{
  "type": "URL",
  "indicator": "https://www.ptsecurity.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.ptsecurity.com",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "majestic",
        "message": "Whitelisted domain ptsecurity.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4051125410,
      "indicator": "https://www.ptsecurity.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6946cb8e3eff732bd3d47bff",
          "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
          "description": "",
          "modified": "2025-12-20T16:15:10.914000",
          "created": "2025-12-20T16:15:10.914000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6887d46c19a44d6affd7bd2d",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "120 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6887d46c19a44d6affd7bd2d",
          "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
          "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
          "modified": "2025-08-28T16:04:17.368000",
          "created": "2025-07-28T19:50:04.469000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "234 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67c6bb5aa601e91b1314ff44",
          "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
          "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
          "modified": "2025-04-22T06:02:28.535000",
          "created": "2025-03-04T08:35:38.390000",
          "tags": [
            "misc",
            "filename ioc",
            "scanid",
            "sigtype1",
            "reasonscount",
            "sg2backup drive",
            "thu feb",
            "log entry",
            "exists1",
            "matched1",
            "warp",
            "trash",
            "rooter",
            "service",
            "puppet",
            "apache",
            "ruby",
            "execution",
            "android",
            "glasses",
            "agent",
            "hermes",
            "atlas",
            "score",
            "open",
            "orion",
            "entity",
            "download",
            "enterprise",
            "nexus",
            "beyond",
            "patch",
            "rest",
            "bsod",
            "bind",
            "june",
            "upgrade",
            "project",
            "surtr",
            "path",
            "mandrake",
            "accept",
            "openssl",
            "null",
            "responder",
            "shell",
            "servu",
            "cargo",
            "bypass",
            "green",
            "python",
            "iframe",
            "webex",
            "blink",
            "code",
            "netty",
            "fall",
            "grab",
            "metasploit",
            "webdav",
            "postscript",
            "middle",
            "assistant",
            "energy",
            "august",
            "diego",
            "february",
            "hold",
            "write",
            "extras",
            "fusion",
            "trace",
            "click",
            "rust",
            "anna",
            "virustotal",
            "rootkit",
            "timestomp",
            "doublepulsar",
            "logger",
            "teamviewer",
            "obfus",
            "probe",
            "win32",
            "snoopy",
            "vuln",
            "april",
            "format",
            "flash",
            "domino",
            "calendar",
            "cryptocat",
            "orca",
            "hello",
            "stream",
            "confi",
            "sharepoint",
            "launcher",
            "hypervisor",
            "malicious",
            "lame",
            "attack",
            "prior",
            "simple",
            "hpack",
            "homepage",
            "easy",
            "live",
            "cookie",
            "explorer",
            "config",
            "rush",
            "spark",
            "chat",
            "media",
            "webview",
            "trigger",
            "northstar",
            "monitoring",
            "false",
            "impact",
            "dino",
            "example",
            "splash",
            "macos",
            "notifier",
            "error",
            "spring",
            "this",
            "neutrino",
            "tools",
            "template",
            "crow",
            "magento",
            "zimbra",
            "drop",
            "stack",
            "linear",
            "blocker",
            "deleter",
            "main",
            "face",
            "arch",
            "hosts",
            "bifrost",
            "recursive",
            "cobaltstrike",
            "luckycat",
            "brain",
            "apt",
            "php",
            "rat",
            "hacktool",
            "worm",
            "meterpreter",
            "obfuscated",
            "evasive",
            "exaramel",
            "anti-vm"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
            "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
            "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
            "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
            "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
            "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
            "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1505",
              "name": "Server Software Component",
              "display_name": "T1505 - Server Software Component"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            }
          ],
          "industries": [
            "Education",
            "Healthcare",
            "Government",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 14071,
            "FileHash-MD5": 979,
            "FileHash-SHA1": 2568,
            "FileHash-SHA256": 636,
            "URL": 43905,
            "domain": 2031,
            "email": 31,
            "hostname": 3621
          },
          "indicator_count": 67842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "362 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Education",
            "Healthcare",
            "Telecommunications",
            "Government",
            "Technology"
          ],
          "unique_indicators": 24784
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ptsecurity.com",
    "whois": "http://whois.domaintools.com/ptsecurity.com",
    "domain": "ptsecurity.com",
    "hostname": "www.ptsecurity.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6946cb8e3eff732bd3d47bff",
      "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
      "description": "",
      "modified": "2025-12-20T16:15:10.914000",
      "created": "2025-12-20T16:15:10.914000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6887d46c19a44d6affd7bd2d",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "120 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6887d46c19a44d6affd7bd2d",
      "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
      "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
      "modified": "2025-08-28T16:04:17.368000",
      "created": "2025-07-28T19:50:04.469000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "234 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67c6bb5aa601e91b1314ff44",
      "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
      "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
      "modified": "2025-04-22T06:02:28.535000",
      "created": "2025-03-04T08:35:38.390000",
      "tags": [
        "misc",
        "filename ioc",
        "scanid",
        "sigtype1",
        "reasonscount",
        "sg2backup drive",
        "thu feb",
        "log entry",
        "exists1",
        "matched1",
        "warp",
        "trash",
        "rooter",
        "service",
        "puppet",
        "apache",
        "ruby",
        "execution",
        "android",
        "glasses",
        "agent",
        "hermes",
        "atlas",
        "score",
        "open",
        "orion",
        "entity",
        "download",
        "enterprise",
        "nexus",
        "beyond",
        "patch",
        "rest",
        "bsod",
        "bind",
        "june",
        "upgrade",
        "project",
        "surtr",
        "path",
        "mandrake",
        "accept",
        "openssl",
        "null",
        "responder",
        "shell",
        "servu",
        "cargo",
        "bypass",
        "green",
        "python",
        "iframe",
        "webex",
        "blink",
        "code",
        "netty",
        "fall",
        "grab",
        "metasploit",
        "webdav",
        "postscript",
        "middle",
        "assistant",
        "energy",
        "august",
        "diego",
        "february",
        "hold",
        "write",
        "extras",
        "fusion",
        "trace",
        "click",
        "rust",
        "anna",
        "virustotal",
        "rootkit",
        "timestomp",
        "doublepulsar",
        "logger",
        "teamviewer",
        "obfus",
        "probe",
        "win32",
        "snoopy",
        "vuln",
        "april",
        "format",
        "flash",
        "domino",
        "calendar",
        "cryptocat",
        "orca",
        "hello",
        "stream",
        "confi",
        "sharepoint",
        "launcher",
        "hypervisor",
        "malicious",
        "lame",
        "attack",
        "prior",
        "simple",
        "hpack",
        "homepage",
        "easy",
        "live",
        "cookie",
        "explorer",
        "config",
        "rush",
        "spark",
        "chat",
        "media",
        "webview",
        "trigger",
        "northstar",
        "monitoring",
        "false",
        "impact",
        "dino",
        "example",
        "splash",
        "macos",
        "notifier",
        "error",
        "spring",
        "this",
        "neutrino",
        "tools",
        "template",
        "crow",
        "magento",
        "zimbra",
        "drop",
        "stack",
        "linear",
        "blocker",
        "deleter",
        "main",
        "face",
        "arch",
        "hosts",
        "bifrost",
        "recursive",
        "cobaltstrike",
        "luckycat",
        "brain",
        "apt",
        "php",
        "rat",
        "hacktool",
        "worm",
        "meterpreter",
        "obfuscated",
        "evasive",
        "exaramel",
        "anti-vm"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1505",
          "name": "Server Software Component",
          "display_name": "T1505 - Server Software Component"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        }
      ],
      "industries": [
        "Education",
        "Healthcare",
        "Government",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 14071,
        "FileHash-MD5": 979,
        "FileHash-SHA1": 2568,
        "FileHash-SHA256": 636,
        "URL": 43905,
        "domain": 2031,
        "email": 31,
        "hostname": 3621
      },
      "indicator_count": 67842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "362 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.ptsecurity.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.ptsecurity.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776618279.3892317
}