara detections",
            "virtool",
            "win32",
            "ahmann",
            "hacker group",
            "law firm",
            "order",
            "google",
            "smart assembly"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "VirTool:MSIL/Injector.BF",
              "display_name": "VirTool:MSIL/Injector.BF",
              "target": "/malware/VirTool:MSIL/Injector.BF"
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1087",
              "name": "Account Discovery",
              "display_name": "T1087 - Account Discovery"
            },
            {
              "id": "T1087.003",
              "name": "Email Account",
              "display_name": "T1087.003 - Email Account"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 115,
            "FileHash-SHA1": 112,
            "FileHash-SHA256": 589,
            "URL": 1795,
            "SSLCertFingerprint": 3,
            "domain": 319,
            "hostname": 847,
            "email": 1
          },
          "indicator_count": 3781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e1b4122a419384f1add7f",
          "name": "Cutwail Trojan DownLoader | Driveby compromises | Redirect",
          "description": "Cutwail Trojan DownLoader | Driveby comprises | Malicious Redirects.\n\nSuspicious redirects from Google homepage to \u2018Doodle\u2019s\nHeavy , ongoing cyber attack. Affects, iOS, Android, Cellular networks (global)\n\nI\u2019m hoping OTX will fully pulse. Indicators will be pulsed fully relying on OTX auto\npulse alone. No references or input from me.",
          "modified": "2025-12-31T22:02:44.679000",
          "created": "2025-12-01T22:48:33.510000",
          "tags": [
            "filehashmd5",
            "filehashsha256",
            "sha256",
            "filehashsha1",
            "indicator role",
            "title added",
            "active related",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "dynamicloader",
            "medium",
            "show",
            "entries",
            "dynamic",
            "pe section",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "copy",
            "write",
            "flag",
            "misc activity",
            "et info",
            "cloudflare dns",
            "over https",
            "windir",
            "openurl c",
            "prefetch2",
            "dns requests",
            "domain address",
            "google homepage",
            "html",
            "binary file",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "matched",
            "redirect",
            "t1189",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "found",
            "ck techniques",
            "alert",
            "potential ip",
            "general",
            "click",
            "united",
            "analysis tip",
            "analysis",
            "tor analysis",
            "date",
            "c pe",
            "data upload",
            "extraction",
            "iocs",
            "manually add",
            "network traffic",
            "detected",
            "t1566",
            "submitted url",
            "t1204"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 95,
            "FileHash-SHA1": 95,
            "FileHash-SHA256": 183,
            "hostname": 227,
            "domain": 83,
            "URL": 575
          },
          "indicator_count": 1258,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692d02f096f3ec8b5b507496",
          "name": "Google Drive: Share Files Online with Secure Cloud Storage | Google Workspace",
          "description": "nJRAT | Corrupted Google Drive sent to targets former device. Years long social engineering may have been involved. All\nIoC\u2019s Appears to involve years of social engineering. Google\ndrive service in question is a storage service based in Vietnam. | \n\nBotnet / Check-ins / Spyware / Cams. [Anon Sec Botnet subdomain name pulsed.  Close directly related to zalo.me\nand tbtteams.com]\nRequires further research.\n\nThis pulse is a bit confusing due where and who it originated from.",
          "modified": "2025-12-31T02:01:50.101000",
          "created": "2025-12-01T02:52:32.483000",
          "tags": [
            "business",
            "enterprise",
            "drive",
            "english",
            "google drive",
            "try drive",
            "business small",
            "workspace",
            "sign",
            "strong",
            "find",
            "life",
            "tools",
            "protect",
            "cloud",
            "simple",
            "android",
            "indonesia",
            "video",
            "mb download",
            "shared may",
            "shared",
            "learn",
            "drive drive",
            "name date",
            "javascript",
            "dynamicloader",
            "medium",
            "minimal headers",
            "high",
            "observed get",
            "get http",
            "united",
            "yara rule",
            "http",
            "write",
            "guard",
            "malware",
            "read c",
            "ms windows",
            "intel",
            "png image",
            "rgba",
            "pe32",
            "get na",
            "explorer",
            "music",
            "virlock",
            "media",
            "ho chi",
            "minh city",
            "viet nam",
            "storage company",
            "limited",
            "google",
            "address as",
            "luutruso",
            "cloudflar",
            "domain",
            "asn15169",
            "asn56153",
            "asn13335",
            "cisco",
            "umbrella rank",
            "apex domain",
            "url https",
            "kb stylesheet",
            "kb font",
            "kb image",
            "image",
            "kb script",
            "november",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "redirect chain",
            "kb document",
            "urls",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "t1590 gather",
            "windir",
            "openurl c",
            "prefetch2",
            "tor analysis",
            "dns requests",
            "domain address",
            "rsdsq jfu",
            "ollydbg ollydbg",
            "wireshark",
            "external",
            "binary file",
            "mitre att",
            "ck matrix",
            "aaaa",
            "cong ty",
            "co phan",
            "code",
            "province hcm",
            "files",
            "ip address",
            "request",
            "flag",
            "country",
            "contacted hosts",
            "process details",
            "link initial",
            "t1480 execution",
            "domains",
            "moved",
            "gmt content",
            "all ipv4",
            "url analysis",
            "location viet",
            "title",
            "error",
            "problem",
            "url add",
            "related nids",
            "files location",
            "flag united",
            "development att",
            "name server",
            "markmonitor",
            "localappdata",
            "programfiles",
            "edge",
            "hyundai",
            "social engineering",
            ".mil",
            "hackers",
            "phishing eml",
            "summary",
            "cisco umbrella",
            "google safe",
            "browsing",
            "current dns",
            "a record",
            "ip information",
            "ipasns ip",
            "detail domain",
            "domain tree",
            "links apex",
            "transfer",
            "b script",
            "b stylesheet",
            "frame b830",
            "b document",
            "value",
            "december",
            "degurafregistry",
            "gat object",
            "jsl object",
            "gapijstiming",
            "iframe function",
            "domainpath name",
            "nid value",
            "source level",
            "files domain",
            "files related",
            "tags",
            "related tags",
            "virustotal",
            "foundry",
            "pulse otx",
            "dark",
            "vietnam",
            "present aug",
            "present nov",
            "present jul",
            "present sep",
            "unknown aaaa",
            "search",
            "name servers",
            "present oct",
            "trojan",
            "data upload",
            "extraction",
            "se https",
            "include review",
            "exclude sugges",
            "find s",
            "failed",
            "typ don",
            "faith",
            "study",
            "romeo\u2019s",
            "juliettes",
            "femme fatales",
            "strategy",
            "honey pot",
            "honey traps",
            "spy",
            "helix",
            "anons",
            "passive dns",
            "pulse pulses",
            "files ip",
            "address",
            "location united",
            "asn as400519",
            "whois registrar",
            "ms defender",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "date hash",
            "cameras",
            "cams",
            "spycam",
            "botnet",
            "vietnam",
            "company limited",
            "dnssec",
            "status",
            "india unknown",
            "present may",
            "espionage",
            "hostname add",
            "generic",
            "cnc activity",
            "backdoor",
            "ipv4",
            "anonsecbotnet",
            "iptv"
          ],
          "references": [
            "drive.google.com/",
            "https://foundry2-lbl.dvr.dn2.n-helix.com/",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9",
            "zalo.me | href | Binary File | ATT&CK ID T1566.002",
            "https://account.helix.com/activate/start",
            "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022",
            "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]",
            "Terse Unencrypted Request for Google - Likely Connectivity Check",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6",
            "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com",
            "https://hyundaibariavungtau3s.com/vehicle/stargazer",
            "https://hyundaibariavungtau3s.com/vehicle/ioniq-5",
            "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue",
            "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade",
            "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin",
            "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/",
            "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com",
            "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/",
            "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com",
            "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/",
            "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466",
            "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam",
            "feedback-pa.clients6.google.com/v1/survey/trigger/",
            "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg",
            "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Virus.Virlock-6804475-0",
              "display_name": "Win.Virus.Virlock-6804475-0",
              "target": null
            },
            {
              "id": "Win.Malware.Bzub-6727003-0",
              "display_name": "Win.Malware.Bzub-6727003-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-9801687-0",
              "display_name": "Win.Trojan.Generic-9801687-0",
              "target": null
            },
            {
              "id": "NID",
              "display_name": "NID",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Floxif.E",
              "display_name": "Trojan:Win32/Floxif.E",
              "target": "/malware/Trojan:Win32/Floxif.E"
            },
            {
              "id": "Win.Dropper.njRAT-10015886-0",
              "display_name": "Win.Dropper.njRAT-10015886-0",
              "target": null
            },
            {
              "id": "Win.Packed.Generic-9795615-0",
              "display_name": "Win.Packed.Generic-9795615-0",
              "target": null
            },
            {
              "id": "Backdoor:MSIL/Bladabindi.AJ GC!",
              "display_name": "Backdoor:MSIL/Bladabindi.AJ GC!",
              "target": "/malware/Backdoor:MSIL/Bladabindi.AJ GC!"
            },
            {
              "id": "Win.Packed.Generic-9795615-0\t.",
              "display_name": "Win.Packed.Generic-9795615-0\t.",
              "target": null
            },
            {
              "id": "Backdoor:MSIL/Bladabindi.AJ",
              "display_name": "Backdoor:MSIL/Bladabindi.AJ",
              "target": "/malware/Backdoor:MSIL/Bladabindi.AJ"
            },
            {
              "id": "Win.Packed.Fecn-7077459-0",
              "display_name": "Win.Packed.Fecn-7077459-0",
              "target": null
            },
            {
              "id": "Trojan:MSIL/Ranos.A",
              "display_name": "Trojan:MSIL/Ranos.A",
              "target": "/malware/Trojan:MSIL/Ranos.A"
            },
            {
              "id": "Win.Trojan.Generic-6417450-0",
              "display_name": "Win.Trojan.Generic-6417450-0",
              "target": null
            },
            {
              "id": "ALF:Backdoor:MSIL/Noancooe.KA",
              "display_name": "ALF:Backdoor:MSIL/Noancooe.KA",
              "target": null
            },
            {
              "id": "Win.Packed.Msilperseus-9956592-0",
              "display_name": "Win.Packed.Msilperseus-9956592-0",
              "target": null
            },
            {
              "id": "Trojan:MSIL/ClipBanker",
              "display_name": "Trojan:MSIL/ClipBanker",
              "target": "/malware/Trojan:MSIL/ClipBanker"
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1194",
              "name": "Spearphishing via Service",
              "display_name": "T1194 - Spearphishing via Service"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1039",
              "name": "Data from Network Shared Drive",
              "display_name": "T1039 - Data from Network Shared Drive"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1567.002",
              "name": "Exfiltration to Cloud Storage",
              "display_name": "T1567.002 - Exfiltration to Cloud Storage"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1911,
            "hostname": 714,
            "FileHash-SHA256": 1304,
            "FileHash-MD5": 159,
            "FileHash-SHA1": 71,
            "SSLCertFingerprint": 2,
            "domain": 421,
            "CVE": 1,
            "email": 4
          },
          "indicator_count": 4587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "109 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/",
        "feedback-pa.clients6.google.com/v1/survey/trigger/",
        "Terse Unencrypted Request for Google - Likely Connectivity Check",
        "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com",
        "zalo.me | href | Binary File | ATT&CK ID T1566.002",
        "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue",
        "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam",
        "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com",
        "https://hyundaibariavungtau3s.com/vehicle/ioniq-5",
        "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]",
        "drive.google.com/",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6",
        "https://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9",
        "https://hyundaibariavungtau3s.com/vehicle/stargazer",
        "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin",
        "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/",
        "https://account.helix.com/activate/start",
        "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net",
        "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com",
        "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg",
        "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466",
        "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Tofsee",
            "Win.packed.fecn-7077459-0",
            "Win.virus.virlock-6804475-0",
            "Win.packed.generic-9795615-0",
            "Win.trojan.generic-9801687-0",
            "Win.malware.bzub-6727003-0",
            "Win.malware.vmprotect-9880726-0",
            "Other malware",
            "Trojan:msil/clipbanker",
            "Virtool:msil/injector.bf",
            "Ransomware",
            "Win.packed.generic-9795615-0\t.",
            "#virtool:win32/obfuscator.adb",
            "Trojan:win32/floxif.e",
            "Virtool:win32/injector.cl",
            "Win.trojan.generic-6417450-0",
            "Nid",
            "Mirai",
            "Backdoor:msil/bladabindi.aj",
            "Trojan:msil/ranos.a",
            "Backdoor:msil/bladabindi.aj gc!",
            "Alf:backdoor:msil/noancooe.ka",
            "Ransom:win32/blocker.nn!mtb",
            "Unix.trojan.mirai-7135937-0",
            "Backdoor:win32/drixed",
            "Win.dropper.njrat-10015886-0",
            "Win.packed.msilperseus-9956592-0",
            "Virtool:win32/injector"
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "unique_indicators": 23793
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mindlightg.info",
    "whois": "http://whois.domaintools.com/mindlightg.info",
    "domain": "mindlightg.info",
    "hostname": "www.mindlightg.info"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "692f04e9fa3d782118e94aac",
      "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
      "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
      "modified": "2026-01-01T15:04:20.907000",
      "created": "2025-12-02T15:25:29.158000",
      "tags": [
        "levelblue",
        "open threat",
        "dynamicloader",
        "tlsv1",
        "high",
        "msie",
        "windows nt",
        "delete c",
        "fwlink",
        "stream",
        "powershell",
        "write",
        "malware",
        "local",
        "united",
        "flag",
        "date",
        "server",
        "crazy egg",
        "name server",
        "gmt flag",
        "domain address",
        "markmonitor",
        "enom",
        "sugges",
        "onv incude",
        "data upload",
        "find s",
        "extraction",
        "types",
        "type",
        "indicator",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "contacted hosts",
        "search",
        "entries",
        "read c",
        "medium",
        "memcommit",
        "tls handshake",
        "failure",
        "module load",
        "next",
        "execution",
        "dock",
        "capture",
        "persistence",
        "copy",
        "unknown",
        "suricata alert",
        "et info",
        "bad traffic",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "t1480 execution",
        "file defense",
        "write c",
        "x02x82",
        "xe6x15c6",
        "x16f",
        "xc0xc0xc0",
        "revengerat",
        "guard",
        "service",
        "encrypt",
        "entries yara",
        "delphi",
        "win32",
        "jordan",
        "delete app"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Vmprotect-9880726-0",
          "display_name": "Win.Malware.Vmprotect-9880726-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [
        "Technology",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4624,
        "FileHash-SHA256": 2021,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 20,
        "SSLCertFingerprint": 10,
        "hostname": 1433,
        "domain": 728
      },
      "indicator_count": 8887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e8cd886e0bb692e8a9d08",
      "name": "Blocker Ransomware affecting Apple and iCloud  | Injection",
      "description": "Wild! Hackers attack-ack-acking!\nThey\u2019re quite good. Persistent. Angry. \nIt\u2019s the same group of hackers.",
      "modified": "2026-01-01T06:01:02.583000",
      "created": "2025-12-02T06:53:12.823000",
      "tags": [
        "url https",
        "url http",
        "domain",
        "fh no",
        "ipv4",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "pattern match",
        "mitre att",
        "ck id",
        "ck matrix",
        "ascii text",
        "href",
        "network traffic",
        "general",
        "local",
        "click",
        "strings",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "found",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "dynamicloader",
        "windows nt",
        "wow64",
        "khtml",
        "gecko",
        "write c",
        "unknown",
        "virtool",
        "write",
        "defender",
        "malware",
        "delete",
        "alerts",
        "backdoor",
        "high",
        "ip address",
        "t1045",
        "packing",
        "t1055",
        "injection",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1119",
        "t1027",
        "tools",
        "families",
        "mirai",
        "indicator role",
        "active related",
        "hackers",
        "ahmann",
        "usual suspects"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Drixed",
          "display_name": "Backdoor:Win32/Drixed",
          "target": "/malware/Backdoor:Win32/Drixed"
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector",
          "display_name": "VirTool:Win32/Injector",
          "target": "/malware/VirTool:Win32/Injector"
        },
        {
          "id": "Ransom:Win32/Blocker.NN!MTB",
          "display_name": "Ransom:Win32/Blocker.NN!MTB",
          "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
        },
        {
          "id": "Unix.Trojan.Mirai-7135937-0",
          "display_name": "Unix.Trojan.Mirai-7135937-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1470",
          "name": "Obtain Device Cloud Backups",
          "display_name": "T1470 - Obtain Device Cloud Backups"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1066",
          "name": "Indicator Removal from Tools",
          "display_name": "T1066 - Indicator Removal from Tools"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1408",
          "name": "Disguise Root/Jailbreak Indicators",
          "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1590.002",
          "name": "DNS",
          "display_name": "T1590.002 - DNS"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 234,
        "FileHash-SHA1": 219,
        "FileHash-SHA256": 841,
        "URL": 2606,
        "domain": 298,
        "hostname": 772,
        "SSLCertFingerprint": 2,
        "CVE": 1
      },
      "indicator_count": 4973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e7870eb1d3db6241c7771",
      "name": "Apple iCloud Stealer  \u2022 Mirai",
      "description": "*Mirai - Absolutely adventurous attack! They don\u2019t forget. |\nObserved. Targeted iPhone  remotely attacked. RMS user? . Fully updated device. with only one iOS application downloaded. Chaerged iOS was powered on to research suspicious activity. \nThe phone was powered off after glitched. Reset itself ,  presents a new device , icons and apps changed. Passwords stolen. Barely noticeable side drive by. iCloud unavailable. Hackers are logging in frequently, I cannot change password. The cloud is not accessible. Device has some accounts with threat research on it. Hacker is wiping. Hackers are answering the phone. Phone does not ring for other team members. Much more. Device unlocked since 10/2024. Fixed , hacked repeatedly.\nUsed to examine hacker behavior. It\u2019s  pretty sad. The ability for this level of hacker to infect other devices around devices is high / risky. \n\nHosts contacted.",
      "modified": "2026-01-01T04:03:48.354000",
      "created": "2025-12-02T05:26:08.084000",
      "tags": [
        "no expiration",
        "url http",
        "url https",
        "iocs",
        "domain",
        "enter source",
        "url or",
        "urls",
        "url add",
        "http",
        "files domain",
        "files related",
        "related tags",
        "present dec",
        "present nov",
        "united",
        "ip address",
        "tpp wholesale",
        "pty ltd",
        "unknown soa",
        "passive dns",
        "ostname add",
        "files",
        "files ip",
        "address",
        "related nids",
        "files location",
        "australia flag",
        "gmt server",
        "unix",
        "gmt etag",
        "avast avg",
        "scans record",
        "value",
        "mirai",
        "ipv4",
        "reverse dns",
        "australia asn",
        "dns resolutions",
        "domains top",
        "level",
        "twitter",
        "present jun",
        "present oct",
        "present jul",
        "proxy error",
        "web address",
        "search",
        "apache",
        "next associated",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "mtb oct",
        "toolbar",
        "ransom",
        "click",
        "yara detections",
        "alerts",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "analysis date",
        "file score",
        "delphi",
        "dns query",
        "dyndns domain",
        "delphi alerts",
        "contacted",
        "pulses",
        "date june",
        "dynamicloader",
        "medium",
        "high",
        "yara rule",
        "write c",
        "win32",
        "entries",
        "write",
        "guard",
        "next",
        "code",
        "malware",
        "local",
        "unknown",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "javascript",
        "spawns",
        "ck techniques",
        "initial access",
        "defense evasion",
        "ltd flag",
        "contacted hosts",
        "network related",
        "response risk",
        "mitre att",
        "detection",
        "detected",
        "external",
        "detected text",
        "general",
        "possible http",
        "xss attempt",
        "local source",
        "possible",
        "sinkhole cookie",
        "value snkz",
        "forbidden tls",
        "virtool",
        "copy",
        "geodata",
        "hacking",
        "cloud id"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Unix.Trojan.Mirai-7135937-0",
          "display_name": "Unix.Trojan.Mirai-7135937-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/Blocker.NN!MTB",
          "display_name": "Ransom:Win32/Blocker.NN!MTB",
          "target": "/malware/Ransom:Win32/Blocker.NN!MTB"
        },
        {
          "id": "VirTool:Win32/Injector.CL",
          "display_name": "VirTool:Win32/Injector.CL",
          "target": "/malware/VirTool:Win32/Injector.CL"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1066",
          "name": "Indicator Removal from Tools",
          "display_name": "T1066 - Indicator Removal from Tools"
        },
        {
          "id": "T1408",
          "name": "Disguise Root/Jailbreak Indicators",
          "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1647,
        "FileHash-MD5": 196,
        "FileHash-SHA1": 187,
        "FileHash-SHA256": 450,
        "domain": 211,
        "hostname": 779
      },
      "indicator_count": 3470,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e2d950ac7d1e2a3454a4f",
      "name": "Gooogle Accounts | Drive-by Compromise \u2022 Ransomware \u2022 Phishing Attack",
      "description": "Google accounts Drive-by Compromise. Affected Google accounts redirects to a suspicious non - Google homepage. |\nRansomware | Adware | Phishing | Injection | \nExploits seen affecting both OS and iOS devices. Threat actors able to remotely access iOS device, unlock, access iCloud. System root control, fully infected devices, Attackers continue to ravage devices w/ drive by compromise, unsafe adware, malware text, etc., Seeks to remove malicious IoC\u2019s on mock accounts , password stealers",
      "modified": "2025-12-31T23:04:59.378000",
      "created": "2025-12-02T00:06:45.807000",
      "tags": [
        "iocs",
        "drop",
        "network traffic",
        "ck id",
        "mitre att",
        "ck matrix",
        "network related",
        "detected",
        "t1566",
        "t1204",
        "united",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "tor analysis",
        "dns requests",
        "learn",
        "suspicious",
        "informative",
        "name tactics",
        "adversaries",
        "command",
        "initial access",
        "spawns",
        "found",
        "binary file",
        "t1189",
        "regsetvalueexa",
        "regdword",
        "post http",
        "medium",
        "high",
        "regbinary",
        "loader",
        "dock",
        "write",
        "malware",
        "unknown",
        "romania unknown",
        "present may",
        "msie",
        "chrome",
        "body",
        "passive dns",
        "ip address",
        "present jun",
        "welcome",
        "accept",
        "encrypt",
        "gmt content",
        "ipv4 add",
        "url analysis",
        "urls",
        "files",
        "reverse dns",
        "unknown aaaa",
        "certificate",
        "hostname add",
        "error",
        "flag",
        "domain address",
        "contacted hosts",
        "type",
        "india unknown",
        "record value",
        "body html",
        "head title",
        "title",
        "entries",
        "read c",
        "high defense",
        "evasion",
        "yara detections",
        "virtool",
        "win32",
        "ahmann",
        "hacker group",
        "law firm",
        "order",
        "google",
        "smart assembly"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "VirTool:MSIL/Injector.BF",
          "display_name": "VirTool:MSIL/Injector.BF",
          "target": "/malware/VirTool:MSIL/Injector.BF"
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1087",
          "name": "Account Discovery",
          "display_name": "T1087 - Account Discovery"
        },
        {
          "id": "T1087.003",
          "name": "Email Account",
          "display_name": "T1087.003 - Email Account"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 115,
        "FileHash-SHA1": 112,
        "FileHash-SHA256": 589,
        "URL": 1795,
        "SSLCertFingerprint": 3,
        "domain": 319,
        "hostname": 847,
        "email": 1
      },
      "indicator_count": 3781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e1b4122a419384f1add7f",
      "name": "Cutwail Trojan DownLoader | Driveby compromises | Redirect",
      "description": "Cutwail Trojan DownLoader | Driveby comprises | Malicious Redirects.\n\nSuspicious redirects from Google homepage to \u2018Doodle\u2019s\nHeavy , ongoing cyber attack. Affects, iOS, Android, Cellular networks (global)\n\nI\u2019m hoping OTX will fully pulse. Indicators will be pulsed fully relying on OTX auto\npulse alone. No references or input from me.",
      "modified": "2025-12-31T22:02:44.679000",
      "created": "2025-12-01T22:48:33.510000",
      "tags": [
        "filehashmd5",
        "filehashsha256",
        "sha256",
        "filehashsha1",
        "indicator role",
        "title added",
        "active related",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "dynamicloader",
        "medium",
        "show",
        "entries",
        "dynamic",
        "pe section",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "copy",
        "write",
        "flag",
        "misc activity",
        "et info",
        "cloudflare dns",
        "over https",
        "windir",
        "openurl c",
        "prefetch2",
        "dns requests",
        "domain address",
        "google homepage",
        "html",
        "binary file",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "matched",
        "redirect",
        "t1189",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "found",
        "ck techniques",
        "alert",
        "potential ip",
        "general",
        "click",
        "united",
        "analysis tip",
        "analysis",
        "tor analysis",
        "date",
        "c pe",
        "data upload",
        "extraction",
        "iocs",
        "manually add",
        "network traffic",
        "detected",
        "t1566",
        "submitted url",
        "t1204"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 95,
        "FileHash-SHA1": 95,
        "FileHash-SHA256": 183,
        "hostname": 227,
        "domain": 83,
        "URL": 575
      },
      "indicator_count": 1258,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692d02f096f3ec8b5b507496",
      "name": "Google Drive: Share Files Online with Secure Cloud Storage | Google Workspace",
      "description": "nJRAT | Corrupted Google Drive sent to targets former device. Years long social engineering may have been involved. All\nIoC\u2019s Appears to involve years of social engineering. Google\ndrive service in question is a storage service based in Vietnam. | \n\nBotnet / Check-ins / Spyware / Cams. [Anon Sec Botnet subdomain name pulsed.  Close directly related to zalo.me\nand tbtteams.com]\nRequires further research.\n\nThis pulse is a bit confusing due where and who it originated from.",
      "modified": "2025-12-31T02:01:50.101000",
      "created": "2025-12-01T02:52:32.483000",
      "tags": [
        "business",
        "enterprise",
        "drive",
        "english",
        "google drive",
        "try drive",
        "business small",
        "workspace",
        "sign",
        "strong",
        "find",
        "life",
        "tools",
        "protect",
        "cloud",
        "simple",
        "android",
        "indonesia",
        "video",
        "mb download",
        "shared may",
        "shared",
        "learn",
        "drive drive",
        "name date",
        "javascript",
        "dynamicloader",
        "medium",
        "minimal headers",
        "high",
        "observed get",
        "get http",
        "united",
        "yara rule",
        "http",
        "write",
        "guard",
        "malware",
        "read c",
        "ms windows",
        "intel",
        "png image",
        "rgba",
        "pe32",
        "get na",
        "explorer",
        "music",
        "virlock",
        "media",
        "ho chi",
        "minh city",
        "viet nam",
        "storage company",
        "limited",
        "google",
        "address as",
        "luutruso",
        "cloudflar",
        "domain",
        "asn15169",
        "asn56153",
        "asn13335",
        "cisco",
        "umbrella rank",
        "apex domain",
        "url https",
        "kb stylesheet",
        "kb font",
        "kb image",
        "image",
        "kb script",
        "november",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "redirect chain",
        "kb document",
        "urls",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "t1590 gather",
        "windir",
        "openurl c",
        "prefetch2",
        "tor analysis",
        "dns requests",
        "domain address",
        "rsdsq jfu",
        "ollydbg ollydbg",
        "wireshark",
        "external",
        "binary file",
        "mitre att",
        "ck matrix",
        "aaaa",
        "cong ty",
        "co phan",
        "code",
        "province hcm",
        "files",
        "ip address",
        "request",
        "flag",
        "country",
        "contacted hosts",
        "process details",
        "link initial",
        "t1480 execution",
        "domains",
        "moved",
        "gmt content",
        "all ipv4",
        "url analysis",
        "location viet",
        "title",
        "error",
        "problem",
        "url add",
        "related nids",
        "files location",
        "flag united",
        "development att",
        "name server",
        "markmonitor",
        "localappdata",
        "programfiles",
        "edge",
        "hyundai",
        "social engineering",
        ".mil",
        "hackers",
        "phishing eml",
        "summary",
        "cisco umbrella",
        "google safe",
        "browsing",
        "current dns",
        "a record",
        "ip information",
        "ipasns ip",
        "detail domain",
        "domain tree",
        "links apex",
        "transfer",
        "b script",
        "b stylesheet",
        "frame b830",
        "b document",
        "value",
        "december",
        "degurafregistry",
        "gat object",
        "jsl object",
        "gapijstiming",
        "iframe function",
        "domainpath name",
        "nid value",
        "source level",
        "files domain",
        "files related",
        "tags",
        "related tags",
        "virustotal",
        "foundry",
        "pulse otx",
        "dark",
        "vietnam",
        "present aug",
        "present nov",
        "present jul",
        "present sep",
        "unknown aaaa",
        "search",
        "name servers",
        "present oct",
        "trojan",
        "data upload",
        "extraction",
        "se https",
        "include review",
        "exclude sugges",
        "find s",
        "failed",
        "typ don",
        "faith",
        "study",
        "romeo\u2019s",
        "juliettes",
        "femme fatales",
        "strategy",
        "honey pot",
        "honey traps",
        "spy",
        "helix",
        "anons",
        "passive dns",
        "pulse pulses",
        "files ip",
        "address",
        "location united",
        "asn as400519",
        "whois registrar",
        "ms defender",
        "files matching",
        "number",
        "sample analysis",
        "hide samples",
        "date hash",
        "cameras",
        "cams",
        "spycam",
        "botnet",
        "vietnam",
        "company limited",
        "dnssec",
        "status",
        "india unknown",
        "present may",
        "espionage",
        "hostname add",
        "generic",
        "cnc activity",
        "backdoor",
        "ipv4",
        "anonsecbotnet",
        "iptv"
      ],
      "references": [
        "drive.google.com/",
        "https://foundry2-lbl.dvr.dn2.n-helix.com/",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9",
        "zalo.me | href | Binary File | ATT&CK ID T1566.002",
        "https://account.helix.com/activate/start",
        "anonsecbotnet.cameraddns.net \u2022 cameraddns.net \u2022 http://iptv.cameraddns.net/cotich/ \u2022 http://iptv.cameraddns.net/cotichC \u2022",
        "https://iptv.cameraddns.net/kodi/zips/plugin.video.iptvjson]",
        "Terse Unencrypted Request for Google - Likely Connectivity Check",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/c7aa2b182b17cfb5efb3367e0bc7b36e7088ab43a8fb21a772a0f8f90b7329d9",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/d334c3220573f98da1a0eef13be9c8b0053447519b3a6ace3728bcffa10b99b6",
        "cpcalendars.hyundaibariavungtau3s.com \u2022 cpcontacts.hyundaibariavungtau3s.com",
        "https://hyundaibariavungtau3s.com/vehicle/stargazer",
        "https://hyundaibariavungtau3s.com/vehicle/ioniq-5",
        "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-venue",
        "https://hyundaibariavungtau3s.com/vehicle/new-hyundai-palisade",
        "https://hyundaibariavungtau3s.com/vehicle/hyundai-custin",
        "https://hyundaibariavungtau3s.com/wp-content/themes/flatsome/inc/extensions/flatsome-live-search/",
        "https://delivery-mp-microsoft.dvrx.dn3.n-helix.com \u2022 https://dnsplay.dn2.n-helix.com",
        "https://dnss2.dn2.n-helix.com \u2022 https://dnssounib.dn2.n-helix.com/",
        "https://foundry2-lbl.dvr.dn2.n-helix.com/ \u2022 https://node8-serve.dvrx.dn3.n-helix.com \u2022 https://sfbambi-tel.dn2.n-helix.com \u2022 https://softlayer3.dn2.n-helix.com",
        "http://bjdclub.ru/out.phtml?www.skyxxxgals.info/feet-licking-porn/",
        "http://www.yayabay.com/forum/adclick.php?url=http%3a%2f%2fhkprice.info%2fpornstars%2f22466",
        "https://asianleak.com/videos/8120/sg-cousin-showering-spy-cam",
        "feedback-pa.clients6.google.com/v1/survey/trigger/",
        "https://feedback-pa.clients6.google.com/v1/survey/trigger/trigger_anonymous?key=AIzaSyD3LJeW4Q6gtdgJlyeFZUp-GhpIoc6EUeg",
        "anonsecbotnet.cameraddns.net \u2022 http://anonsecbotnet.cameraddns.net \u2022 https://anonsecbotnet.cameraddns.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Virus.Virlock-6804475-0",
          "display_name": "Win.Virus.Virlock-6804475-0",
          "target": null
        },
        {
          "id": "Win.Malware.Bzub-6727003-0",
          "display_name": "Win.Malware.Bzub-6727003-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-9801687-0",
          "display_name": "Win.Trojan.Generic-9801687-0",
          "target": null
        },
        {
          "id": "NID",
          "display_name": "NID",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Floxif.E",
          "display_name": "Trojan:Win32/Floxif.E",
          "target": "/malware/Trojan:Win32/Floxif.E"
        },
        {
          "id": "Win.Dropper.njRAT-10015886-0",
          "display_name": "Win.Dropper.njRAT-10015886-0",
          "target": null
        },
        {
          "id": "Win.Packed.Generic-9795615-0",
          "display_name": "Win.Packed.Generic-9795615-0",
          "target": null
        },
        {
          "id": "Backdoor:MSIL/Bladabindi.AJ GC!",
          "display_name": "Backdoor:MSIL/Bladabindi.AJ GC!",
          "target": "/malware/Backdoor:MSIL/Bladabindi.AJ GC!"
        },
        {
          "id": "Win.Packed.Generic-9795615-0\t.",
          "display_name": "Win.Packed.Generic-9795615-0\t.",
          "target": null
        },
        {
          "id": "Backdoor:MSIL/Bladabindi.AJ",
          "display_name": "Backdoor:MSIL/Bladabindi.AJ",
          "target": "/malware/Backdoor:MSIL/Bladabindi.AJ"
        },
        {
          "id": "Win.Packed.Fecn-7077459-0",
          "display_name": "Win.Packed.Fecn-7077459-0",
          "target": null
        },
        {
          "id": "Trojan:MSIL/Ranos.A",
          "display_name": "Trojan:MSIL/Ranos.A",
          "target": "/malware/Trojan:MSIL/Ranos.A"
        },
        {
          "id": "Win.Trojan.Generic-6417450-0",
          "display_name": "Win.Trojan.Generic-6417450-0",
          "target": null
        },
        {
          "id": "ALF:Backdoor:MSIL/Noancooe.KA",
          "display_name": "ALF:Backdoor:MSIL/Noancooe.KA",
          "target": null
        },
        {
          "id": "Win.Packed.Msilperseus-9956592-0",
          "display_name": "Win.Packed.Msilperseus-9956592-0",
          "target": null
        },
        {
          "id": "Trojan:MSIL/ClipBanker",
          "display_name": "Trojan:MSIL/ClipBanker",
          "target": "/malware/Trojan:MSIL/ClipBanker"
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1194",
          "name": "Spearphishing via Service",
          "display_name": "T1194 - Spearphishing via Service"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1039",
          "name": "Data from Network Shared Drive",
          "display_name": "T1039 - Data from Network Shared Drive"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1567.002",
          "name": "Exfiltration to Cloud Storage",
          "display_name": "T1567.002 - Exfiltration to Cloud Storage"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1911,
        "hostname": 714,
        "FileHash-SHA256": 1304,
        "FileHash-MD5": 159,
        "FileHash-SHA1": 71,
        "SSLCertFingerprint": 2,
        "domain": 421,
        "CVE": 1,
        "email": 4
      },
      "indicator_count": 4587,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "109 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.mindlightg.info/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.mindlightg.info/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776608538.4714887
}