{
  "type": "URL",
  "indicator": "https://zowie.ai/20min-call",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://zowie.ai/20min-call",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3756749133,
      "indicator": "https://zowie.ai/20min-call",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6892a73593f73dfc969779b0",
          "name": "Part I | Track | Locate | Political & Civil society \u2018news\u2019 campaigns",
          "description": "Part I | Track | Locate | Political & Civil society \u2018news\u2019 campaigns\n*[ddddd.msg]\n[http://tracking.eu1.glintinc.com]\n[stormer5v52vjsw66jmds7ndeecudq444woadhzr2plxlaayexnh6eqd]\n[stackstorm.ops.dev.az.glintinc.com]\n\u2022 http://stormer5v52vjsw66jmds7ndeecudq444woadhzr2plxlaayexnh6eqd.onion/peter-thiel-running-database-to-root-out-those-disloyal-to-the-leader/\\n \u2022\n[http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/360]\n[http://pixelrz.com/lists/keywords/tsara-brashears-dead/360]",
          "modified": "2025-09-05T00:03:23.223000",
          "created": "2025-08-06T00:52:05.051000",
          "tags": [
            "url http",
            "small",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "tellyoun",
            "n aug",
            "entries",
            "data upload",
            "extraction",
            "windows error",
            "june",
            "fwd urgent",
            "justice czech",
            "copy sha256",
            "rejectedfailed",
            "timestamp input",
            "message status",
            "actions august",
            "file",
            "actions june",
            "actions may",
            "cta4 https",
            "context related",
            "associated urls",
            "campaigncodedsc",
            "language",
            "uid http",
            "community",
            "sha256",
            "size42b type",
            "submitted",
            "august",
            "april",
            "internal error",
            "previous1",
            "iframe",
            "community score",
            "scan analysis",
            "malicious",
            "intelligence",
            "learn",
            "falcon sandbox",
            "submissions",
            "status",
            "adversaries",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "defense evasion",
            "windows folder",
            "found",
            "dlls",
            "impact",
            "chromeua",
            "optout",
            "object",
            "path",
            "value",
            "access type",
            "setval",
            "windir",
            "localappdata",
            "null",
            "win64",
            "error",
            "generator",
            "close",
            "roboto",
            "date",
            "format",
            "light",
            "span",
            "template",
            "void",
            "android",
            "body",
            "trident",
            "mexico",
            "sonic",
            "black",
            "critical",
            "desktop",
            "dark",
            "meta",
            "this",
            "hybrid",
            "apache",
            "write",
            "crypto",
            "autodetect",
            "face",
            "courier",
            "gigi",
            "shadow",
            "click",
            "strings",
            "cray",
            "smwg",
            "eret",
            "footer",
            "infinity",
            "window",
            "canvas",
            "legend",
            "nuke",
            "lion",
            "4629",
            "ahav",
            "olsa",
            "false"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1007",
              "name": "System Service Discovery",
              "display_name": "T1007 - System Service Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9062,
            "domain": 707,
            "hostname": 2318,
            "FileHash-MD5": 86,
            "FileHash-SHA1": 26,
            "FileHash-SHA256": 2096,
            "email": 5,
            "FilePath": 2,
            "URI": 1
          },
          "indicator_count": 14303,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "269 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a59d46cd05b8ffc71d84",
          "name": "Racoon Stealer \u2022 Cobalt Strike",
          "description": "",
          "modified": "2023-12-06T16:47:25.409000",
          "created": "2023-12-06T16:47:25.409000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 509,
            "FileHash-MD5": 377,
            "FileHash-SHA1": 205,
            "FileHash-SHA256": 357,
            "URL": 1762,
            "domain": 595
          },
          "indicator_count": 3805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a598f3d4e8c2cffd4f73",
          "name": "SMS SPY  \u2022 Remote Access",
          "description": "",
          "modified": "2023-12-06T16:47:19.410000",
          "created": "2023-12-06T16:47:19.410000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1043,
            "hostname": 684,
            "domain": 639,
            "FileHash-MD5": 382,
            "FileHash-SHA1": 212,
            "URL": 2215
          },
          "indicator_count": 5175,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650b67e5a3ff15727eed5a06",
          "name": "SMS SPY  \u2022 Remote Access",
          "description": "Malvertizing. Spyware\nMalbranding:\nTagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person,  click on link infecting devices.",
          "modified": "2023-10-20T21:00:45.519000",
          "created": "2023-09-20T21:45:09.422000",
          "tags": [
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "alexa",
            "united",
            "engineering",
            "phishing",
            "bank",
            "cobalt strike",
            "emotet",
            "phishtank",
            "spammer",
            "malware site",
            "deepscan",
            "malicious",
            "smsspy",
            "bradesco",
            "stealer",
            "facebook",
            "download",
            "service",
            "zbot",
            "formbook",
            "coinminer",
            "raccoonstealer",
            "social engineering",
            "vj75",
            "http",
            "oid3",
            "vis1",
            "redirect chain",
            "z554903578",
            "slfrd1",
            "xpccbgarern6r",
            "xpcyqqhir7yvq",
            "xpchgxkc32lbs",
            "pattern match",
            "q0o0mahttp",
            "pfunction",
            "lkvoid",
            "glfunction",
            "befunction",
            "mrtk",
            "7jfjrw",
            "zzvyn6uhsb"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:MSIL/RacoonStealer",
              "display_name": "Trojan:MSIL/RacoonStealer",
              "target": "/malware/Trojan:MSIL/RacoonStealer"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Bradesco",
              "display_name": "TrojanSpy:Win32/Bradesco",
              "target": "/malware/TrojanSpy:Win32/Bradesco"
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 36,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 639,
            "hostname": 684,
            "FileHash-MD5": 382,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 1043,
            "URL": 2215
          },
          "indicator_count": 5175,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "954 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650b692590e81c17c7985837",
          "name": "Racoon Stealer \u2022 Cobalt Strike",
          "description": "Malvertizing. Spyware Malbranding: Tagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person, click on link infecting devices with spyware, stealers, etc.",
          "modified": "2023-10-20T20:05:36.159000",
          "created": "2023-09-20T21:50:29.485000",
          "tags": [
            "site",
            "cisco umbrella",
            "alexa top",
            "million",
            "alexa",
            "united",
            "engineering",
            "phishing",
            "bank",
            "cobalt strike",
            "emotet",
            "phishtank",
            "spammer",
            "malware site",
            "deepscan",
            "malicious",
            "smsspy",
            "bradesco",
            "stealer",
            "facebook",
            "download",
            "service",
            "zbot",
            "formbook",
            "coinminer",
            "raccoonstealer",
            "social engineering",
            "vj75",
            "http",
            "oid3",
            "vis1",
            "redirect chain",
            "z554903578",
            "slfrd1",
            "xpccbgarern6r",
            "xpcyqqhir7yvq",
            "xpchgxkc32lbs"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:MSIL/RacoonStealer",
              "display_name": "Trojan:MSIL/RacoonStealer",
              "target": "/malware/Trojan:MSIL/RacoonStealer"
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Bradesco",
              "display_name": "TrojanSpy:Win32/Bradesco",
              "target": "/malware/TrojanSpy:Win32/Bradesco"
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 595,
            "hostname": 509,
            "FileHash-MD5": 377,
            "FileHash-SHA1": 205,
            "FileHash-SHA256": 357,
            "URL": 1762
          },
          "indicator_count": 3805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "954 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Formbook",
            "Cobalt strike",
            "Trojan:msil/racoonstealer",
            "Alf:heraklezeval:trojan:win32/zbot",
            "Trojanspy:win32/bradesco"
          ],
          "industries": [],
          "unique_indicators": 19410
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/zowie.ai",
    "whois": "http://whois.domaintools.com/zowie.ai",
    "domain": "zowie.ai",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6892a73593f73dfc969779b0",
      "name": "Part I | Track | Locate | Political & Civil society \u2018news\u2019 campaigns",
      "description": "Part I | Track | Locate | Political & Civil society \u2018news\u2019 campaigns\n*[ddddd.msg]\n[http://tracking.eu1.glintinc.com]\n[stormer5v52vjsw66jmds7ndeecudq444woadhzr2plxlaayexnh6eqd]\n[stackstorm.ops.dev.az.glintinc.com]\n\u2022 http://stormer5v52vjsw66jmds7ndeecudq444woadhzr2plxlaayexnh6eqd.onion/peter-thiel-running-database-to-root-out-those-disloyal-to-the-leader/\\n \u2022\n[http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-at-concentra/360]\n[http://pixelrz.com/lists/keywords/tsara-brashears-dead/360]",
      "modified": "2025-09-05T00:03:23.223000",
      "created": "2025-08-06T00:52:05.051000",
      "tags": [
        "url http",
        "small",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "tellyoun",
        "n aug",
        "entries",
        "data upload",
        "extraction",
        "windows error",
        "june",
        "fwd urgent",
        "justice czech",
        "copy sha256",
        "rejectedfailed",
        "timestamp input",
        "message status",
        "actions august",
        "file",
        "actions june",
        "actions may",
        "cta4 https",
        "context related",
        "associated urls",
        "campaigncodedsc",
        "language",
        "uid http",
        "community",
        "sha256",
        "size42b type",
        "submitted",
        "august",
        "april",
        "internal error",
        "previous1",
        "iframe",
        "community score",
        "scan analysis",
        "malicious",
        "intelligence",
        "learn",
        "falcon sandbox",
        "submissions",
        "status",
        "adversaries",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "defense evasion",
        "windows folder",
        "found",
        "dlls",
        "impact",
        "chromeua",
        "optout",
        "object",
        "path",
        "value",
        "access type",
        "setval",
        "windir",
        "localappdata",
        "null",
        "win64",
        "error",
        "generator",
        "close",
        "roboto",
        "date",
        "format",
        "light",
        "span",
        "template",
        "void",
        "android",
        "body",
        "trident",
        "mexico",
        "sonic",
        "black",
        "critical",
        "desktop",
        "dark",
        "meta",
        "this",
        "hybrid",
        "apache",
        "write",
        "crypto",
        "autodetect",
        "face",
        "courier",
        "gigi",
        "shadow",
        "click",
        "strings",
        "cray",
        "smwg",
        "eret",
        "footer",
        "infinity",
        "window",
        "canvas",
        "legend",
        "nuke",
        "lion",
        "4629",
        "ahav",
        "olsa",
        "false"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1007",
          "name": "System Service Discovery",
          "display_name": "T1007 - System Service Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9062,
        "domain": 707,
        "hostname": 2318,
        "FileHash-MD5": 86,
        "FileHash-SHA1": 26,
        "FileHash-SHA256": 2096,
        "email": 5,
        "FilePath": 2,
        "URI": 1
      },
      "indicator_count": 14303,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "269 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a59d46cd05b8ffc71d84",
      "name": "Racoon Stealer \u2022 Cobalt Strike",
      "description": "",
      "modified": "2023-12-06T16:47:25.409000",
      "created": "2023-12-06T16:47:25.409000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 509,
        "FileHash-MD5": 377,
        "FileHash-SHA1": 205,
        "FileHash-SHA256": 357,
        "URL": 1762,
        "domain": 595
      },
      "indicator_count": 3805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a598f3d4e8c2cffd4f73",
      "name": "SMS SPY  \u2022 Remote Access",
      "description": "",
      "modified": "2023-12-06T16:47:19.410000",
      "created": "2023-12-06T16:47:19.410000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1043,
        "hostname": 684,
        "domain": 639,
        "FileHash-MD5": 382,
        "FileHash-SHA1": 212,
        "URL": 2215
      },
      "indicator_count": 5175,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650b67e5a3ff15727eed5a06",
      "name": "SMS SPY  \u2022 Remote Access",
      "description": "Malvertizing. Spyware\nMalbranding:\nTagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person,  click on link infecting devices.",
      "modified": "2023-10-20T21:00:45.519000",
      "created": "2023-09-20T21:45:09.422000",
      "tags": [
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "alexa",
        "united",
        "engineering",
        "phishing",
        "bank",
        "cobalt strike",
        "emotet",
        "phishtank",
        "spammer",
        "malware site",
        "deepscan",
        "malicious",
        "smsspy",
        "bradesco",
        "stealer",
        "facebook",
        "download",
        "service",
        "zbot",
        "formbook",
        "coinminer",
        "raccoonstealer",
        "social engineering",
        "vj75",
        "http",
        "oid3",
        "vis1",
        "redirect chain",
        "z554903578",
        "slfrd1",
        "xpccbgarern6r",
        "xpcyqqhir7yvq",
        "xpchgxkc32lbs",
        "pattern match",
        "q0o0mahttp",
        "pfunction",
        "lkvoid",
        "glfunction",
        "befunction",
        "mrtk",
        "7jfjrw",
        "zzvyn6uhsb"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:MSIL/RacoonStealer",
          "display_name": "Trojan:MSIL/RacoonStealer",
          "target": "/malware/Trojan:MSIL/RacoonStealer"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Bradesco",
          "display_name": "TrojanSpy:Win32/Bradesco",
          "target": "/malware/TrojanSpy:Win32/Bradesco"
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 36,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 639,
        "hostname": 684,
        "FileHash-MD5": 382,
        "FileHash-SHA1": 212,
        "FileHash-SHA256": 1043,
        "URL": 2215
      },
      "indicator_count": 5175,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "954 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650b692590e81c17c7985837",
      "name": "Racoon Stealer \u2022 Cobalt Strike",
      "description": "Malvertizing. Spyware Malbranding: Tagging tool tags allows adversaries to tag targets name in malicious website. Target may be lured by salacious content featuring their own name or someone known to person, click on link infecting devices with spyware, stealers, etc.",
      "modified": "2023-10-20T20:05:36.159000",
      "created": "2023-09-20T21:50:29.485000",
      "tags": [
        "site",
        "cisco umbrella",
        "alexa top",
        "million",
        "alexa",
        "united",
        "engineering",
        "phishing",
        "bank",
        "cobalt strike",
        "emotet",
        "phishtank",
        "spammer",
        "malware site",
        "deepscan",
        "malicious",
        "smsspy",
        "bradesco",
        "stealer",
        "facebook",
        "download",
        "service",
        "zbot",
        "formbook",
        "coinminer",
        "raccoonstealer",
        "social engineering",
        "vj75",
        "http",
        "oid3",
        "vis1",
        "redirect chain",
        "z554903578",
        "slfrd1",
        "xpccbgarern6r",
        "xpcyqqhir7yvq",
        "xpchgxkc32lbs"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:MSIL/RacoonStealer",
          "display_name": "Trojan:MSIL/RacoonStealer",
          "target": "/malware/Trojan:MSIL/RacoonStealer"
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Zbot",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Bradesco",
          "display_name": "TrojanSpy:Win32/Bradesco",
          "target": "/malware/TrojanSpy:Win32/Bradesco"
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 595,
        "hostname": 509,
        "FileHash-MD5": 377,
        "FileHash-SHA1": 205,
        "FileHash-SHA256": 357,
        "URL": 1762
      },
      "indicator_count": 3805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "954 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://zowie.ai/20min-call",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://zowie.ai/20min-call",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780285727.9799702
}