{ "type": "URL", "indicator": "https://www.qualys.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.qualys.com/", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #3944", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain qualys.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain qualys.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4107289194, "indicator": "https://www.qualys.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "6946cb8e3eff732bd3d47bff", "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]", "description": "", "modified": "2025-12-20T16:15:10.914000", "created": "2025-12-20T16:15:10.914000", "tags": [ "data", "upload", "sg2backup drive", "no problems", "problems1", "supportavast", "progressb", "files", "onedrivenoprobs", "sg2suss", "trash", "fall", "Covenant Health", "AHS", "Alberta Health Services", "Rogers", "UAlberta", "APT", "Edmonton", "Telus" ], "references": [ "Bitch-On-Wheels_files_md5s.csv", "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431", "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106", "", "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://tria.ge/250729-s1vysaywgy", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3", "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview", "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview", "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview", "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd", "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa", "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Education", "Healthcare", "Government" ], "TLP": "white", "cloned_from": "6887d46c19a44d6affd7bd2d", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4790, "FileHash-SHA1": 3172, "FileHash-SHA256": 2764, "domain": 453, "URL": 2688, "CVE": 59, "email": 31, "hostname": 638 }, "indicator_count": 14595, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "120 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6889153bb756c703bd61c97d", "name": "Calisto - APT - 07.29.25 - UA ChromeBook Retro", "description": "Maldoc Calisto - 03.17.23\nRetroanalysis of a simple test to demonstrate a point (had some extensions to capture data). Borrowed a Google Chromebook From University of Alberta & signed in to my CCID on Campus with the Chromebook provided by Office of DOS (provided to them by 'offside IT'. Chromebook did not do so well. Returned. \n\nMAL_PDF_Calisto_PDF_Streams_Jul_09 (Threatzone)\nThis supports findings from Beehive Security who later blocked Calisto/Callisto with their MDR Solution.", "modified": "2025-09-03T00:22:10.750000", "created": "2025-07-29T18:38:51.647000", "tags": [ "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "download submit", "sha512", "sha1", "filesize", "sha256", "file", "token", "prefetch8", "prefetch1", "dataprofile", "general", "config", "download", "copy", "target", "defense", "generic", "impact", "virus", "trojan", "ransomware", "static", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "platform", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "switch", "inquest labs", "resources api", "notes supported", "cve list", "drop your", "service", "privacy policy", "found url", "ck id", "details found", "ingress tool", "transfer", "t1105", "details url", "t1571", "pdf found", "found", "contentparse", "externalparser", "woff2", "inputfile", "domainresolve", "u200c200d", "u25cc", "ioc value", "Callisto", "Maldoc", "UAlberta", "U of A", "Chromebook", "Microsoft", "Google", "Telus", "Calisto", "APT" ], "references": [ "https://tria.ge/250729-wr59yabk7y/behavioral2", "https://www.filescan.io/uploads/68890e2dc79df08ef097cd38/reports/06923db6-30ae-455f-8026-73461cc1472e/overview", "https://hybrid-analysis.com/sample/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://metadefender.com/results/file/YTI1MDcyOXl4LTdxa1I5ZlVJNGVsWTRUS2kz_mdaas", "https://polyswarm.network/scan/results/file/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce", "https://app.threat.zone/submission/5879c4fe-ce35-45c3-8a3c-e8c06d0e2b2d/overview", "https://tip.neiki.dev/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://www.virustotal.com/gui/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://www.virustotal.com/gui/file-analysis/MTllN2NiNTVkMGQ1MTYzNGY0OTg4MGY2MmRiYmNjYzg6MTc1MzgxNDIzNQ==", "https://vtbehaviour.commondatastorage.googleapis.com/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1753815427&Signature=BM1MWONwwKd011yMi5XzJJHo01QYs0qWdERlFPM9BGS4OW62YRzI4FX6aMwA6MgQB2eLDnMBjwIYw2ct1yC2HAzJ82eh6VqtBu%2BiE6lObCQjjON9nx29EKx9dGSRLewI3Zjpp7Kbokc%2FIKEh40ZNmeXNc4aCsECY%2Fwq9FQOmT2vm8Bi6IHzZNBMT3srLRZsr%2Bo36MP6ckdybeglLLnb9LA5iEOYbMBMEq6HxMj%2BfLIssDjKInHz7", "https://hybrid-analysis.com/sample/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce/6889105954703efa4303f7c7", "https://malpedia.caad.fkie.fraunhofer.de/actor/callisto" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Netherlands" ], "malware_families": [ { "id": "MAL_PDF_Calisto_PDF_Streams_Jul_09", "display_name": "MAL_PDF_Calisto_PDF_Streams_Jul_09", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1217", "name": "Browser Bookmark Discovery", "display_name": "T1217 - Browser Bookmark Discovery" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [ "Education", "Technology", "Healthcare", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6319, "CIDR": 11, "CVE": 9, "FileHash-MD5": 323, "FileHash-SHA1": 260, "FileHash-SHA256": 292, "domain": 596, "email": 37, "hostname": 806 }, "indicator_count": 8653, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "228 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6887d46c19a44d6affd7bd2d", "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]", "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references", "modified": "2025-08-28T16:04:17.368000", "created": "2025-07-28T19:50:04.469000", "tags": [ "data", "upload", "sg2backup drive", "no problems", "problems1", "supportavast", "progressb", "files", "onedrivenoprobs", "sg2suss", "trash", "fall", "Covenant Health", "AHS", "Alberta Health Services", "Rogers", "UAlberta", "APT", "Edmonton", "Telus" ], "references": [ "Bitch-On-Wheels_files_md5s.csv", "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431", "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106", "", "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://tria.ge/250729-s1vysaywgy", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3", "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview", "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview", "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview", "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd", "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa", "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Education", "Healthcare", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4790, "FileHash-SHA1": 3172, "FileHash-SHA256": 2764, "domain": 453, "URL": 2688, "CVE": 59, "email": 31, "hostname": 638 }, "indicator_count": 14595, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "234 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "", "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7", "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431", "https://hybrid-analysis.com/sample/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce/6889105954703efa4303f7c7", "https://malpedia.caad.fkie.fraunhofer.de/actor/callisto", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview", "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106", "https://tip.neiki.dev/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa", "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas", "https://tria.ge/250729-s1vysaywgy", "https://www.filescan.io/uploads/68890e2dc79df08ef097cd38/reports/06923db6-30ae-455f-8026-73461cc1472e/overview", "https://tria.ge/250729-wr59yabk7y/behavioral2", "https://polyswarm.network/scan/results/file/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce", "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview", "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview", "https://metadefender.com/results/file/YTI1MDcyOXl4LTdxa1I5ZlVJNGVsWTRUS2kz_mdaas", "https://app.threat.zone/submission/5879c4fe-ce35-45c3-8a3c-e8c06d0e2b2d/overview", "https://hybrid-analysis.com/sample/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "Bitch-On-Wheels_files_md5s.csv", "https://www.virustotal.com/gui/file-analysis/MTllN2NiNTVkMGQ1MTYzNGY0OTg4MGY2MmRiYmNjYzg6MTc1MzgxNDIzNQ==", "https://vtbehaviour.commondatastorage.googleapis.com/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1753815427&Signature=BM1MWONwwKd011yMi5XzJJHo01QYs0qWdERlFPM9BGS4OW62YRzI4FX6aMwA6MgQB2eLDnMBjwIYw2ct1yC2HAzJ82eh6VqtBu%2BiE6lObCQjjON9nx29EKx9dGSRLewI3Zjpp7Kbokc%2FIKEh40ZNmeXNc4aCsECY%2Fwq9FQOmT2vm8Bi6IHzZNBMT3srLRZsr%2Bo36MP6ckdybeglLLnb9LA5iEOYbMBMEq6HxMj%2BfLIssDjKInHz7", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview", "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd", "https://www.virustotal.com/gui/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Mal_pdf_calisto_pdf_streams_jul_09" ], "industries": [ "Telecommunications", "Education", "Government", "Healthcare", "Technology" ], "unique_indicators": 5622 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/qualys.com", "whois": "http://whois.domaintools.com/qualys.com", "domain": "qualys.com", "hostname": "www.qualys.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "6946cb8e3eff732bd3d47bff", "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]", "description": "", "modified": "2025-12-20T16:15:10.914000", "created": "2025-12-20T16:15:10.914000", "tags": [ "data", "upload", "sg2backup drive", "no problems", "problems1", "supportavast", "progressb", "files", "onedrivenoprobs", "sg2suss", "trash", "fall", "Covenant Health", "AHS", "Alberta Health Services", "Rogers", "UAlberta", "APT", "Edmonton", "Telus" ], "references": [ "Bitch-On-Wheels_files_md5s.csv", "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431", "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106", "", "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://tria.ge/250729-s1vysaywgy", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3", "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview", "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview", "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview", "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd", "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa", "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Education", "Healthcare", "Government" ], "TLP": "white", "cloned_from": "6887d46c19a44d6affd7bd2d", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4790, "FileHash-SHA1": 3172, "FileHash-SHA256": 2764, "domain": 453, "URL": 2688, "CVE": 59, "email": 31, "hostname": 638 }, "indicator_count": 14595, "is_author": false, "is_subscribing": null, "subscriber_count": 139, "modified_text": "120 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6889153bb756c703bd61c97d", "name": "Calisto - APT - 07.29.25 - UA ChromeBook Retro", "description": "Maldoc Calisto - 03.17.23\nRetroanalysis of a simple test to demonstrate a point (had some extensions to capture data). Borrowed a Google Chromebook From University of Alberta & signed in to my CCID on Campus with the Chromebook provided by Office of DOS (provided to them by 'offside IT'. Chromebook did not do so well. Returned. \n\nMAL_PDF_Calisto_PDF_Streams_Jul_09 (Threatzone)\nThis supports findings from Beehive Security who later blocked Calisto/Callisto with their MDR Solution.", "modified": "2025-09-03T00:22:10.750000", "created": "2025-07-29T18:38:51.647000", "tags": [ "triage", "malware", "analysis", "report", "reported", "analyze", "sandbox", "download submit", "sha512", "sha1", "filesize", "sha256", "file", "token", "prefetch8", "prefetch1", "dataprofile", "general", "config", "download", "copy", "target", "defense", "generic", "impact", "virus", "trojan", "ransomware", "static", "indicator of compromise", "ioc", "extraction", "emulation", "online", "submit", "sample", "platform", "vxstream", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "switch", "inquest labs", "resources api", "notes supported", "cve list", "drop your", "service", "privacy policy", "found url", "ck id", "details found", "ingress tool", "transfer", "t1105", "details url", "t1571", "pdf found", "found", "contentparse", "externalparser", "woff2", "inputfile", "domainresolve", "u200c200d", "u25cc", "ioc value", "Callisto", "Maldoc", "UAlberta", "U of A", "Chromebook", "Microsoft", "Google", "Telus", "Calisto", "APT" ], "references": [ "https://tria.ge/250729-wr59yabk7y/behavioral2", "https://www.filescan.io/uploads/68890e2dc79df08ef097cd38/reports/06923db6-30ae-455f-8026-73461cc1472e/overview", "https://hybrid-analysis.com/sample/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://metadefender.com/results/file/YTI1MDcyOXl4LTdxa1I5ZlVJNGVsWTRUS2kz_mdaas", "https://polyswarm.network/scan/results/file/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce", "https://app.threat.zone/submission/5879c4fe-ce35-45c3-8a3c-e8c06d0e2b2d/overview", "https://tip.neiki.dev/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://www.virustotal.com/gui/file/2d0458cbda9297baf3d2f28bfa47a4872075a444ec68f30757ceec458f3aab2e", "https://www.virustotal.com/gui/file-analysis/MTllN2NiNTVkMGQ1MTYzNGY0OTg4MGY2MmRiYmNjYzg6MTc1MzgxNDIzNQ==", "https://vtbehaviour.commondatastorage.googleapis.com/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1753815427&Signature=BM1MWONwwKd011yMi5XzJJHo01QYs0qWdERlFPM9BGS4OW62YRzI4FX6aMwA6MgQB2eLDnMBjwIYw2ct1yC2HAzJ82eh6VqtBu%2BiE6lObCQjjON9nx29EKx9dGSRLewI3Zjpp7Kbokc%2FIKEh40ZNmeXNc4aCsECY%2Fwq9FQOmT2vm8Bi6IHzZNBMT3srLRZsr%2Bo36MP6ckdybeglLLnb9LA5iEOYbMBMEq6HxMj%2BfLIssDjKInHz7", "https://hybrid-analysis.com/sample/4c7d629d37665e74617cefe3e208a37b2042529cbbeb9a839a79e167919561ce/6889105954703efa4303f7c7", "https://malpedia.caad.fkie.fraunhofer.de/actor/callisto" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada", "Netherlands" ], "malware_families": [ { "id": "MAL_PDF_Calisto_PDF_Streams_Jul_09", "display_name": "MAL_PDF_Calisto_PDF_Streams_Jul_09", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1217", "name": "Browser Bookmark Discovery", "display_name": "T1217 - Browser Bookmark Discovery" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" } ], "industries": [ "Education", "Technology", "Healthcare", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6319, "CIDR": 11, "CVE": 9, "FileHash-MD5": 323, "FileHash-SHA1": 260, "FileHash-SHA256": 292, "domain": 596, "email": 37, "hostname": 806 }, "indicator_count": 8653, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "228 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6887d46c19a44d6affd7bd2d", "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]", "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references", "modified": "2025-08-28T16:04:17.368000", "created": "2025-07-28T19:50:04.469000", "tags": [ "data", "upload", "sg2backup drive", "no problems", "problems1", "supportavast", "progressb", "files", "onedrivenoprobs", "sg2suss", "trash", "fall", "Covenant Health", "AHS", "Alberta Health Services", "Rogers", "UAlberta", "APT", "Edmonton", "Telus" ], "references": [ "Bitch-On-Wheels_files_md5s.csv", "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431", "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106", "", "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://tria.ge/250729-s1vysaywgy", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3", "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview", "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview", "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview", "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview", "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb", "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5", "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd", "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa", "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Technology", "Telecommunications", "Education", "Healthcare", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 4790, "FileHash-SHA1": 3172, "FileHash-SHA256": 2764, "domain": 453, "URL": 2688, "CVE": 59, "email": 31, "hostname": 638 }, "indicator_count": 14595, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "234 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.qualys.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.qualys.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776618515.675832 }