{ "type": "URL", "indicator": "https://www.tonex.com/train", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.tonex.com/train", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4372053435, "indicator": "https://www.tonex.com/train", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6a0ff878b8d1717e395e0d0a", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-23T03:58:21.402000", "created": "2026-05-22T06:32:24.666000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 194, "FileHash-SHA1": 212, "FileHash-SHA256": 412, "IPv4": 297, "URL": 840, "domain": 343, "hostname": 541, "CIDR": 6, "email": 23, "IPv6": 176, "CVE": 4 }, "indicator_count": 3048, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff829e77845255960bf9b", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:31:05.326000", "created": "2026-05-22T06:31:05.326000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff81386cb24a2c2aed36e", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:43.975000", "created": "2026-05-22T06:30:43.975000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff80e77e46edda3f73cbf", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:38.852000", "created": "2026-05-22T06:30:38.852000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff80cd75eee6656143b60", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:36.500000", "created": "2026-05-22T06:30:36.500000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0fec7257bc32c037c9be08", "name": "research part 3 * CAPE Sandbox", "description": "NET\nIssuer\nMicrosoft Code Signing PCA 2011\nValid From\n2023-05-11 19:03:32\nValid To\n2024-05-08 19:03:32\nValid Usage\n0.4.1.311.76.8, Code Signing\nAlgorithm\nsha384RSA\nThumbprint\n50A04FFE627F8E21FD61AF1B73E5D03B4ADB100D\nThumbprint MD5\n97762F82B14E28F4E97F0A97D81F280B\nThumbprint SHA256\nC5C2879E3551DA2FA5B8B2576FB7567F2BBEF79DDA388C45D137B0EE62F8F62C\nSerial Number\n33 00 00 03 7C C9 F6 BC ED 07 59 AE 08 00 00 00 00 03 7C", "modified": "2026-05-22T06:18:07.234000", "created": "2026-05-22T05:41:06.053000", "tags": [ "string id", "x5173x95ed", "control", "wixbundlename", "x53d6x6d88", "copyright", "width", "height", "helptext", "repair", "detail info", "tickcount", "filename", "behaviour", "imagepath", "cmdline", "offset", "targetprocess", "writeaddress", "size", "write", "shell", "open", "pe32", "ms windows", "microsoft input", "method editor", "ms visual", "win32 dynamic", "link library", "pe64 compiler", "ltcgc", "linker", "windows sandbox", "clear filters", "algorithm", "key identifier", "x509v3 subject", "full name", "v3 serial", "number", "cus odigicert", "inc cndigicert", "sha2 secure", "server ca", "performs dns", "pe file", "sample", "sigma", "instance", "spawns", "aslr", "urls", "t1055 process", "attack network", "phishing", "info", "next", "status code", "body length", "kb body", "default", "parent pid", "full path", "command line", "inprocserver32", "data", "datacrashpad", "k localservice", "s ngcsvc", "s ngcctnrsvc", "cname", "strong", "library", "accept", "address virtual", "file type", "shutdown", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "virtual address", "guard", "back", "studio build", "tools", "linkid2179911", "visual c", "visual studio", "ccli", "studio", "studio ide", "msbuild", "dev17", "false", "ascii text", "https", "svg scalable", "vector graphics", "elite", "tls version", "unicode text", "persistence", "malicious", "ip address", "mb body", "windows", "reads", "network info", "processes extra", "intel", "delphi", "code", "microsoft code", "signing pca", "valid from", "valid usage", "code signing", "thumbprint", "thumbprint md5", "c9 f6", "bc ed", "service issuer", "usage ff", "authority", "sha256", "serial number", "none rticon", "tofsee", "stream", "mitre attack", "chrome cache", "entry", "web open", "font format", "truetype", "version", "t1574", "execution flow", "found", "drops pe", "window", "Avalon", "dmca https", "versionnt", "and not", "versionnt64", "and versionnt64", "majorupgrade", "service pack", "redistributable", "detect", "windows81x86", "script", "cohassethingham", "title", "rent", "pendo", "userinfo", "doctype html", "head", "optanonwrapper", "date", "meta", "strings", "null", "layer protocol", "overview", "overview zenbox", "verdict" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425168&Signature=g5GBSyA0yAUEvdoIOge%2BpfDJHbEytZxyvD3%2FuIcPelmvG2YCD8XkTO52d2p6QEigdTHcudK90Dn1hnWcxTw6zW0f0taTQ152R0ivuwKsnjkdiGmEzEda3oomEw1S48VFEpo1FuPOBhJtSmOjTuz9nVjcf3CdYabNfv8w000uClW3ho3WHUKSKqaM5pz0Z6Xu2n5VBrPgbxrhGhcNzUYi9LdeW6OcRYQBHN5EqStdWH%2FvxKQ%2FaFWjFd", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425246&Signature=fNaUBAJEmKllb5%2BKYH8bOQO1PzuFIiqEarnmkfx0gTO3Zcux7EpGxLoFPLchiYgrfzVfRPXLYR87MrSmbNYjWg1htJNnnaFqRSG4aNch9NFulAeCq1Z%2Fs3nHKMh2SoYATCaXKkGC1KMoX4mFFftGFebHxq1M2D6aTdpIXnzI3HywXD8RMRRqM%2BJ%2BHAiuK%2B6FibY2SRG6%2B9sr7guEPsUOTIwiBxKX9Gbagoh14UqeIlUtMED61D", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425341&Signature=aiKp8TxOFSCG510XO0p8MMtzOWTr180htkSKvZu7%2B%2B7TV3TUxMnUm8O4WkkPJsIy0hXEHz3SRFf%2BNX2NpE5T7Akl4MMr9SaooFFtTImZIFRBXxMzzBkd6u4aNRTmAryhVrbtk4kTjCi0E3OpH3F3u5QIMQ33o2Puktbg4XX61XQWt4YaLOFUYMamfulIpUzpOHeVs%2Fkth06S%2FWrPDLvcNkaYRX3DPH8f4gl%2F9TOPklWx", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425469&Signature=gf1ylsIZ1FiwQfafpFPWlt2AP1PARebq7RGsb2lQJjPNRddkHG%2BNaDO44Op2YPyEC3JC9zlMUS25qA16XdMFGyeWpb8VMUpENtMxuen3x7q3DqkJoaCjH9ZGAt9Aak00PlI4MJbauwW4QCaTMqZcv%2Bs5scZuf29QSN0dJR4znOWHr48ryot1YP5O8TwsVbpaQxFRNkUt1AyiuPjaPUNxIlcuMMDVePvGwkqamMmQVCxksE1tXMgTA4chz2ehGL1BZi", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425908&Signature=PF22eOYOsUk8SONoBlJI8S81qygM4SRaTxPjXl%2BCjQ72N47ponTTU3Ysuv4BzsixckMJSY4E2jO2BgC0FVvrrCqEk%2FTr%2BOqDIJ5VkLruDQg58W3Z4gY8TGtXjbcIyp5hIZfbbCwRf4q%2BbzA9FxSTDXd9GvVO9T%2FMLfy8fTEPq1x%2BxKuOXDo0wQmtYWTB7ljw7tWexq4FlRTU%2B7iu1JYO%2FMlylQPvdMDAy9so15FLIiqxR8", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425966&Signature=smUTi069ww4c03xNnWiAdPUZUaGaxehukFdqKEVMCUD%2BbA%2BMmuQJo%2B3TBJ8g3pT884gYvzxRo88GpCPJTMoT54SwAzTcUD6vNx8IJxw2khWcNWb1lVYvE%2FoCguT0IJYm7wiTEjWDpeLz5amfhrPftnPjBIP1ITo9VIOc%2FK%2F%2F5EQMFcv%2FyNZhKMHzvda0LGCp6BHK0n03SMwluqFYlaGrkcE2y0buTDk2fFmt8YwN%2Bp6%", "https://vtbehaviour.commondatastorage.googleapis.com/e1473cc8cff4b1be7da44681ffa0371e603c6202e97b31b204b88e0b4cd16f6e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426024&Signature=Mn%2BWGa6Bwgj%2B7Wvu84ha8YpIKBeSUTbuDj5UoPu6SjBglPGllKI8zGujdrSeUWSakmCrXC6ynTHKW%2FCe0Mtbri1ObLWlzLI2MOBUa1yvFAedeuv%2F64ht%2BZjOHazy%2FNRoLbLO2wNd5WqlfQ3rNN%2BS%2FKqw3NxoYEZmZZhAR4NHgiElwdY%2BIT6lKyUMlku3DlyVKntVZPwyrzmP3YZUPyHbpMTZxXMmtYB8eG%2FQaUfDA3", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426074&Signature=qsu4LRTHFbUwe%2BwGeH1wThGz%2Fef3HYKxkFl1vMVQNvSHHHWd5C6FYUJ%2FBAGx%2BPx5JPbhWS2o9hfGQ4PWjcZ%2BEqleuPjTEfvCl96m9na%2BKTfO%2B15rn0TppIYdJJ5htoNwO2lJ%2FvSyMqLFt4Ql5RobZ9%2Bwtn7dUblGvh54wFvGpuu1oDoPvM4FYh6srDJwWsDLVi9u30Uk5nk5vqIHQH9XClZDjz13oBECBSZskns55zdY", "https://vtbehaviour.commondatastorage.googleapis.com/e0ac3780a1152800adc9fb31b5fd9d849b8f8defc014657b9b2e998ff72c2bb4_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426262&Signature=avYnViHhTCOzYcoQ9ZoWQXm888gYkFImwUY0aRhd7oc1noQzp0745QvRAtZCzRHg%2BVUbbKfpoRjOdPiXYw9FjrUllbNInvvGXIqN7Vtt6LC%2BxdGOhf7dLa6Uz%2B4LKhHlMM9d8xQ8jjMB48wG8FndhOesYOX2tjxz91IrsOQV%2Fu3rAp8bXq4TWxnLb2IfPWr4pG0y4o57hz%2F8dV%2B%2Fu7EoTWk5RmbMKFLNREVh3JRX1DofdLJi", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426428&Signature=ZMUnHqhcQ0e3Y7e7YGilNtksz7XM2Vy8N0nLj%2Fq7zprOG9An%2FoSgolS4cNDYtYSr9l3zZBGHdB43Oc9M4nz2aeg5WDyzle7o3jBBwQWsXIuS7HrXDH3wJPpINzb%2FlcYkpv8GJyWjJSUPZJPOV7bj32rGnh3ZOr%2BwqEA%2BOx78h9d66QzN%2FaVtc6Mg6%2F673L1JfHuXBAOSrc5TXgSNfTd0jYXHEuus8QfD3ocALihLDkkwz4tTjvcb4y6f", "https://vtbehaviour.commondatastorage.googleapis.com/5e5f874a1eedb61097a11ae64bd9c49b5f31af66e85930a66e7373e0f0484034_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426881&Signature=1FEszGc%2F5G396F8wJFd3wgCtHXg3oxedxnO7D7aWCkWs6d4k4i2%2Bp%2FehCdoJHrRy%2BJ7T4NZNupkx%2FLaxFRAwo%2BfTRBiFEwifjfN7zL2zunSZf%2FfWtXiVPftdFJynEYsHNiLxKclxy1ARhFeet3pCpGDAv70BgmRez08V1p4Qi8IG9RdOdvM6eiVmQ9AUp8LIwuJVMAQHFkKTOgCT2y01MhOpqVjtDSEIvVHBH2kInDwo7juUKj7hmudu", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427393&Signature=Y1SIIdbfZ13laS6E1kUpDYc3bEcZnQ7kw%2Fr%2FySc758jCzvRyB08531PJ9iIMMOMiupAUPfD3E1JfLbApE2HLnQ4ijkDHqFUPUrV4NrHU9QGGgJoj%2BJWZRNL2LFzbZoktG317lOAXVsRcZiqK9ps%2Bi%2B9q8K%2BDDNRE0Widdz0r9jJ8yUeyykgyWeZy3ljccHWcdlokMiJ4bRN6RQpwollIZ1IJBCRNewd%2FPKBJwI%2FEoFf%2B", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427457&Signature=qOgcBOyqA4YSh6lf9Vqs0UkKhwe0uotFK%2FBY4A2zWmCw%2FHzm2zZPrXINH1IFwPYSCmtm%2Fp15%2F9Qo%2FqhjC7vIq5yHz0oQjOU9Q41Oym%2F3Uea1SLp8gDBbnHKGJM1BYk88nOQOAzSporsAI6HsjZe6s7l%2B%2Buz2eFXF%2Bwkbj%2FwSSEb%2BAntmQo7dsjK90hkww2aZA9K4zdSsnT62hSdsoWJ5Xp4NS9Rv9hechWc8xqNk", "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427538&Signature=o6aSYMUzoDKb3m0W3lZulI%2Bc%2BcvifozmlN72ZSSxcWMU3DjzK%2FH515TFuFdkccTfkm8PO%2FlxgBrpamg%2B5bAcBaYvVJ3lga385BWvoGzETcXayv%2FRl2EffIIOhDUa9yPodQ13tYE1C8gE34LQPdK02WTjxunaKFa6nQmtd4h2qgf7IRve6UEZGMbiDkUlu9muuvpS6Aw1TQ8d%2BltZZJ9mPp5lmoTbra5oKX8mvHQmfzKhBFUYfckzn6Qg", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427641&Signature=WFnkeBZrEnGt9bxaBIROfEvcDg7woGYh2z9eElPx22u7UrFNBNzuaClc6Zl5jeius8pWGrlc7WTma3KN7lY%2BtUaCClyPnnoe%2FvUr7AZI6%2Bxp6mNDoTeMsn9xu7Qw9UtFwiOXagOocenXZ1jF2RgbnGvUyQHHfkymVZIYy9QGNX6kKek3Vfpx%2FtZbK5eMyv9smQ4%2BMIb6MKyloiWF%2BPe8TsKv00dULjDyhC7QyyJEy5heiyWfU9LnviZTFL", "https://vtbehaviour.commondatastorage.googleapis.com/dfc3a78d8aa1b8c02a6f66ef9d96192b569e9af8d43291940eee5e0d11925e83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427738&Signature=gFp6kB0oxeyNHL6GzyKaaCGqK8SMwnZKibR150oaqlNN6FVzXLLL1xM5%2BOssqN1VObuGVYC8rGfsRuYZrrRg1vAfyLSAnpYp4Eo%2B%2FXiVFRZN%2FQSNqP%2BnOrVnXcGgr5GZfnAUvRqlC3op%2Bxq1j3a9eZoEKexYzFm0cgrNoa1gKtifgvWutOVwZdJ58fJglF%2FTB3qBH5QE6EgIetjtRIMOFZrfeTaI0QpOlyFexAmuJlBy633A", "https://vtbehaviour.commondatastorage.googleapis.com/e3b4e56eb9d0af4fa92f811c8433517d1e3b0a500e626441fc3388ec5c89c38c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427874&Signature=Mka3TdgNgNwtOsGI7QSeJXzEbXBcGM7vApf4fqs1N89fN8dlAkV6RGqkQoTiYd9PjEUORagcZEFpfKD86fjqieTKGkkB0mdpW1LEfGyums9GH822QupXFD8%2FVCbbeowKDnRuvd0ZOT%2FWo0YOVLMzjQRc6HHaXTwmD30iqz08ClcMhnaTGnW%2BL1VFSUV0QOoUTPfotLBvZBzSqvMOjkppXhsU1e7zn%2BzQK8JUajgHKx7RViqsMVuA8Qlt9jy48z", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428327&Signature=CKFTYt6ArIXnni2OBMePdc%2BoH7kRmZPKkiafFzNYrWXp%2FJELva1Jl%2Fh%2BAPz2FyN1cXlsmQQI2zESw%2F5RN07RU%2F%2FgUL5LhkXqgs592Rqd60w3NRL0Syuh1bXYUy6zXlqQLg1MRwYvryPVKsV0v93ldWr%2BHwcGR3VXqtUGT7JB7YrAk0vkPyAznWMvStz%2F6jZnaVlEEYGqnCMx%2FA8O0i9yH5R0X47OY0U1B%2BHBsDKO", "https://vtbehaviour.commondatastorage.googleapis.com/013026abaf363129613d63f7a80bd5f1007d3a123442447b298e74631a86b6b9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428392&Signature=0fuLnRY7OihvxaAAPVTWWy1rHjerWWMNx%2BVogBBBqrD3gYysT0fj7z9yXH0ciZv48Vzbl12zYunAvcOrZmlhWRayUlGVpmLUMUixVInEpEUagrezUUQW8L%2FaK7MLeJRak3FTNR73YGL8ce%2BEwpUNCoTwlXYndc6GGpjbXjOHEjyuW1DrhR%2BQui94xj%2F%2FUk5EnrRIl2HS7SgRoiwpozKBamKdin2TzeP0%2FKV2O0QDII05A0Qu", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428474&Signature=uql0wTbjXQwkaToIAACxI%2Fw60EJ4vo2N07Siqp0dhXPVMJkxDeYFF6ZedokBsmnThvTAhc2yXpV%2BJgGaV5BSeKresSym3g6XQ4nRY9Q6S%2F7OabrFLu5yiEKKbRgi8%2Fvc8xj0sz79D43XxY99BwYqBZtXoSvWU1T%2B2c0KSbnsNj7VB2U6rcHd0JmQWlVb2tZlzOHvdlxx6GBoKE6E4Z3cYi1OYi7TV9jZkiEGTeQFP3VmeI6pXzMR", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428517&Signature=DU4VOy7yITJdQXs7DOFeKHRKp%2Br9mKpD9h%2BzEGEaWFaglZT%2BclhwHRdwBHsCzL3esOya6J8S6kTLGWityOyu9TZDMqfQCfMp2jrPQX0U11wTs9NTbFlQVPiFCuOcmW%2BCNCN6h3I6vc5O5HfqTq6Hbpn1lI4N5nYcPJqVw993JXQDQ6o00cH6Txboc9yIeqp31lJFhP75yloqdbqBtVFTI3bqPTd4C83AS0015IRL8zpZo%2BKa1nuGpj7FIFXb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 638, "FileHash-SHA1": 366, "FileHash-SHA256": 1441, "IPv4": 377, "URL": 1697, "domain": 404, "hostname": 873, "CIDR": 1, "Mutex": 1, "IPv6": 19, "email": 9 }, "indicator_count": 5826, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/e0ac3780a1152800adc9fb31b5fd9d849b8f8defc014657b9b2e998ff72c2bb4_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426262&Signature=avYnViHhTCOzYcoQ9ZoWQXm888gYkFImwUY0aRhd7oc1noQzp0745QvRAtZCzRHg%2BVUbbKfpoRjOdPiXYw9FjrUllbNInvvGXIqN7Vtt6LC%2BxdGOhf7dLa6Uz%2B4LKhHlMM9d8xQ8jjMB48wG8FndhOesYOX2tjxz91IrsOQV%2Fu3rAp8bXq4TWxnLb2IfPWr4pG0y4o57hz%2F8dV%2B%2Fu7EoTWk5RmbMKFLNREVh3JRX1DofdLJi", "https://vtbehaviour.commondatastorage.googleapis.com/e1473cc8cff4b1be7da44681ffa0371e603c6202e97b31b204b88e0b4cd16f6e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426024&Signature=Mn%2BWGa6Bwgj%2B7Wvu84ha8YpIKBeSUTbuDj5UoPu6SjBglPGllKI8zGujdrSeUWSakmCrXC6ynTHKW%2FCe0Mtbri1ObLWlzLI2MOBUa1yvFAedeuv%2F64ht%2BZjOHazy%2FNRoLbLO2wNd5WqlfQ3rNN%2BS%2FKqw3NxoYEZmZZhAR4NHgiElwdY%2BIT6lKyUMlku3DlyVKntVZPwyrzmP3YZUPyHbpMTZxXMmtYB8eG%2FQaUfDA3", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425966&Signature=smUTi069ww4c03xNnWiAdPUZUaGaxehukFdqKEVMCUD%2BbA%2BMmuQJo%2B3TBJ8g3pT884gYvzxRo88GpCPJTMoT54SwAzTcUD6vNx8IJxw2khWcNWb1lVYvE%2FoCguT0IJYm7wiTEjWDpeLz5amfhrPftnPjBIP1ITo9VIOc%2FK%2F%2F5EQMFcv%2FyNZhKMHzvda0LGCp6BHK0n03SMwluqFYlaGrkcE2y0buTDk2fFmt8YwN%2Bp6%", "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427538&Signature=o6aSYMUzoDKb3m0W3lZulI%2Bc%2BcvifozmlN72ZSSxcWMU3DjzK%2FH515TFuFdkccTfkm8PO%2FlxgBrpamg%2B5bAcBaYvVJ3lga385BWvoGzETcXayv%2FRl2EffIIOhDUa9yPodQ13tYE1C8gE34LQPdK02WTjxunaKFa6nQmtd4h2qgf7IRve6UEZGMbiDkUlu9muuvpS6Aw1TQ8d%2BltZZJ9mPp5lmoTbra5oKX8mvHQmfzKhBFUYfckzn6Qg", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428474&Signature=uql0wTbjXQwkaToIAACxI%2Fw60EJ4vo2N07Siqp0dhXPVMJkxDeYFF6ZedokBsmnThvTAhc2yXpV%2BJgGaV5BSeKresSym3g6XQ4nRY9Q6S%2F7OabrFLu5yiEKKbRgi8%2Fvc8xj0sz79D43XxY99BwYqBZtXoSvWU1T%2B2c0KSbnsNj7VB2U6rcHd0JmQWlVb2tZlzOHvdlxx6GBoKE6E4Z3cYi1OYi7TV9jZkiEGTeQFP3VmeI6pXzMR", "https://vtbehaviour.commondatastorage.googleapis.com/dfc3a78d8aa1b8c02a6f66ef9d96192b569e9af8d43291940eee5e0d11925e83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427738&Signature=gFp6kB0oxeyNHL6GzyKaaCGqK8SMwnZKibR150oaqlNN6FVzXLLL1xM5%2BOssqN1VObuGVYC8rGfsRuYZrrRg1vAfyLSAnpYp4Eo%2B%2FXiVFRZN%2FQSNqP%2BnOrVnXcGgr5GZfnAUvRqlC3op%2Bxq1j3a9eZoEKexYzFm0cgrNoa1gKtifgvWutOVwZdJ58fJglF%2FTB3qBH5QE6EgIetjtRIMOFZrfeTaI0QpOlyFexAmuJlBy633A", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427641&Signature=WFnkeBZrEnGt9bxaBIROfEvcDg7woGYh2z9eElPx22u7UrFNBNzuaClc6Zl5jeius8pWGrlc7WTma3KN7lY%2BtUaCClyPnnoe%2FvUr7AZI6%2Bxp6mNDoTeMsn9xu7Qw9UtFwiOXagOocenXZ1jF2RgbnGvUyQHHfkymVZIYy9QGNX6kKek3Vfpx%2FtZbK5eMyv9smQ4%2BMIb6MKyloiWF%2BPe8TsKv00dULjDyhC7QyyJEy5heiyWfU9LnviZTFL", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/5e5f874a1eedb61097a11ae64bd9c49b5f31af66e85930a66e7373e0f0484034_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426881&Signature=1FEszGc%2F5G396F8wJFd3wgCtHXg3oxedxnO7D7aWCkWs6d4k4i2%2Bp%2FehCdoJHrRy%2BJ7T4NZNupkx%2FLaxFRAwo%2BfTRBiFEwifjfN7zL2zunSZf%2FfWtXiVPftdFJynEYsHNiLxKclxy1ARhFeet3pCpGDAv70BgmRez08V1p4Qi8IG9RdOdvM6eiVmQ9AUp8LIwuJVMAQHFkKTOgCT2y01MhOpqVjtDSEIvVHBH2kInDwo7juUKj7hmudu", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426074&Signature=qsu4LRTHFbUwe%2BwGeH1wThGz%2Fef3HYKxkFl1vMVQNvSHHHWd5C6FYUJ%2FBAGx%2BPx5JPbhWS2o9hfGQ4PWjcZ%2BEqleuPjTEfvCl96m9na%2BKTfO%2B15rn0TppIYdJJ5htoNwO2lJ%2FvSyMqLFt4Ql5RobZ9%2Bwtn7dUblGvh54wFvGpuu1oDoPvM4FYh6srDJwWsDLVi9u30Uk5nk5vqIHQH9XClZDjz13oBECBSZskns55zdY", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427393&Signature=Y1SIIdbfZ13laS6E1kUpDYc3bEcZnQ7kw%2Fr%2FySc758jCzvRyB08531PJ9iIMMOMiupAUPfD3E1JfLbApE2HLnQ4ijkDHqFUPUrV4NrHU9QGGgJoj%2BJWZRNL2LFzbZoktG317lOAXVsRcZiqK9ps%2Bi%2B9q8K%2BDDNRE0Widdz0r9jJ8yUeyykgyWeZy3ljccHWcdlokMiJ4bRN6RQpwollIZ1IJBCRNewd%2FPKBJwI%2FEoFf%2B", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427457&Signature=qOgcBOyqA4YSh6lf9Vqs0UkKhwe0uotFK%2FBY4A2zWmCw%2FHzm2zZPrXINH1IFwPYSCmtm%2Fp15%2F9Qo%2FqhjC7vIq5yHz0oQjOU9Q41Oym%2F3Uea1SLp8gDBbnHKGJM1BYk88nOQOAzSporsAI6HsjZe6s7l%2B%2Buz2eFXF%2Bwkbj%2FwSSEb%2BAntmQo7dsjK90hkww2aZA9K4zdSsnT62hSdsoWJ5Xp4NS9Rv9hechWc8xqNk", "https://vtbehaviour.commondatastorage.googleapis.com/e3b4e56eb9d0af4fa92f811c8433517d1e3b0a500e626441fc3388ec5c89c38c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427874&Signature=Mka3TdgNgNwtOsGI7QSeJXzEbXBcGM7vApf4fqs1N89fN8dlAkV6RGqkQoTiYd9PjEUORagcZEFpfKD86fjqieTKGkkB0mdpW1LEfGyums9GH822QupXFD8%2FVCbbeowKDnRuvd0ZOT%2FWo0YOVLMzjQRc6HHaXTwmD30iqz08ClcMhnaTGnW%2BL1VFSUV0QOoUTPfotLBvZBzSqvMOjkppXhsU1e7zn%2BzQK8JUajgHKx7RViqsMVuA8Qlt9jy48z", "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425168&Signature=g5GBSyA0yAUEvdoIOge%2BpfDJHbEytZxyvD3%2FuIcPelmvG2YCD8XkTO52d2p6QEigdTHcudK90Dn1hnWcxTw6zW0f0taTQ152R0ivuwKsnjkdiGmEzEda3oomEw1S48VFEpo1FuPOBhJtSmOjTuz9nVjcf3CdYabNfv8w000uClW3ho3WHUKSKqaM5pz0Z6Xu2n5VBrPgbxrhGhcNzUYi9LdeW6OcRYQBHN5EqStdWH%2FvxKQ%2FaFWjFd", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425469&Signature=gf1ylsIZ1FiwQfafpFPWlt2AP1PARebq7RGsb2lQJjPNRddkHG%2BNaDO44Op2YPyEC3JC9zlMUS25qA16XdMFGyeWpb8VMUpENtMxuen3x7q3DqkJoaCjH9ZGAt9Aak00PlI4MJbauwW4QCaTMqZcv%2Bs5scZuf29QSN0dJR4znOWHr48ryot1YP5O8TwsVbpaQxFRNkUt1AyiuPjaPUNxIlcuMMDVePvGwkqamMmQVCxksE1tXMgTA4chz2ehGL1BZi", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425341&Signature=aiKp8TxOFSCG510XO0p8MMtzOWTr180htkSKvZu7%2B%2B7TV3TUxMnUm8O4WkkPJsIy0hXEHz3SRFf%2BNX2NpE5T7Akl4MMr9SaooFFtTImZIFRBXxMzzBkd6u4aNRTmAryhVrbtk4kTjCi0E3OpH3F3u5QIMQ33o2Puktbg4XX61XQWt4YaLOFUYMamfulIpUzpOHeVs%2Fkth06S%2FWrPDLvcNkaYRX3DPH8f4gl%2F9TOPklWx", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426428&Signature=ZMUnHqhcQ0e3Y7e7YGilNtksz7XM2Vy8N0nLj%2Fq7zprOG9An%2FoSgolS4cNDYtYSr9l3zZBGHdB43Oc9M4nz2aeg5WDyzle7o3jBBwQWsXIuS7HrXDH3wJPpINzb%2FlcYkpv8GJyWjJSUPZJPOV7bj32rGnh3ZOr%2BwqEA%2BOx78h9d66QzN%2FaVtc6Mg6%2F673L1JfHuXBAOSrc5TXgSNfTd0jYXHEuus8QfD3ocALihLDkkwz4tTjvcb4y6f", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425246&Signature=fNaUBAJEmKllb5%2BKYH8bOQO1PzuFIiqEarnmkfx0gTO3Zcux7EpGxLoFPLchiYgrfzVfRPXLYR87MrSmbNYjWg1htJNnnaFqRSG4aNch9NFulAeCq1Z%2Fs3nHKMh2SoYATCaXKkGC1KMoX4mFFftGFebHxq1M2D6aTdpIXnzI3HywXD8RMRRqM%2BJ%2BHAiuK%2B6FibY2SRG6%2B9sr7guEPsUOTIwiBxKX9Gbagoh14UqeIlUtMED61D", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425908&Signature=PF22eOYOsUk8SONoBlJI8S81qygM4SRaTxPjXl%2BCjQ72N47ponTTU3Ysuv4BzsixckMJSY4E2jO2BgC0FVvrrCqEk%2FTr%2BOqDIJ5VkLruDQg58W3Z4gY8TGtXjbcIyp5hIZfbbCwRf4q%2BbzA9FxSTDXd9GvVO9T%2FMLfy8fTEPq1x%2BxKuOXDo0wQmtYWTB7ljw7tWexq4FlRTU%2B7iu1JYO%2FMlylQPvdMDAy9so15FLIiqxR8", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/013026abaf363129613d63f7a80bd5f1007d3a123442447b298e74631a86b6b9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428392&Signature=0fuLnRY7OihvxaAAPVTWWy1rHjerWWMNx%2BVogBBBqrD3gYysT0fj7z9yXH0ciZv48Vzbl12zYunAvcOrZmlhWRayUlGVpmLUMUixVInEpEUagrezUUQW8L%2FaK7MLeJRak3FTNR73YGL8ce%2BEwpUNCoTwlXYndc6GGpjbXjOHEjyuW1DrhR%2BQui94xj%2F%2FUk5EnrRIl2HS7SgRoiwpozKBamKdin2TzeP0%2FKV2O0QDII05A0Qu", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428517&Signature=DU4VOy7yITJdQXs7DOFeKHRKp%2Br9mKpD9h%2BzEGEaWFaglZT%2BclhwHRdwBHsCzL3esOya6J8S6kTLGWityOyu9TZDMqfQCfMp2jrPQX0U11wTs9NTbFlQVPiFCuOcmW%2BCNCN6h3I6vc5O5HfqTq6Hbpn1lI4N5nYcPJqVw993JXQDQ6o00cH6Txboc9yIeqp31lJFhP75yloqdbqBtVFTI3bqPTd4C83AS0015IRL8zpZo%2BKa1nuGpj7FIFXb", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428327&Signature=CKFTYt6ArIXnni2OBMePdc%2BoH7kRmZPKkiafFzNYrWXp%2FJELva1Jl%2Fh%2BAPz2FyN1cXlsmQQI2zESw%2F5RN07RU%2F%2FgUL5LhkXqgs592Rqd60w3NRL0Syuh1bXYUy6zXlqQLg1MRwYvryPVKsV0v93ldWr%2BHwcGR3VXqtUGT7JB7YrAk0vkPyAznWMvStz%2F6jZnaVlEEYGqnCMx%2FA8O0i9yH5R0X47OY0U1B%2BHBsDKO", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 5624 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/tonex.com", "whois": "http://whois.domaintools.com/tonex.com", "domain": "tonex.com", "hostname": "www.tonex.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6a0ff878b8d1717e395e0d0a", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-23T03:58:21.402000", "created": "2026-05-22T06:32:24.666000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 194, "FileHash-SHA1": 212, "FileHash-SHA256": 412, "IPv4": 297, "URL": 840, "domain": 343, "hostname": 541, "CIDR": 6, "email": 23, "IPv6": 176, "CVE": 4 }, "indicator_count": 3048, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff829e77845255960bf9b", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:31:05.326000", "created": "2026-05-22T06:31:05.326000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff81386cb24a2c2aed36e", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:43.975000", "created": "2026-05-22T06:30:43.975000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff80e77e46edda3f73cbf", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:38.852000", "created": "2026-05-22T06:30:38.852000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0ff80cd75eee6656143b60", "name": "Research part 4 * CAPE Sandbox", "description": "A Cuckoo has been running on a KVM operating system for the next two years. \u00c2\u00a31.5m.. and \u00e2\u201a\u00ac1m", "modified": "2026-05-22T06:30:36.500000", "created": "2026-05-22T06:30:36.500000", "tags": [ "default", "nothing", "file execution", "registry keys", "inprocserver32", "server", "parent pid", "full path", "command line", "files c", "cname", "accept", "ip address", "cape sandbox", "found", "center", "http", "port", "shutdown", "title", "performs dns", "mitre attack", "network info", "processes extra", "sigma", "t1055 process", "overview", "overview zenbox", "verdict", "guest system", "defense evasion", "next", "win1", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "acrongl integ", "adc4240758", "angsana new", "bootkit", "back", "p2404", "host", "cultureneutral", "p11750170564", "shell folders", "systemroot", "gmt range", "guard", "pe file", "file type", "creates", "extra info", "sample", "contains", "aslr", "binary", "command", "malicious" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/91031d16ab93fe5d7f8dc7a55b4bbb8e23742c774ad467f67e2e1681e5439fb9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431033&Signature=tDkjksSltx3F6MPqpr8Xf%2BIAVxBBNNTifbGimbXIX5DCrLCZugVQF%2B7kCV%2BJ3RQ1lKt1eMcfTaQ3FUvgjt7%2F3uEgdHY390sywG9OdYe2HZMJHg%2BYNxsAIe8n7UIa22pLVZNqhDSymVa0VyJAEZb8B2t7gNdGsBLQKQ7GyJ2iYAz4NklXYQPVUZoWObKt0eggHoV3wJUWM%2BQKxWSnPP6HQ8wusnitHIEqxdfckeRTMZR9zlIg31", "https://vtbehaviour.commondatastorage.googleapis.com/beddd6543579e4744aa3aceb91c6ff522e5d4a9cf54c41b27ad97d6533cff57e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431302&Signature=VN0Lo6N8srKzgIyGy%2B2YBOQ%2BngCQJsbj8jycOiDUs3CpGIyP8pZyyC326od%2FfI41dky2kAUXq4L2f1AHLLukNksIcompwOACdBTaq%2B6r%2FyNhhrsOVLiVCA4wkuZX%2Bjz5eRA8KhG7BcGA1Z8ERy3OYr1b5gS4cUton8nwnqvSE7ZH6dFOkbdhFiX%2FwmTQbOzFCCqJWT0%2FJJZQaXyWSitlkG3IN8RyMOUpjxyT9fwh51%2FT", "https://vtbehaviour.commondatastorage.googleapis.com/f26944950ccf7fd4422662d575c0b3698670e1b19d76fe386c20058ea4ea991f_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431338&Signature=FoZZNyxGwBJKtHZSxcj9EHaeRdEMbmfNE6I04ld5vuYz8v2b9G%2Bwt0JlXl6N1uR2a9k4YqZln0HWuPEsYhjLjy3e465eqqg1UIPsLLqvH%2BmT7ox8n7TU%2B54qFOkQtrqoj3cO%2BSeZXnlXHOzxx9rdozltX%2FZ%2BOw1i5z%2FzvLy%2FlI3NhUcyIPbiD3yhM6DqHS%2Fyt7x5bhd5cz18yhPyQq7CNoW%2Fx%2B5aj4d6lWRgPVoBfaoqi33C", "https://vtbehaviour.commondatastorage.googleapis.com/c915c30bfba565e05ccdea80427ffcba415831161e38e81eccbc893e8eb0bf83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431449&Signature=PDRco%2B36G08WhkVripJBX%2FKsew%2Fqdtv%2BE4v4qZ%2BxTtqIWv%2BbUShaZJk4oroxSc0hAtyIuEAY0Fl7s%2FjNS%2FYPoQ1iU9EMWYaxvd0Sl1%2F%2BEc%2Foq9dc3YP5F0muq56mEXdREOlePA54%2BObbmwRbWR4mwAkK%2FuAkYzpAtJKkLJRZ6GQ0sbyCC5VdaAT3OMhtFkTKCtx5Wk2ZTdGZT5ASe3hD4xmg219rX3t5uV8j", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431564&Signature=x%2BpjgWuHJOMK96wkAkxWnO%2BvWXDtko8QpNc0JQs9qrmHA1DtI9OB1F4jxixqRaySdJpP0JpTJK%2BRxE8sVad9wh3wtqgIhtbiihOX2%2FXHa7ukyAZOuMkh8fVLwIUVkxrObXKFDv8CiRAzdRemUPxSH%2FYmbOPY2eYs7UbUQp%2B93VYGCAMTuaztTey%2F1T8DM1tWLfxE5nKn3j7VigVpXMi8228oo%2B7ofaOVz3A%2FZKMZ1gKD", "https://vtbehaviour.commondatastorage.googleapis.com/00185697c0de6262fafba95770b1dd85ddbcdc8b5945d517457be2fb3e6908c1_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779431586&Signature=mg5jUjSQG5fVQ2idj9wgQGE6D7neQXnBJ4xAD50pgEFgszvmZvrLrvz5RjR00uX4f7Gs2afv8MUs272SCXfylMEo1EhlVujdxecw4%2Ftn9jdYUfSDpqu0quw4dkL1YXviPoAcCJLaKrrvBsQMT468PPk4VwiDZbq2JNrZZwt1qXHmZFe3X5CHabJJE0ORZBwBH0jMYUE%2BWIvGzkZ%2Bul4ufi3xgsgA%2BoN0jUlIddwaoZA4eQeYVlQ388DLeonSjl" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1064", "name": "Scripting", "display_name": "T1064 - Scripting" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1203", "name": "Exploitation for Client Execution", "display_name": "T1203 - Exploitation for Client Execution" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 93, "FileHash-SHA1": 110, "FileHash-SHA256": 71, "IPv4": 154, "URL": 155, "domain": 7, "hostname": 189 }, "indicator_count": 779, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6a0fec7257bc32c037c9be08", "name": "research part 3 * CAPE Sandbox", "description": "NET\nIssuer\nMicrosoft Code Signing PCA 2011\nValid From\n2023-05-11 19:03:32\nValid To\n2024-05-08 19:03:32\nValid Usage\n0.4.1.311.76.8, Code Signing\nAlgorithm\nsha384RSA\nThumbprint\n50A04FFE627F8E21FD61AF1B73E5D03B4ADB100D\nThumbprint MD5\n97762F82B14E28F4E97F0A97D81F280B\nThumbprint SHA256\nC5C2879E3551DA2FA5B8B2576FB7567F2BBEF79DDA388C45D137B0EE62F8F62C\nSerial Number\n33 00 00 03 7C C9 F6 BC ED 07 59 AE 08 00 00 00 00 03 7C", "modified": "2026-05-22T06:18:07.234000", "created": "2026-05-22T05:41:06.053000", "tags": [ "string id", "x5173x95ed", "control", "wixbundlename", "x53d6x6d88", "copyright", "width", "height", "helptext", "repair", "detail info", "tickcount", "filename", "behaviour", "imagepath", "cmdline", "offset", "targetprocess", "writeaddress", "size", "write", "shell", "open", "pe32", "ms windows", "microsoft input", "method editor", "ms visual", "win32 dynamic", "link library", "pe64 compiler", "ltcgc", "linker", "windows sandbox", "clear filters", "algorithm", "key identifier", "x509v3 subject", "full name", "v3 serial", "number", "cus odigicert", "inc cndigicert", "sha2 secure", "server ca", "performs dns", "pe file", "sample", "sigma", "instance", "spawns", "aslr", "urls", "t1055 process", "attack network", "phishing", "info", "next", "status code", "body length", "kb body", "default", "parent pid", "full path", "command line", "inprocserver32", "data", "datacrashpad", "k localservice", "s ngcsvc", "s ngcctnrsvc", "cname", "strong", "library", "accept", "address virtual", "file type", "shutdown", "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "virtual address", "guard", "back", "studio build", "tools", "linkid2179911", "visual c", "visual studio", "ccli", "studio", "studio ide", "msbuild", "dev17", "false", "ascii text", "https", "svg scalable", "vector graphics", "elite", "tls version", "unicode text", "persistence", "malicious", "ip address", "mb body", "windows", "reads", "network info", "processes extra", "intel", "delphi", "code", "microsoft code", "signing pca", "valid from", "valid usage", "code signing", "thumbprint", "thumbprint md5", "c9 f6", "bc ed", "service issuer", "usage ff", "authority", "sha256", "serial number", "none rticon", "tofsee", "stream", "mitre attack", "chrome cache", "entry", "web open", "font format", "truetype", "version", "t1574", "execution flow", "found", "drops pe", "window", "Avalon", "dmca https", "versionnt", "and not", "versionnt64", "and versionnt64", "majorupgrade", "service pack", "redistributable", "detect", "windows81x86", "script", "cohassethingham", "title", "rent", "pendo", "userinfo", "doctype html", "head", "optanonwrapper", "date", "meta", "strings", "null", "layer protocol", "overview", "overview zenbox", "verdict" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425168&Signature=g5GBSyA0yAUEvdoIOge%2BpfDJHbEytZxyvD3%2FuIcPelmvG2YCD8XkTO52d2p6QEigdTHcudK90Dn1hnWcxTw6zW0f0taTQ152R0ivuwKsnjkdiGmEzEda3oomEw1S48VFEpo1FuPOBhJtSmOjTuz9nVjcf3CdYabNfv8w000uClW3ho3WHUKSKqaM5pz0Z6Xu2n5VBrPgbxrhGhcNzUYi9LdeW6OcRYQBHN5EqStdWH%2FvxKQ%2FaFWjFd", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_Tencent%20HABO.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425246&Signature=fNaUBAJEmKllb5%2BKYH8bOQO1PzuFIiqEarnmkfx0gTO3Zcux7EpGxLoFPLchiYgrfzVfRPXLYR87MrSmbNYjWg1htJNnnaFqRSG4aNch9NFulAeCq1Z%2Fs3nHKMh2SoYATCaXKkGC1KMoX4mFFftGFebHxq1M2D6aTdpIXnzI3HywXD8RMRRqM%2BJ%2BHAiuK%2B6FibY2SRG6%2B9sr7guEPsUOTIwiBxKX9Gbagoh14UqeIlUtMED61D", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_VirusTotal%20Jujubox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425341&Signature=aiKp8TxOFSCG510XO0p8MMtzOWTr180htkSKvZu7%2B%2B7TV3TUxMnUm8O4WkkPJsIy0hXEHz3SRFf%2BNX2NpE5T7Akl4MMr9SaooFFtTImZIFRBXxMzzBkd6u4aNRTmAryhVrbtk4kTjCi0E3OpH3F3u5QIMQ33o2Puktbg4XX61XQWt4YaLOFUYMamfulIpUzpOHeVs%2Fkth06S%2FWrPDLvcNkaYRX3DPH8f4gl%2F9TOPklWx", "https://vtbehaviour.commondatastorage.googleapis.com/002362f9547b518f561f460bed033d3012cb5129491df95049825e5fb397be6e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425469&Signature=gf1ylsIZ1FiwQfafpFPWlt2AP1PARebq7RGsb2lQJjPNRddkHG%2BNaDO44Op2YPyEC3JC9zlMUS25qA16XdMFGyeWpb8VMUpENtMxuen3x7q3DqkJoaCjH9ZGAt9Aak00PlI4MJbauwW4QCaTMqZcv%2Bs5scZuf29QSN0dJR4znOWHr48ryot1YP5O8TwsVbpaQxFRNkUt1AyiuPjaPUNxIlcuMMDVePvGwkqamMmQVCxksE1tXMgTA4chz2ehGL1BZi", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425908&Signature=PF22eOYOsUk8SONoBlJI8S81qygM4SRaTxPjXl%2BCjQ72N47ponTTU3Ysuv4BzsixckMJSY4E2jO2BgC0FVvrrCqEk%2FTr%2BOqDIJ5VkLruDQg58W3Z4gY8TGtXjbcIyp5hIZfbbCwRf4q%2BbzA9FxSTDXd9GvVO9T%2FMLfy8fTEPq1x%2BxKuOXDo0wQmtYWTB7ljw7tWexq4FlRTU%2B7iu1JYO%2FMlylQPvdMDAy9so15FLIiqxR8", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779425966&Signature=smUTi069ww4c03xNnWiAdPUZUaGaxehukFdqKEVMCUD%2BbA%2BMmuQJo%2B3TBJ8g3pT884gYvzxRo88GpCPJTMoT54SwAzTcUD6vNx8IJxw2khWcNWb1lVYvE%2FoCguT0IJYm7wiTEjWDpeLz5amfhrPftnPjBIP1ITo9VIOc%2FK%2F%2F5EQMFcv%2FyNZhKMHzvda0LGCp6BHK0n03SMwluqFYlaGrkcE2y0buTDk2fFmt8YwN%2Bp6%", "https://vtbehaviour.commondatastorage.googleapis.com/e1473cc8cff4b1be7da44681ffa0371e603c6202e97b31b204b88e0b4cd16f6e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426024&Signature=Mn%2BWGa6Bwgj%2B7Wvu84ha8YpIKBeSUTbuDj5UoPu6SjBglPGllKI8zGujdrSeUWSakmCrXC6ynTHKW%2FCe0Mtbri1ObLWlzLI2MOBUa1yvFAedeuv%2F64ht%2BZjOHazy%2FNRoLbLO2wNd5WqlfQ3rNN%2BS%2FKqw3NxoYEZmZZhAR4NHgiElwdY%2BIT6lKyUMlku3DlyVKntVZPwyrzmP3YZUPyHbpMTZxXMmtYB8eG%2FQaUfDA3", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426074&Signature=qsu4LRTHFbUwe%2BwGeH1wThGz%2Fef3HYKxkFl1vMVQNvSHHHWd5C6FYUJ%2FBAGx%2BPx5JPbhWS2o9hfGQ4PWjcZ%2BEqleuPjTEfvCl96m9na%2BKTfO%2B15rn0TppIYdJJ5htoNwO2lJ%2FvSyMqLFt4Ql5RobZ9%2Bwtn7dUblGvh54wFvGpuu1oDoPvM4FYh6srDJwWsDLVi9u30Uk5nk5vqIHQH9XClZDjz13oBECBSZskns55zdY", "https://vtbehaviour.commondatastorage.googleapis.com/e0ac3780a1152800adc9fb31b5fd9d849b8f8defc014657b9b2e998ff72c2bb4_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426262&Signature=avYnViHhTCOzYcoQ9ZoWQXm888gYkFImwUY0aRhd7oc1noQzp0745QvRAtZCzRHg%2BVUbbKfpoRjOdPiXYw9FjrUllbNInvvGXIqN7Vtt6LC%2BxdGOhf7dLa6Uz%2B4LKhHlMM9d8xQ8jjMB48wG8FndhOesYOX2tjxz91IrsOQV%2Fu3rAp8bXq4TWxnLb2IfPWr4pG0y4o57hz%2F8dV%2B%2Fu7EoTWk5RmbMKFLNREVh3JRX1DofdLJi", "https://vtbehaviour.commondatastorage.googleapis.com/c6096cb32fc9fe4f9cc789acd6e7710be6efb8703e6f529fc3b21d78781d1fa8_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426428&Signature=ZMUnHqhcQ0e3Y7e7YGilNtksz7XM2Vy8N0nLj%2Fq7zprOG9An%2FoSgolS4cNDYtYSr9l3zZBGHdB43Oc9M4nz2aeg5WDyzle7o3jBBwQWsXIuS7HrXDH3wJPpINzb%2FlcYkpv8GJyWjJSUPZJPOV7bj32rGnh3ZOr%2BwqEA%2BOx78h9d66QzN%2FaVtc6Mg6%2F673L1JfHuXBAOSrc5TXgSNfTd0jYXHEuus8QfD3ocALihLDkkwz4tTjvcb4y6f", "https://vtbehaviour.commondatastorage.googleapis.com/5e5f874a1eedb61097a11ae64bd9c49b5f31af66e85930a66e7373e0f0484034_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779426881&Signature=1FEszGc%2F5G396F8wJFd3wgCtHXg3oxedxnO7D7aWCkWs6d4k4i2%2Bp%2FehCdoJHrRy%2BJ7T4NZNupkx%2FLaxFRAwo%2BfTRBiFEwifjfN7zL2zunSZf%2FfWtXiVPftdFJynEYsHNiLxKclxy1ARhFeet3pCpGDAv70BgmRez08V1p4Qi8IG9RdOdvM6eiVmQ9AUp8LIwuJVMAQHFkKTOgCT2y01MhOpqVjtDSEIvVHBH2kInDwo7juUKj7hmudu", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427393&Signature=Y1SIIdbfZ13laS6E1kUpDYc3bEcZnQ7kw%2Fr%2FySc758jCzvRyB08531PJ9iIMMOMiupAUPfD3E1JfLbApE2HLnQ4ijkDHqFUPUrV4NrHU9QGGgJoj%2BJWZRNL2LFzbZoktG317lOAXVsRcZiqK9ps%2Bi%2B9q8K%2BDDNRE0Widdz0r9jJ8yUeyykgyWeZy3ljccHWcdlokMiJ4bRN6RQpwollIZ1IJBCRNewd%2FPKBJwI%2FEoFf%2B", "https://vtbehaviour.commondatastorage.googleapis.com/3fe3b0bc7ca7ec4d23c1cd7c07d5cdf9cb3463beb18cd58e2501150d343d0851_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427457&Signature=qOgcBOyqA4YSh6lf9Vqs0UkKhwe0uotFK%2FBY4A2zWmCw%2FHzm2zZPrXINH1IFwPYSCmtm%2Fp15%2F9Qo%2FqhjC7vIq5yHz0oQjOU9Q41Oym%2F3Uea1SLp8gDBbnHKGJM1BYk88nOQOAzSporsAI6HsjZe6s7l%2B%2Buz2eFXF%2Bwkbj%2FwSSEb%2BAntmQo7dsjK90hkww2aZA9K4zdSsnT62hSdsoWJ5Xp4NS9Rv9hechWc8xqNk", "https://vtbehaviour.commondatastorage.googleapis.com/72959b40065fe77303aaf1b1ef7639481e8081374d194ee7bdca70d4145c280c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427538&Signature=o6aSYMUzoDKb3m0W3lZulI%2Bc%2BcvifozmlN72ZSSxcWMU3DjzK%2FH515TFuFdkccTfkm8PO%2FlxgBrpamg%2B5bAcBaYvVJ3lga385BWvoGzETcXayv%2FRl2EffIIOhDUa9yPodQ13tYE1C8gE34LQPdK02WTjxunaKFa6nQmtd4h2qgf7IRve6UEZGMbiDkUlu9muuvpS6Aw1TQ8d%2BltZZJ9mPp5lmoTbra5oKX8mvHQmfzKhBFUYfckzn6Qg", "https://vtbehaviour.commondatastorage.googleapis.com/d0dc95ec6184b0d79326d7ef70955d143e94215b332d869cbaf4482f34741216_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427641&Signature=WFnkeBZrEnGt9bxaBIROfEvcDg7woGYh2z9eElPx22u7UrFNBNzuaClc6Zl5jeius8pWGrlc7WTma3KN7lY%2BtUaCClyPnnoe%2FvUr7AZI6%2Bxp6mNDoTeMsn9xu7Qw9UtFwiOXagOocenXZ1jF2RgbnGvUyQHHfkymVZIYy9QGNX6kKek3Vfpx%2FtZbK5eMyv9smQ4%2BMIb6MKyloiWF%2BPe8TsKv00dULjDyhC7QyyJEy5heiyWfU9LnviZTFL", "https://vtbehaviour.commondatastorage.googleapis.com/dfc3a78d8aa1b8c02a6f66ef9d96192b569e9af8d43291940eee5e0d11925e83_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427738&Signature=gFp6kB0oxeyNHL6GzyKaaCGqK8SMwnZKibR150oaqlNN6FVzXLLL1xM5%2BOssqN1VObuGVYC8rGfsRuYZrrRg1vAfyLSAnpYp4Eo%2B%2FXiVFRZN%2FQSNqP%2BnOrVnXcGgr5GZfnAUvRqlC3op%2Bxq1j3a9eZoEKexYzFm0cgrNoa1gKtifgvWutOVwZdJ58fJglF%2FTB3qBH5QE6EgIetjtRIMOFZrfeTaI0QpOlyFexAmuJlBy633A", "https://vtbehaviour.commondatastorage.googleapis.com/e3b4e56eb9d0af4fa92f811c8433517d1e3b0a500e626441fc3388ec5c89c38c_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779427874&Signature=Mka3TdgNgNwtOsGI7QSeJXzEbXBcGM7vApf4fqs1N89fN8dlAkV6RGqkQoTiYd9PjEUORagcZEFpfKD86fjqieTKGkkB0mdpW1LEfGyums9GH822QupXFD8%2FVCbbeowKDnRuvd0ZOT%2FWo0YOVLMzjQRc6HHaXTwmD30iqz08ClcMhnaTGnW%2BL1VFSUV0QOoUTPfotLBvZBzSqvMOjkppXhsU1e7zn%2BzQK8JUajgHKx7RViqsMVuA8Qlt9jy48z", "https://vtbehaviour.commondatastorage.googleapis.com/e32c3637b93d17e560587a039f5c5958b8b81c1397a6d638163dd4566fdfac4d_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428327&Signature=CKFTYt6ArIXnni2OBMePdc%2BoH7kRmZPKkiafFzNYrWXp%2FJELva1Jl%2Fh%2BAPz2FyN1cXlsmQQI2zESw%2F5RN07RU%2F%2FgUL5LhkXqgs592Rqd60w3NRL0Syuh1bXYUy6zXlqQLg1MRwYvryPVKsV0v93ldWr%2BHwcGR3VXqtUGT7JB7YrAk0vkPyAznWMvStz%2F6jZnaVlEEYGqnCMx%2FA8O0i9yH5R0X47OY0U1B%2BHBsDKO", "https://vtbehaviour.commondatastorage.googleapis.com/013026abaf363129613d63f7a80bd5f1007d3a123442447b298e74631a86b6b9_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428392&Signature=0fuLnRY7OihvxaAAPVTWWy1rHjerWWMNx%2BVogBBBqrD3gYysT0fj7z9yXH0ciZv48Vzbl12zYunAvcOrZmlhWRayUlGVpmLUMUixVInEpEUagrezUUQW8L%2FaK7MLeJRak3FTNR73YGL8ce%2BEwpUNCoTwlXYndc6GGpjbXjOHEjyuW1DrhR%2BQui94xj%2F%2FUk5EnrRIl2HS7SgRoiwpozKBamKdin2TzeP0%2FKV2O0QDII05A0Qu", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428474&Signature=uql0wTbjXQwkaToIAACxI%2Fw60EJ4vo2N07Siqp0dhXPVMJkxDeYFF6ZedokBsmnThvTAhc2yXpV%2BJgGaV5BSeKresSym3g6XQ4nRY9Q6S%2F7OabrFLu5yiEKKbRgi8%2Fvc8xj0sz79D43XxY99BwYqBZtXoSvWU1T%2B2c0KSbnsNj7VB2U6rcHd0JmQWlVb2tZlzOHvdlxx6GBoKE6E4Z3cYi1OYi7TV9jZkiEGTeQFP3VmeI6pXzMR", "https://vtbehaviour.commondatastorage.googleapis.com/26635326e74a93872df8e8c2cb62d97975d4b8fecc47f1fb095f5edaea35d24e_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779428517&Signature=DU4VOy7yITJdQXs7DOFeKHRKp%2Br9mKpD9h%2BzEGEaWFaglZT%2BclhwHRdwBHsCzL3esOya6J8S6kTLGWityOyu9TZDMqfQCfMp2jrPQX0U11wTs9NTbFlQVPiFCuOcmW%2BCNCN6h3I6vc5O5HfqTq6Hbpn1lI4N5nYcPJqVw993JXQDQ6o00cH6Txboc9yIeqp31lJFhP75yloqdbqBtVFTI3bqPTd4C83AS0015IRL8zpZo%2BKa1nuGpj7FIFXb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1014", "name": "Rootkit", "display_name": "T1014 - Rootkit" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1542", "name": "Pre-OS Boot", "display_name": "T1542 - Pre-OS Boot" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 638, "FileHash-SHA1": 366, "FileHash-SHA256": 1441, "IPv4": 377, "URL": 1697, "domain": 404, "hostname": 873, "CIDR": 1, "Mutex": 1, "IPv6": 19, "email": 9 }, "indicator_count": 5826, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "9 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.tonex.com/train", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.tonex.com/train", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780248019.164782 }