{
  "type": "URL",
  "indicator": "https://www.reddit.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.reddit.com",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #20",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #284",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain reddit.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain reddit.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3808658257,
      "indicator": "https://www.reddit.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6946cb8e3eff732bd3d47bff",
          "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
          "description": "",
          "modified": "2025-12-20T16:15:10.914000",
          "created": "2025-12-20T16:15:10.914000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6887d46c19a44d6affd7bd2d",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "120 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6887d46c19a44d6affd7bd2d",
          "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
          "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
          "modified": "2025-08-28T16:04:17.368000",
          "created": "2025-07-28T19:50:04.469000",
          "tags": [
            "data",
            "upload",
            "sg2backup drive",
            "no problems",
            "problems1",
            "supportavast",
            "progressb",
            "files",
            "onedrivenoprobs",
            "sg2suss",
            "trash",
            "fall",
            "Covenant Health",
            "AHS",
            "Alberta Health Services",
            "Rogers",
            "UAlberta",
            "APT",
            "Edmonton",
            "Telus"
          ],
          "references": [
            "Bitch-On-Wheels_files_md5s.csv",
            "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
            "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
            "",
            "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://tria.ge/250729-s1vysaywgy",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
            "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
            "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
            "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
            "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
            "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
            "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
            "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
            "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
            "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 4790,
            "FileHash-SHA1": 3172,
            "FileHash-SHA256": 2764,
            "domain": 453,
            "URL": 2688,
            "CVE": 59,
            "email": 31,
            "hostname": 638
          },
          "indicator_count": 14595,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "234 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67c6bb5aa601e91b1314ff44",
          "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
          "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
          "modified": "2025-04-22T06:02:28.535000",
          "created": "2025-03-04T08:35:38.390000",
          "tags": [
            "misc",
            "filename ioc",
            "scanid",
            "sigtype1",
            "reasonscount",
            "sg2backup drive",
            "thu feb",
            "log entry",
            "exists1",
            "matched1",
            "warp",
            "trash",
            "rooter",
            "service",
            "puppet",
            "apache",
            "ruby",
            "execution",
            "android",
            "glasses",
            "agent",
            "hermes",
            "atlas",
            "score",
            "open",
            "orion",
            "entity",
            "download",
            "enterprise",
            "nexus",
            "beyond",
            "patch",
            "rest",
            "bsod",
            "bind",
            "june",
            "upgrade",
            "project",
            "surtr",
            "path",
            "mandrake",
            "accept",
            "openssl",
            "null",
            "responder",
            "shell",
            "servu",
            "cargo",
            "bypass",
            "green",
            "python",
            "iframe",
            "webex",
            "blink",
            "code",
            "netty",
            "fall",
            "grab",
            "metasploit",
            "webdav",
            "postscript",
            "middle",
            "assistant",
            "energy",
            "august",
            "diego",
            "february",
            "hold",
            "write",
            "extras",
            "fusion",
            "trace",
            "click",
            "rust",
            "anna",
            "virustotal",
            "rootkit",
            "timestomp",
            "doublepulsar",
            "logger",
            "teamviewer",
            "obfus",
            "probe",
            "win32",
            "snoopy",
            "vuln",
            "april",
            "format",
            "flash",
            "domino",
            "calendar",
            "cryptocat",
            "orca",
            "hello",
            "stream",
            "confi",
            "sharepoint",
            "launcher",
            "hypervisor",
            "malicious",
            "lame",
            "attack",
            "prior",
            "simple",
            "hpack",
            "homepage",
            "easy",
            "live",
            "cookie",
            "explorer",
            "config",
            "rush",
            "spark",
            "chat",
            "media",
            "webview",
            "trigger",
            "northstar",
            "monitoring",
            "false",
            "impact",
            "dino",
            "example",
            "splash",
            "macos",
            "notifier",
            "error",
            "spring",
            "this",
            "neutrino",
            "tools",
            "template",
            "crow",
            "magento",
            "zimbra",
            "drop",
            "stack",
            "linear",
            "blocker",
            "deleter",
            "main",
            "face",
            "arch",
            "hosts",
            "bifrost",
            "recursive",
            "cobaltstrike",
            "luckycat",
            "brain",
            "apt",
            "php",
            "rat",
            "hacktool",
            "worm",
            "meterpreter",
            "obfuscated",
            "evasive",
            "exaramel",
            "anti-vm"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
            "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
            "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
            "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
            "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
            "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
            "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1505",
              "name": "Server Software Component",
              "display_name": "T1505 - Server Software Component"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            }
          ],
          "industries": [
            "Education",
            "Healthcare",
            "Government",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 14071,
            "FileHash-MD5": 979,
            "FileHash-SHA1": 2568,
            "FileHash-SHA256": 636,
            "URL": 43905,
            "domain": 2031,
            "email": 31,
            "hostname": 3621
          },
          "indicator_count": 67842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "362 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658303b7e2b4417d9e24a7cc",
          "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
          "description": "",
          "modified": "2024-01-19T12:02:13.495000",
          "created": "2023-12-20T15:09:43.783000",
          "tags": [
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha1",
            "sha256",
            "runtime process",
            "date",
            "unknown",
            "error",
            "path",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "accept",
            "url http",
            "filehashmd5",
            "url https",
            "search otx",
            "octoseek report",
            "spam author",
            "reddit",
            "tulach c2",
            "created",
            "minutes ago",
            "added active",
            "related pulses",
            "am",
            "no expiration",
            "indicator role",
            "pulses url",
            "showing",
            "entries",
            "dded active",
            "copyright",
            "reserved",
            "cve cve20170199",
            "win32 exe",
            "android",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "headers",
            "manager",
            "files",
            "detections type",
            "name",
            "lord krishna",
            "right",
            "tjprojmain",
            "windows",
            "secure",
            "headers nel",
            "ssl certificate",
            "whois whois",
            "historical ssl",
            "referrer",
            "logistics",
            "cyber defense",
            "firm collection",
            "ioc honeypot",
            "list for",
            "malware",
            "open",
            "attack",
            "contacted",
            "dropped",
            "bundled",
            "problems",
            "whois record",
            "domains",
            "execution",
            "agent tesla",
            "azorult",
            "project",
            "startpage",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "magic pe32",
            "installer",
            "compiler",
            "nsis",
            "serial number",
            "g4 code",
            "signing rsa4096",
            "sha384",
            "root g4",
            "valid from",
            "algorithm",
            "thumbprint",
            "fast corporate",
            "from",
            "pe resource",
            "collection",
            "vt graph",
            "paulsmith",
            "apple tv",
            "apple music",
            "$RTD4NQU.exe",
            "no data",
            "tag count",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "iocs",
            "summary",
            "nisis",
            "executable",
            "ms windows",
            "trid win64",
            "generic",
            "sections",
            "sha256 file",
            "type type",
            "chi2",
            "dkey english",
            "xml rtmanifest",
            "english us",
            "overlay",
            "learn",
            "botnet",
            "honeypot",
            "ejkaej saBey k7-^Oa"
          ],
          "references": [
            "https://www.reddit.com/user/",
            "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
            "Gowi Live Bot.exe",
            "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
            "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
            "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
            "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
            "tv.apple.com [Apple Backdoor| Attack | Hacking]",
            "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
            "browser.events.data.msn.com | events-sandbox.data.msn.com",
            "https://tulach.cc/ [phishing attacks]",
            "tulach.cc [AM | phishing]",
            "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
            "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
            "3.163.189.120    [Tracking]",
            "86.140.232.148  [scanning_host]",
            "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
            "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
            "checkip.dyndns.org    [command_and_control]",
            "104.86.182.8          [command_and_control]",
            "103.224.182.253    [command_and_control]",
            "103.224.182.246    [command_and_control]",
            "www.supernetforme.com    [command_and_control]",
            "rp.downloadastrocdn.com   [command_and_control]",
            "ddos.dnsnb8.net   [command_and_control]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "AM",
              "display_name": "AM",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "adware.pcappstore/veryfast",
              "display_name": "adware.pcappstore/veryfast",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Static AI - Malicious PE",
              "display_name": "Static AI - Malicious PE",
              "target": null
            },
            {
              "id": "HoneyPot",
              "display_name": "HoneyPot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 392,
            "FileHash-SHA1": 374,
            "FileHash-SHA256": 5560,
            "URL": 7433,
            "domain": 1461,
            "hostname": 2463,
            "CVE": 3,
            "email": 1
          },
          "indicator_count": 17687,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "103.224.182.246    [command_and_control]",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://tria.ge/250729-s1vysaywgy",
        "3.163.189.120    [Tracking]",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "checkip.dyndns.org    [command_and_control]",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "86.140.232.148  [scanning_host]",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://www.reddit.com/user/",
        "tulach.cc [AM | phishing]",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "www.supernetforme.com    [command_and_control]",
        "103.224.182.253    [command_and_control]",
        "rp.downloadastrocdn.com   [command_and_control]",
        "Gowi Live Bot.exe",
        "https://tulach.cc/ [phishing attacks]",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "Bitch-On-Wheels_files_md5s.csv",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "ddos.dnsnb8.net   [command_and_control]",
        "104.86.182.8          [command_and_control]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Tulach malware",
            "Am",
            "Static ai - malicious pe",
            "Nsis",
            "Honeypot",
            "Malware",
            "Agent tesla",
            "Adware.pcappstore/veryfast"
          ],
          "industries": [
            "Education",
            "Telecommunications",
            "Government",
            "Technology",
            "Healthcare"
          ],
          "unique_indicators": 42876
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/reddit.com",
    "whois": "http://whois.domaintools.com/reddit.com",
    "domain": "reddit.com",
    "hostname": "www.reddit.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6946cb8e3eff732bd3d47bff",
      "name": "Thor Lite - 07.27.25 - APT Detections [by Disable_Duck]",
      "description": "",
      "modified": "2025-12-20T16:15:10.914000",
      "created": "2025-12-20T16:15:10.914000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6887d46c19a44d6affd7bd2d",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "120 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6887d46c19a44d6affd7bd2d",
      "name": "Thor Lite - 07.27.25 - APT Detections [un-enriched]",
      "description": "Thor Lite Scan on Windows PC (a psuedo mirror of sorts) of a University of Alberta, Alberta Health Services, Covenant Health, Government of Alberta Portable Workstation. Files uploaded to VT.\nUpdated Note: Included IOCs from Filescanio\nRan files through: Neiki, FileScanio, Polyswarm, Triage, Metadefender, Hybrid Analysis, Threatzone, Virustotal\nTPs = This Pulse - IOCs from references",
      "modified": "2025-08-28T16:04:17.368000",
      "created": "2025-07-28T19:50:04.469000",
      "tags": [
        "data",
        "upload",
        "sg2backup drive",
        "no problems",
        "problems1",
        "supportavast",
        "progressb",
        "files",
        "onedrivenoprobs",
        "sg2suss",
        "trash",
        "fall",
        "Covenant Health",
        "AHS",
        "Alberta Health Services",
        "Rogers",
        "UAlberta",
        "APT",
        "Edmonton",
        "Telus"
      ],
      "references": [
        "Bitch-On-Wheels_files_md5s.csv",
        "832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431",
        "f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106",
        "",
        "https://hybrid-analysis.com/sample/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://tria.ge/250729-s1vysaywgy",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3",
        "https://polyswarm.network/scan/results/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/a3528542-a121-4351-91fe-de5aab327fe2/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/3c22777d-9fa3-4d67-a00a-8aa505154874/overview",
        "https://metadefender.com/results/file/bzI1MDcyOV9QRkdmNWZwSkhvMG11YWczRVZMRw_mdaas",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/5fdda54a-0164-4d4e-a248-d07ec3780d8a/overview",
        "https://app.threat.zone/submission/ef60d9bd-bd97-4859-8e58-4f670d1f1783/overview",
        "https://www.filescan.io/uploads/6888ec9fa16348d835f2f6d3/reports/21f7ed2c-7815-49f0-8697-998b341df34a/overview",
        "https://tip.neiki.dev/file/9c8ee51b61019f9820cd151b3f3a5a9a0309787a46bd37fa877c5c95b633b5cb",
        "https://hybrid-analysis.com/sample/f66f2b730bec1c6927aa86503dfb22fc8d03a2f9e871ae6269d2a3ed29dc48e5",
        "https://hybrid-analysis.com/sample/902574c9ffd06678d769ae3db96b3957269c45617ad8e2feead4d02f5f3da106/6888ec5bd7a73585560d2ddd",
        "https://hybrid-analysis.com/sample/832dde85e22a6de8081cdb46fcc7d8f2ae104bbdae54c5dc75d2a6272a0bd431/6888ec5cfd974c2a5b0f1cfa",
        "https://hybrid-analysis.com/sample/12f05b32365a6fc40b30d108ea0dc730f662c6ee48c0feccf7cb43263a0a8166/6888ec5d423dabf7de0872d7"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 4790,
        "FileHash-SHA1": 3172,
        "FileHash-SHA256": 2764,
        "domain": 453,
        "URL": 2688,
        "CVE": 59,
        "email": 31,
        "hostname": 638
      },
      "indicator_count": 14595,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "234 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67c6bb5aa601e91b1314ff44",
      "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
      "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
      "modified": "2025-04-22T06:02:28.535000",
      "created": "2025-03-04T08:35:38.390000",
      "tags": [
        "misc",
        "filename ioc",
        "scanid",
        "sigtype1",
        "reasonscount",
        "sg2backup drive",
        "thu feb",
        "log entry",
        "exists1",
        "matched1",
        "warp",
        "trash",
        "rooter",
        "service",
        "puppet",
        "apache",
        "ruby",
        "execution",
        "android",
        "glasses",
        "agent",
        "hermes",
        "atlas",
        "score",
        "open",
        "orion",
        "entity",
        "download",
        "enterprise",
        "nexus",
        "beyond",
        "patch",
        "rest",
        "bsod",
        "bind",
        "june",
        "upgrade",
        "project",
        "surtr",
        "path",
        "mandrake",
        "accept",
        "openssl",
        "null",
        "responder",
        "shell",
        "servu",
        "cargo",
        "bypass",
        "green",
        "python",
        "iframe",
        "webex",
        "blink",
        "code",
        "netty",
        "fall",
        "grab",
        "metasploit",
        "webdav",
        "postscript",
        "middle",
        "assistant",
        "energy",
        "august",
        "diego",
        "february",
        "hold",
        "write",
        "extras",
        "fusion",
        "trace",
        "click",
        "rust",
        "anna",
        "virustotal",
        "rootkit",
        "timestomp",
        "doublepulsar",
        "logger",
        "teamviewer",
        "obfus",
        "probe",
        "win32",
        "snoopy",
        "vuln",
        "april",
        "format",
        "flash",
        "domino",
        "calendar",
        "cryptocat",
        "orca",
        "hello",
        "stream",
        "confi",
        "sharepoint",
        "launcher",
        "hypervisor",
        "malicious",
        "lame",
        "attack",
        "prior",
        "simple",
        "hpack",
        "homepage",
        "easy",
        "live",
        "cookie",
        "explorer",
        "config",
        "rush",
        "spark",
        "chat",
        "media",
        "webview",
        "trigger",
        "northstar",
        "monitoring",
        "false",
        "impact",
        "dino",
        "example",
        "splash",
        "macos",
        "notifier",
        "error",
        "spring",
        "this",
        "neutrino",
        "tools",
        "template",
        "crow",
        "magento",
        "zimbra",
        "drop",
        "stack",
        "linear",
        "blocker",
        "deleter",
        "main",
        "face",
        "arch",
        "hosts",
        "bifrost",
        "recursive",
        "cobaltstrike",
        "luckycat",
        "brain",
        "apt",
        "php",
        "rat",
        "hacktool",
        "worm",
        "meterpreter",
        "obfuscated",
        "evasive",
        "exaramel",
        "anti-vm"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1505",
          "name": "Server Software Component",
          "display_name": "T1505 - Server Software Component"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        }
      ],
      "industries": [
        "Education",
        "Healthcare",
        "Government",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 14071,
        "FileHash-MD5": 979,
        "FileHash-SHA1": 2568,
        "FileHash-SHA256": 636,
        "URL": 43905,
        "domain": 2031,
        "email": 31,
        "hostname": 3621
      },
      "indicator_count": 67842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "362 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658303b7e2b4417d9e24a7cc",
      "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
      "description": "",
      "modified": "2024-01-19T12:02:13.495000",
      "created": "2023-12-20T15:09:43.783000",
      "tags": [
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha1",
        "sha256",
        "runtime process",
        "date",
        "unknown",
        "error",
        "path",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "accept",
        "url http",
        "filehashmd5",
        "url https",
        "search otx",
        "octoseek report",
        "spam author",
        "reddit",
        "tulach c2",
        "created",
        "minutes ago",
        "added active",
        "related pulses",
        "am",
        "no expiration",
        "indicator role",
        "pulses url",
        "showing",
        "entries",
        "dded active",
        "copyright",
        "reserved",
        "cve cve20170199",
        "win32 exe",
        "android",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "headers",
        "manager",
        "files",
        "detections type",
        "name",
        "lord krishna",
        "right",
        "tjprojmain",
        "windows",
        "secure",
        "headers nel",
        "ssl certificate",
        "whois whois",
        "historical ssl",
        "referrer",
        "logistics",
        "cyber defense",
        "firm collection",
        "ioc honeypot",
        "list for",
        "malware",
        "open",
        "attack",
        "contacted",
        "dropped",
        "bundled",
        "problems",
        "whois record",
        "domains",
        "execution",
        "agent tesla",
        "azorult",
        "project",
        "startpage",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "magic pe32",
        "installer",
        "compiler",
        "nsis",
        "serial number",
        "g4 code",
        "signing rsa4096",
        "sha384",
        "root g4",
        "valid from",
        "algorithm",
        "thumbprint",
        "fast corporate",
        "from",
        "pe resource",
        "collection",
        "vt graph",
        "paulsmith",
        "apple tv",
        "apple music",
        "$RTD4NQU.exe",
        "no data",
        "tag count",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "iocs",
        "summary",
        "nisis",
        "executable",
        "ms windows",
        "trid win64",
        "generic",
        "sections",
        "sha256 file",
        "type type",
        "chi2",
        "dkey english",
        "xml rtmanifest",
        "english us",
        "overlay",
        "learn",
        "botnet",
        "honeypot",
        "ejkaej saBey k7-^Oa"
      ],
      "references": [
        "https://www.reddit.com/user/",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "Gowi Live Bot.exe",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "https://tulach.cc/ [phishing attacks]",
        "tulach.cc [AM | phishing]",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "3.163.189.120    [Tracking]",
        "86.140.232.148  [scanning_host]",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "checkip.dyndns.org    [command_and_control]",
        "104.86.182.8          [command_and_control]",
        "103.224.182.253    [command_and_control]",
        "103.224.182.246    [command_and_control]",
        "www.supernetforme.com    [command_and_control]",
        "rp.downloadastrocdn.com   [command_and_control]",
        "ddos.dnsnb8.net   [command_and_control]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "AM",
          "display_name": "AM",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "adware.pcappstore/veryfast",
          "display_name": "adware.pcappstore/veryfast",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Static AI - Malicious PE",
          "display_name": "Static AI - Malicious PE",
          "target": null
        },
        {
          "id": "HoneyPot",
          "display_name": "HoneyPot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 392,
        "FileHash-SHA1": 374,
        "FileHash-SHA256": 5560,
        "URL": 7433,
        "domain": 1461,
        "hostname": 2463,
        "CVE": 3,
        "email": 1
      },
      "indicator_count": 17687,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.reddit.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.reddit.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630034.7406507
}