{
  "type": "URL",
  "indicator": "https://www.nextron-systems.com/get-started",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.nextron-systems.com/get-started",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4107289024,
      "indicator": "https://www.nextron-systems.com/get-started",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "694bbab7ff25b42cfad129a5",
          "name": "Open M781079_thor_2025-02-02_1454.pdf",
          "description": "Workstation - old - 02.02.25",
          "modified": "2026-01-23T09:01:25.535000",
          "created": "2025-12-24T10:04:39.383000",
          "tags": [
            "wed jun",
            "filename ioc",
            "notice",
            "size2",
            "exists2",
            "file2",
            "exists1",
            "sigtype1",
            "reasonscount",
            "log entry",
            "score",
            "info",
            "click",
            "february",
            "file size",
            "dos batch",
            "win32 exe",
            "vhash",
            "ssdeep",
            "ltd dba",
            "com laude",
            "ip detections",
            "country",
            "detections file",
            "AHS",
            "UAlberta",
            "Telus"
          ],
          "references": [
            "d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998",
            "https://www.filescan.io/uploads/694bb99de126b9ff438fb91a/reports/5472632a-af06-48fb-9f48-e369e2f7ef0a/ioc",
            "http://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998/694bb96deb907ac07c05e616",
            "https://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Healthcare",
            "Education",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 71,
            "FileHash-SHA1": 58,
            "FileHash-SHA256": 63,
            "URL": 51,
            "hostname": 29,
            "domain": 18
          },
          "indicator_count": 290,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 128,
          "modified_text": "86 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6946cb8e3eff732bd3d47bff",
          "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
          "description": "",
          "modified": "2025-12-20T16:15:10.914000",
          "created": "2025-12-20T16:15:10.914000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6887d46c19a44d6affd7bd2d",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "120 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d3caa9524bb6b5460615f3",
          "name": "Legacy.Trojan affects threat researchers networks & portals and/or  platforms",
          "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github",
          "modified": "2025-10-24T10:01:25.310000",
          "created": "2025-09-24T10:40:40.987000",
          "tags": [
            "text drag",
            "browse to",
            "select file",
            "or drop",
            "yara detections",
            "runlevel",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "inject",
            "stncphpphp more",
            "virustotal api",
            "comments",
            "related tags",
            "passive dns",
            "republic",
            "ipv4 add",
            "location korea",
            "korea",
            "asn as9318",
            "dns resolutions",
            "pulses otx",
            "close",
            "dynamicloader",
            "backdoor",
            "tgt session",
            "reads",
            "dynamic",
            "write",
            "chopper",
            "pho exploit",
            "backdoor",
            "fireeye",
            "low risk",
            "drop",
            "create snapshot",
            "hangover_appinbot",
            "kns dropper",
            "self",
            "md5 sha256",
            "google safe",
            "browsing",
            "server response",
            "response code",
            "vary",
            "mimikatz",
            "silence malware",
            "trojanagent",
            "legacy",
            "password",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "defense evasion",
            "spawns",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "selection",
            "ascii text",
            "crlf line",
            "windir",
            "openurl c",
            "appearance code",
            "password",
            "urlhttps",
            "username",
            "flag",
            "united",
            "markmonitor",
            "github",
            "server",
            "date",
            "click",
            "apt 1",
            "high",
            "read c",
            "search",
            "medium",
            "show",
            "windows",
            "cmd c",
            "ms windows",
            "next",
            "copy",
            "ver",
            "businesseconomy"
          ],
          "references": [
            "Files",
            "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
            "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
            "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
            "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
            "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
            "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
            "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ireland"
          ],
          "malware_families": [
            {
              "id": "Php.Exploit.C99-27",
              "display_name": "Php.Exploit.C99-27",
              "target": null
            },
            {
              "id": "Backdoor:ASP/Chopper.F!dha",
              "display_name": "Backdoor:ASP/Chopper.F!dha",
              "target": "/malware/Backdoor:ASP/Chopper.F!dha"
            },
            {
              "id": "Legacy.Trojan.Agent-37025",
              "display_name": "Legacy.Trojan.Agent-37025",
              "target": null
            },
            {
              "id": "Ver",
              "display_name": "Ver",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110.001",
              "name": "Password Guessing",
              "display_name": "T1110.001 - Password Guessing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 87,
            "FileHash-SHA1": 84,
            "FileHash-SHA256": 1049,
            "URL": 1688,
            "hostname": 544,
            "email": 5,
            "domain": 292,
            "CVE": 2
          },
          "indicator_count": 3751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "177 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6887d46c19a44d6affd7bd2d",
          "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
          "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
          "modified": "2025-08-28T16:04:17.368000",
          "created": "2025-07-28T19:50:04.469000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "234 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
        "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "Files",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "http://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998/694bb96deb907ac07c05e616",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7",
        "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/694bb99de126b9ff438fb91a/reports/5472632a-af06-48fb-9f48-e369e2f7ef0a/ioc",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
        "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "Bitch-On-Wheels_files_md5s.csv",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Legacy.trojan.agent-37025",
            "Backdoor:asp/chopper.f!dha",
            "Ver",
            "Php.exploit.c99-27"
          ],
          "industries": [
            "Telecommunications",
            "Education",
            "Government",
            "Healthcare",
            "Technology"
          ],
          "unique_indicators": 7677
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/nextron-systems.com",
    "whois": "http://whois.domaintools.com/nextron-systems.com",
    "domain": "nextron-systems.com",
    "hostname": "www.nextron-systems.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "694bbab7ff25b42cfad129a5",
      "name": "Open M781079_thor_2025-02-02_1454.pdf",
      "description": "Workstation - old - 02.02.25",
      "modified": "2026-01-23T09:01:25.535000",
      "created": "2025-12-24T10:04:39.383000",
      "tags": [
        "wed jun",
        "filename ioc",
        "notice",
        "size2",
        "exists2",
        "file2",
        "exists1",
        "sigtype1",
        "reasonscount",
        "log entry",
        "score",
        "info",
        "click",
        "february",
        "file size",
        "dos batch",
        "win32 exe",
        "vhash",
        "ssdeep",
        "ltd dba",
        "com laude",
        "ip detections",
        "country",
        "detections file",
        "AHS",
        "UAlberta",
        "Telus"
      ],
      "references": [
        "d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998",
        "https://www.filescan.io/uploads/694bb99de126b9ff438fb91a/reports/5472632a-af06-48fb-9f48-e369e2f7ef0a/ioc",
        "http://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998/694bb96deb907ac07c05e616",
        "https://hybrid-analysis.com/sample/d407626bbf2a4163e12f2785c4610c9debc832d834fc0f29be78d74c4b3ec998"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Healthcare",
        "Education",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 71,
        "FileHash-SHA1": 58,
        "FileHash-SHA256": 63,
        "URL": 51,
        "hostname": 29,
        "domain": 18
      },
      "indicator_count": 290,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 128,
      "modified_text": "86 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6946cb8e3eff732bd3d47bff",
      "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
      "description": "",
      "modified": "2025-12-20T16:15:10.914000",
      "created": "2025-12-20T16:15:10.914000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6887d46c19a44d6affd7bd2d",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "120 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d3caa9524bb6b5460615f3",
      "name": "Legacy.Trojan affects threat researchers networks & portals and/or  platforms",
      "description": "Legacy.Trojan affects threat researchers networks & portals and/or platforms or via platforms as a medium.\n[otx auto populated: Adversaries may be able to gain access to a victim's network through a range of techniques, as well as using a variety of other techniques to evade detection and detection.]\n#honeypot #capture #advesaries #fireeye #github",
      "modified": "2025-10-24T10:01:25.310000",
      "created": "2025-09-24T10:40:40.987000",
      "tags": [
        "text drag",
        "browse to",
        "select file",
        "or drop",
        "yara detections",
        "runlevel",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "inject",
        "stncphpphp more",
        "virustotal api",
        "comments",
        "related tags",
        "passive dns",
        "republic",
        "ipv4 add",
        "location korea",
        "korea",
        "asn as9318",
        "dns resolutions",
        "pulses otx",
        "close",
        "dynamicloader",
        "backdoor",
        "tgt session",
        "reads",
        "dynamic",
        "write",
        "chopper",
        "pho exploit",
        "backdoor",
        "fireeye",
        "low risk",
        "drop",
        "create snapshot",
        "hangover_appinbot",
        "kns dropper",
        "self",
        "md5 sha256",
        "google safe",
        "browsing",
        "server response",
        "response code",
        "vary",
        "mimikatz",
        "silence malware",
        "trojanagent",
        "legacy",
        "password",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "defense evasion",
        "spawns",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "selection",
        "ascii text",
        "crlf line",
        "windir",
        "openurl c",
        "appearance code",
        "password",
        "urlhttps",
        "username",
        "flag",
        "united",
        "markmonitor",
        "github",
        "server",
        "date",
        "click",
        "apt 1",
        "high",
        "read c",
        "search",
        "medium",
        "show",
        "windows",
        "cmd c",
        "ms windows",
        "next",
        "copy",
        "ver",
        "businesseconomy"
      ],
      "references": [
        "Files",
        "Yara : KINS_dropper ,  apt_win_mutex_apt1 ,  Hangover_Fuddol ,   Hangover_Tymtin_Degrab",
        "Yara:  Hangover_Smackdown_various ,  Hangover_Foler  ,  Hangover_UpdateEx ,",
        "Yara: Hangover_Smackdown_Downloader ,  Hangover_Vacrhan_Downloader",
        "Yara: HKTL_NATBypass_Dec22_1 ,  power_pe_injection ,  Mimikatz_Logfile",
        "Yara: Mimikatz_Strings ,  Silence_malware_2 ,  EquationGroup_elgingamble ,  EquationGroup_cmsd",
        "Yara: EquationGroup_ebbshave ,  EquationGroup_eggbasket ,  EquationGroup_sambal",
        "Yara: Mimikatz_Logfile SID : * NTLM : Authentication Id : wdigest : Mimikatz_Strings sekurlsa::logonpasswords"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ireland"
      ],
      "malware_families": [
        {
          "id": "Php.Exploit.C99-27",
          "display_name": "Php.Exploit.C99-27",
          "target": null
        },
        {
          "id": "Backdoor:ASP/Chopper.F!dha",
          "display_name": "Backdoor:ASP/Chopper.F!dha",
          "target": "/malware/Backdoor:ASP/Chopper.F!dha"
        },
        {
          "id": "Legacy.Trojan.Agent-37025",
          "display_name": "Legacy.Trojan.Agent-37025",
          "target": null
        },
        {
          "id": "Ver",
          "display_name": "Ver",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110.001",
          "name": "Password Guessing",
          "display_name": "T1110.001 - Password Guessing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 87,
        "FileHash-SHA1": 84,
        "FileHash-SHA256": 1049,
        "URL": 1688,
        "hostname": 544,
        "email": 5,
        "domain": 292,
        "CVE": 2
      },
      "indicator_count": 3751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "177 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6887d46c19a44d6affd7bd2d",
      "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
      "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
      "modified": "2025-08-28T16:04:17.368000",
      "created": "2025-07-28T19:50:04.469000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "234 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "type": "URL",
    "indicator": "https://www.nextron-systems.com/get-started",
    "stats": {
      "malicious": 0,
      "suspicious": 0,
      "harmless": 68,
      "undetected": 30,
      "total": 98,
      "verdict": "clean",
      "ratio": "0/98"
    },
    "verdict": "clean",
    "ratio": "0/98",
    "final_url": "https://www.nextron-systems.com/get-started/",
    "title": "Contact Us for More Information on Our Products and Services - Nextron Systems",
    "reputation": 0,
    "tags": [
      "external-resources",
      "iframes",
      "trackers"
    ],
    "top_detections": [],
    "last_analysis": 1766606784,
    "error": null
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.nextron-systems.com/get-started",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643362.3401675
}