{
  "type": "Domain",
  "indicator": "iptvmove.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/iptvmove.com",
    "alexa": "http://www.alexa.com/siteinfo/iptvmove.com",
    "indicator": "iptvmove.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3855064240,
      "indicator": "iptvmove.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "6a126fcffc60a71dfab01f24",
          "name": "credit scoreblue - clone of another researchers post [Google Spy engine | Tracking, Malware Repository CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by scoreblue] + added 10 iocs",
          "description": "",
          "modified": "2026-05-24T03:32:22.109000",
          "created": "2026-05-24T03:26:07.144000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6688e0ffb31d4881f3238713",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4130,
            "URL": 11958,
            "hostname": 4644,
            "domain": 4304,
            "FileHash-MD5": 2256,
            "FileHash-SHA1": 1161,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1,
            "IPv6": 4,
            "IPv4": 6
          },
          "indicator_count": 28500,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "7 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a126fcc3620af2edeb95e57",
          "name": "credit scoreblue - clone of another researchers post [Google Spy engine | Tracking, Malware Repository CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by scoreblue] + added 10 iocs",
          "description": "",
          "modified": "2026-05-24T03:26:04.439000",
          "created": "2026-05-24T03:26:04.439000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6688e0ffb31d4881f3238713",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "7 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68743733a69ce827f6156f5c",
          "name": "W3.org | Google Spy engine | Tracking, Malware Repository | www.W3.org https://www.searchw3.com/ > ww.google.com.uy",
          "description": "",
          "modified": "2025-07-13T22:46:11.685000",
          "created": "2025-07-13T22:46:11.685000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6688e0ffb31d4881f3238713",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 147,
          "modified_text": "321 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "666cc0893636f98479e34f6e",
          "name": "Telus Communications ASN 852 - part 1.5",
          "description": "https://asnlookup.com/asn/AS852/\n\nhttps://www.virustotal.com/graph/embed/gf794b7e0cba442578197356822e0457b8d920ff9ea32461e85ddb716b3c771cf?theme=dark\n\nhttps://www.filescan.io/search-result?query=dGVsdXMuY29t",
          "modified": "2024-09-22T18:06:53.325000",
          "created": "2024-06-14T22:13:29.917000",
          "tags": [
            "entity",
            "please",
            "javascript",
            "mirai",
            "mozi",
            "hajime"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/gf794b7e0cba442578197356822e0457b8d920ff9ea32461e85ddb716b3c771cf?theme=dark",
            "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/iocs",
            "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/graph",
            "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/summary",
            "https://asnlookup.com/asn/AS852/",
            "https://viz.greynoise.io/analysis/7a369df9-bcbf-4540-ad0f-6d52c0c55cdb",
            "https://www.virustotal.com/graph/embed/gbe89575feac440f0b831e98562c12d0534475b1006e54221acffc624919deef7?theme=dark",
            "https://urlscan.io/search/#page.asn%3AAS852",
            "https://viz.greynoise.io/analysis/8be38b3f-73d9-4f4c-bb64-508ee329596e",
            "https://dnschecker.org/asn-whois-lookup.php?query=AS852",
            "https://mxtoolbox.com/SuperTool.aspx?action=asn%3aAS852&run=toolpage",
            "https://viz.greynoise.io/query/AS852",
            "https://viz.greynoise.io/query/AS852%20classification:%22malicious%22",
            "https://ipinfo.io",
            "https://viz.greynoise.io/analysis/1ba1e524-0d96-4cc6-9426-d01abbe75443",
            "https://bgp.tools/as/852",
            "https://www.ipvoid.com/whois/",
            "https://urlscan.io/search/#asn%3A%22AS852%22",
            "https://dnschecker.org/asn-whois-lookup.php?query=852",
            "https://leakix.net/search?scope=leak&q=telus.com",
            "http://ci-www.threatcrowd.org/domain.php?domain=telus.com",
            "https://intelx.io/?s=telus.com",
            "https://whiteintel.io/",
            "https://inteltechniques.com/tools/Domain.html",
            "https://informationlaundromat.com/content-search",
            "https://urlhaus.abuse.ch/asn/852",
            "https://bgp.he.net/AS852#_prefixes",
            "https://dnstwist.it/#9966d7b4-2d66-4349-9129-21d2adc26c89",
            "https://urlscan.io/search/#asn:%22AS852%22",
            "08.05.24 - https://viz.greynoise.io/query/AS852",
            "https://urlscan.io/asn/AS852",
            "https://www.telus.com/en/ab/outages?INTCMP=contactus_outage_AB_V2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/66b3cdc9971b263122bd14db"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Telecommunications",
            "Technology",
            "Healthcare",
            "Government",
            "Media",
            "Finance",
            "Retail",
            "Education",
            "Energy"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 55,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 12,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 4696,
            "FileHash-MD5": 69,
            "FileHash-SHA256": 1211,
            "URL": 3453,
            "domain": 2060,
            "hostname": 1853,
            "FileHash-SHA1": 68,
            "email": 5,
            "CVE": 11
          },
          "indicator_count": 13426,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "616 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e0ffb31d4881f3238713",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
          "modified": "2024-08-05T04:01:42.283000",
          "created": "2024-07-06T06:15:27.994000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 89,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "664 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e142f0c8f5ddecbc788c",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
          "modified": "2024-08-05T04:01:42.283000",
          "created": "2024-07-06T06:16:34.388000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "network",
            "fakedout threat",
            "urls http",
            "maltiverse safe",
            "malicious url",
            "team",
            "phishtank",
            "services",
            "botnet command",
            "control server",
            "mining",
            "betabot",
            "team malware",
            "engineering",
            "stealer",
            "service",
            "vawtrak",
            "virut",
            "emotet",
            "simda",
            "redline",
            "fri oct",
            "media sharing",
            "known infection source",
            "bot networks",
            "malware",
            "malware repository",
            "spyware"
          ],
          "references": [
            "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
            "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
            "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "IP\u2019s Contacted: 192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
            "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
            "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 94,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 4080,
            "URL": 11952,
            "hostname": 4638,
            "domain": 4301,
            "FileHash-MD5": 2236,
            "FileHash-SHA1": 1140,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 28384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "664 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6688e15588a794b95443b46d",
          "name": "Google Spy engine | Tracking, Malware Repository",
          "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)\nSorry so sloppy and large.\nAll tags , malware families and ATT&CK mechanisms auto populated",
          "modified": "2024-08-05T02:03:31.529000",
          "created": "2024-07-06T06:16:53.461000",
          "tags": [
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "expired",
            "acceptencoding",
            "html info",
            "title home",
            "tags viewport",
            "trackers google",
            "tag manager",
            "gsddf3d2bzf",
            "historical ssl",
            "referrer",
            "december",
            "formbook",
            "round",
            "apple ios",
            "tsara brashears",
            "unlocker",
            "collection",
            "vt graph",
            "socgholish",
            "blister",
            "hacktool",
            "hiddentear",
            "gootloader",
            "agent tesla",
            "crypto",
            "installer",
            "life",
            "malware",
            "open",
            "korplug",
            "tofsee",
            "date",
            "name servers",
            "status",
            "passive dns",
            "urls",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "files",
            "no data",
            "tag count",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "heur",
            "cisco umbrella",
            "alexa top",
            "million",
            "site",
            "alexa",
            "maltiverse",
            "xcnfe",
            "safe site",
            "phishing",
            "remcos",
            "malicious",
            "miner",
            "bank",
            "agenttesla",
            "agent",
            "unknown",
            "downloader",
            "unsafe",
            "trojan",
            "detplock",
            "artemis",
            "networm",
            "win64",
            "redline stealer",
            "limerat",
            "venom rat",
            "trojanspy",
            "tld count",
            "png image",
            "jpeg image",
            "rgba",
            "exif standard",
            "tiff image",
            "pattern match",
            "ascii text",
            "united",
            "jfif",
            "sha1",
            "core",
            "general",
            "starfield",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "adobea",
            "daga",
            "as30148 sucuri",
            "td tr",
            "search",
            "span td",
            "as44273 host",
            "creation date",
            "a domains",
            "xtra",
            "meta",
            "back",
            "verdict",
            "domain",
            "aaaa",
            "as15169 google",
            "asnone united",
            "nxdomain",
            "sucuri security",
            "a li",
            "span",
            "class",
            "body",
            "sucuri website",
            "a div",
            "authority",
            "record value",
            "showing",
            "gmt content",
            "x sucuri",
            "high",
            "related pulses",
            "show",
            "guard",
            "entries",
            "win32",
            "west domains",
            "next",
            "ipv4",
            "asnone germany",
            "object",
            "com cnt",
            "dem fin",
            "gov int",
            "nav onl",
            "phy pre",
            "formbook cnc",
            "checkin",
            "found",
            "error",
            "code",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "dock",
            "execution",
            "copy",
            "xport",
            "firewall",
            "body doctype",
            "section",
            "dcrat",
            "analyzer paste",
            "iocs",
            "hostnames",
            "url https",
            "blacklist",
            "cl0p ransomware",
            "zbot",
            "malware site",
            "team memscan",
            "cl0p",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus starizona",
            "cngo daddy",
            "g2 validity",
            "subject public",
            "key info",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "as174",
            "as3257",
            "sucuri",
            "sucur2",
            "verisign",
            "whois database",
            "server",
            "registrar abuse",
            "icann whois",
            "whois status",
            "registrar iana",
            "form",
            "temple",
            "first",
            "android",
            "win32 exe",
            "html",
            "bobby fischer",
            "office open",
            "detections type",
            "name",
            "pdf dealer",
            "price list",
            "pdf my",
            "crime",
            "taiwan unknown",
            "as3462",
            "as131148 bank",
            "as21342",
            "all search",
            "otx scoreblue",
            "pulse pulses",
            "cname",
            "as22612",
            "as43350 nforce",
            "win32upatre jun",
            "expiration date",
            "hostname",
            "lowfi",
            "date hash",
            "avast avg",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jun",
            "files show",
            "registrar",
            "china unknown",
            "title",
            "file size",
            "b file",
            "detections file",
            "gzip chrome",
            "cache entry",
            "graph",
            "ip detections",
            "country",
            "domains",
            "internet domain",
            "service bs",
            "corp",
            "namecheap inc",
            "csc corporate",
            "tucows",
            "epik llc",
            "tucows domains"
          ],
          "references": [
            "https://www.searchw3.com/",
            "IP\u2019s Contacted: 192.124.249.187",
            "Ransomware: message.htm.com",
            "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
            "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
            "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
            "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
            "192.124.249.187",
            "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
            "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 73,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3731,
            "URL": 11926,
            "hostname": 4626,
            "domain": 4135,
            "FileHash-MD5": 1530,
            "FileHash-SHA1": 762,
            "CVE": 8,
            "SSLCertFingerprint": 20,
            "email": 8,
            "CIDR": 1
          },
          "indicator_count": 26747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 234,
          "modified_text": "664 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eff46bdd371899ca5be7d7",
          "name": "CrypterX-gen | Video-lal.com | M. Brian Sabey \u2022 Hall Render | Rexxfield",
          "description": "Videolal results. Parked. Owner of domain has subsidiaries including Huge Domains. It's possible for attacker to post a 404 error page,  park, post it for sale, malvertize. HoneyPotBot? \n\nFireeye. A bit much. william.ballenthin@fireeye.com\t\ncontain a resource (.rsrc) section moritz.raabe@fireeye.com. Overkill. What would Scooby Doo? Scooby!? \nTarget reports opening her MacBook Pro after it was replaced by Apple. It hadn't been in use. She opened it, surprised it was on, automatically connected to a store wifi (she was home) A worker was typing away in terminal. Fought hacker for recordings app containing Jeffrey Reimers aggressions. She lost. Terrified she murdered her MacBook by drowning  & dismemberment. Big mistake. Cloned MacBook.  Clicked on links trigger malicious downloads, network & DNS issues.",
          "modified": "2024-04-11T04:01:24.166000",
          "created": "2024-03-12T06:21:31.484000",
          "tags": [
            "upatre malware",
            "rwi dtools",
            "page dow",
            "security",
            "bitfender",
            "yandex",
            "malware",
            "all octoseek",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "file score",
            "fireeye",
            "injection",
            "worm",
            "trojan",
            "network",
            "poster",
            "honeybots",
            "united",
            "unknown",
            "win32upatre mar",
            "passive dns",
            "entries",
            "ipv4",
            "body",
            "artro",
            "generic malware",
            "formbook",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "generic",
            "hostnames",
            "pattern match",
            "ascii text",
            "png image",
            "root ca",
            "file",
            "authority",
            "indicator",
            "mitre att",
            "ck id",
            "class",
            "date",
            "enterprise",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "trident",
            "as47846",
            "germany unknown",
            "as2906 netflix",
            "scan endpoints",
            "domain",
            "urls",
            "files",
            "trojanspy",
            "mozilla",
            "dynamicloader",
            "medium",
            "title",
            "ms windows",
            "head",
            "intel",
            "inetsim http",
            "delete c",
            "show",
            "winnt",
            "copy",
            "powershell",
            "write",
            "next",
            "suspicious",
            "shop",
            "graph api",
            "status",
            "join",
            "vt community",
            "api key",
            "xcitium verdict",
            "cloud",
            "contacted",
            "contacted urls",
            "ssl certificate",
            "referrer",
            "historical ssl",
            "parent domain",
            "apple ios",
            "resolutions",
            "execution",
            "hacktool",
            "outbound connection",
            "detection list",
            "blacklist"
          ],
          "references": [
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
            "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
            "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
            "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
            "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
            "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
            "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
            "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
            "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
            "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
            "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
            "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
            "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
            "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
            "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
            "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
            "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
            "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
            "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
            "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
            "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32:CrypterX-gen\\ [Trj]",
              "display_name": "Win32:CrypterX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Win32.Renos/Artro",
              "display_name": "Win32.Renos/Artro",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "I-Worm/Bagle.QE",
              "display_name": "I-Worm/Bagle.QE",
              "target": null
            },
            {
              "id": "Worm.Bagle-44",
              "display_name": "Worm.Bagle-44",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.DE",
              "display_name": "TrojanSpy:Win32/Nivdort.DE",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
            },
            {
              "id": "Win.Trojan.Generic-9897526-0",
              "display_name": "Win.Trojan.Generic-9897526-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Knigsfot-125",
              "display_name": "Win.Trojan.Knigsfot-125",
              "target": null
            },
            {
              "id": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "display_name": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-9957168-0",
              "display_name": "Win.Trojan.Generic-9957168-0",
              "target": null
            },
            {
              "id": "Win.Adware.RelevantKnowledge-9821121-0",
              "display_name": "Win.Adware.RelevantKnowledge-9821121-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1622,
            "FileHash-SHA1": 934,
            "FileHash-SHA256": 3289,
            "URL": 9605,
            "domain": 2321,
            "hostname": 2411,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 20186,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "780 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65eedf74b7bdda41057bef3e",
          "name": "Source Browse- DNS poisoning \u2022 Device CnC",
          "description": "Smear + Fear campaign. Parked domain schemes.   Swatting, social engineering, crime staging/framing.  Cyber bully,  shocking, false online content, posters, porn dumping,  injection, CnC devices, master keys, break  & enter. Victim becomes the accused. Framing.  Ability to close bank accounts, skim, call, text, email collection, redirect phone calls, create botnets, engineer malware, injection,divert tax refunds, divert funds, royalties, mail erase job history, attack, hospital, CnC event, IRS audits, fake documentaries, stalkers, attackers, death threats.  MD articulated outcome after being SA'd by their employee they vowed to protect.",
          "modified": "2024-04-10T09:00:27.994000",
          "created": "2024-03-11T10:39:48.949000",
          "tags": [
            "iocs",
            "all octoseek",
            "blacklist https",
            "gmbh version",
            "legal",
            "service privacy",
            "general full",
            "reverse dns",
            "san francisco",
            "asn13335",
            "cloudflarenet",
            "cloudflare",
            "domains",
            "service privacy",
            "modernizr",
            "domainpath name",
            "migrate",
            "phishing",
            "url https",
            "united",
            "line",
            "threat",
            "paste",
            "analyze",
            "value",
            "z6s3i string",
            "a7i string",
            "y3i string",
            "e0b function",
            "x8i string",
            "source level",
            "threat analyzer",
            "urls https",
            "domain",
            "webzilla",
            "cloudflar",
            "system",
            "hostnames",
            "sample",
            "security tls",
            "ecdheecdsa",
            "resource",
            "hash",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "veryhigh",
            "limited",
            "lsalford",
            "ocomodo ca",
            "cncomodo ecc",
            "secure server",
            "olet",
            "encrypt",
            "cnlet",
            "identity search",
            "group",
            "google https",
            "expired",
            "comodo",
            "tls web",
            "log id",
            "criteria id",
            "1663014711",
            "summary leaf",
            "timestamp entry",
            "log operator",
            "error",
            "name size",
            "parent",
            "directory",
            "displays",
            "targets",
            "smartfolder",
            "frame",
            "bookmarks",
            "splitcount",
            "nib files",
            "design",
            "boundsstr",
            "rows",
            "source browser",
            "ruby logo",
            "license",
            "python",
            "python software",
            "foundation",
            "apple inc",
            "php logo",
            "visit",
            "valid",
            "no na",
            "no no",
            "ip security",
            "ca id",
            "research group",
            "cnisrg root",
            "mozilla",
            "android",
            "binrm",
            "targetdisk",
            "create",
            "crlcachedir",
            "makefile",
            "dstroot",
            "keychainssrc",
            "srcroot",
            "crl cache",
            "install",
            "ev server",
            "authentication",
            "subject",
            "digicert https",
            "sectigo https",
            "certificate",
            "ca limited",
            "salford",
            "greater",
            "key usage",
            "access",
            "ca issuers",
            "ocsp",
            "x509v3 subject",
            "lets",
            "identifier",
            "411260982",
            "poison",
            "search",
            "status page",
            "impressum",
            "protocol h2",
            "main",
            "framing",
            "geoip",
            "as13335",
            "centos",
            "as32244",
            "liquidweb",
            "redirect",
            "as16509",
            "as133618",
            "z6s3i y3i",
            "as62597",
            "france unknown",
            "showing",
            "link",
            "z6s3i",
            "date",
            "unknown",
            "meta",
            "sha256",
            "google safe",
            "browsing",
            "hostname",
            "samples",
            "td td",
            "tr tr",
            "a td",
            "a domains",
            "passive dns",
            "a th",
            "urls",
            "as50295 triple",
            "triple mirrors",
            "contact",
            "moved",
            "show",
            "accept",
            "body",
            "microsoft",
            "e4609l",
            "urls http",
            "yoa https",
            "url http",
            "scan endpoints",
            "report spam",
            "created",
            "weeks ago",
            "pulse",
            "brashears",
            "xvideos",
            "capture",
            "expiration",
            "no expiration",
            "entries",
            "status",
            "as58110 ip",
            "for privacy",
            "aaaa",
            "creation date",
            "domain name",
            "germany unknown",
            "bq mar",
            "ipv4",
            "pulse pulses",
            "files",
            "artro",
            "files domain",
            "files related",
            "pulses otx",
            "pulses",
            "tags",
            "servers",
            "record value",
            "body doctype",
            "html public",
            "macintosh",
            "intel mac",
            "os x",
            "technology",
            "dns replication",
            "email",
            "server",
            "registrar abuse",
            "dnssec",
            "expiration date",
            "registrar iana",
            "admin country",
            "tech country",
            "registry admin",
            "url text",
            "facebook url",
            "google url",
            "google",
            "software",
            "asn15169",
            "ip https",
            "february",
            "request chain",
            "http",
            "referer",
            "aes128gcm",
            "pragma",
            "frankfurt",
            "germany",
            "asn213250",
            "itpsolutions",
            "full url",
            "software caddy",
            "express",
            "ubuntu",
            "as14061",
            "digitaloceanasn",
            "address as",
            "april",
            "facebook",
            "march",
            "hashes",
            "ip address",
            "as autonomous",
            "fastly",
            "packet",
            "kb script",
            "b script",
            "october",
            "resource path",
            "size",
            "type mimetype",
            "redirect chain",
            "kb image",
            "b image",
            "cname",
            "as32244 liquid",
            "trojan",
            "high",
            "yara rule",
            "sniffs",
            "windows",
            "anomalous file",
            "medium",
            "guard",
            "filehash",
            "js user",
            "python connection",
            "brian sabey",
            "smithtech",
            "rexxfield",
            "connect facebook",
            "open",
            "emails",
            "next",
            "ssl certificate",
            "contacted",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "execution",
            "whois whois",
            "contacted urls",
            "linkid69157 url",
            "formbook",
            "spyware",
            "generic malware",
            "tag count",
            "sat jul",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "generic",
            "alerts",
            "icmp traffic",
            "cust exe",
            "depot tech",
            "office depot",
            "tech",
            "customer client",
            "june",
            "copy",
            "network_icmp",
            "inject-x64.exe",
            "tsara brashears",
            "apple ios",
            "hacktool",
            "download",
            "malware",
            "relic",
            "monitoring",
            "tofsee",
            "https://otx.alienvault.com/pulse/65acace20c18a7d6c5da2e27",
            "darklivity",
            "hijacker",
            "remote attackers",
            "cybercrime",
            "fear factor",
            "criminal gang",
            "jeffrey reimer",
            "miles it",
            "history killer",
            "apple",
            "apple control",
            "sreredrum",
            "men",
            "man",
            "hit"
          ],
          "references": [
            "videolal.com [Exploitation for privilege - Turns victim into target then spys, smears, embeds pornography in devices]",
            "videolal.com was first found hosted : https://rexxfield.com/ | https://crt.sh/?id=410492573 | https://crt.sh/?id=411260982",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/michael.pbxuser.auto.html",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/project.pbxproj.auto.html",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/roots/",
            "https://crt.sh/?q=videolal.com",
            "https://opensource.apple.com/source/security_certificates/security_certificates-2/Makefile.auto.html",
            "https://opensource.apple.com/source/security_certificates/",
            "https://crt.sh/?q=videolal.com",
            "https://crt.sh/?graph=410492573&opt=nometadata",
            "https://crt.sh/?spkisha256=2c5ef644a15ed2d591aee707a125b2870da480a0bc16d78022a311c93aca5b15",
            "Tracey Richter smear included Brashears: http://video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
            "Tracey Richter smear:  video-lal.com/videos/diabolical-sentencing.html",
            "Tracey Richter smear:  video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
            "Tracey Richter smear: video-lal.com/video/fbcwPGTSo5lrA7e/tracey-richter-documentary?cpc=no",
            "Malware hosting: http://videolan.mirror.triple-it.nl/vlc-android/3.0.4/VLC-Android-3.0.4-ARMv7.apk",
            "video-lal.com/videos/sandra-richter-video.html",
            "Denver Attorney Frank Azar Smear: video-lal.com/videos/sherryce-emery-frank-azar-&-associates.html",
            "Brashears smear: video-lal.com/videos/tsara-brashears-dead-by-daylight.html",
            "http://tx-p2p-pull.video-voip.com.dorm.com/Accept-Language",
            "Crazy: video-lal.com/videos/michael-roberts.html",
            "https://urlscan.io/screenshots/e40cd846-7c34-45a5-9f79-fea139f5b1ee.png",
            "http://secure.applegiftcard.com \u2022 199.59.243.224: http://tx-p2p-pull.video-voip.com.dorm.com \u2022 199.59.243.224: http://wpad.dorm.com",
            "notonmytrack.info \u2022 http://notonmytrack.info \u2022 https://pochta-rf.ru/track74157857 \u2022 patch-tracker.gnewsense.org \u2022 mysql.snore.co",
            "Darren Meade: https://urlscan.io/result/e5f1d6fe-036e-4291-8595-0a33e5dacba5/#behaviour \u2022 alleged partner turned enemy of Michael Roberts",
            "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe | smithsthermopadtool.com",
            "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe \u2022",
            "Unclear given names authentic. Michael Roberts, Darren Mitchell Meade , M. Brian Sabey could be used interchangeably. Black hats w/pseudonyms.",
            "Smith tech may refer to Det. Ben Smith. HallRender; a media company, producing nonsensical, albeit convincing evidence of deeply fake content.",
            "Possibly false names given by individual involved. Brian Sabey Hall Render | Michael Roberts Rexxfield |  Darren Meade former partner of Roberts",
            "Responsible reopening Richter case via alleged Detective Ben Smith | Names Below  linked to porn spewing Videolan , Videolal, Video-lal (Honeypots?) |",
            "http://www.hallrender.com/attorney/brian-sabey |",
            "Sabey: https://www.google.com/search?q=tsara+brashears&client=ms-android-tmus-us-rvc3&sca_esv=52c806ab62ec5c59&cs=1&prmd=inv&filter=0&biw=347&bih=710&dpr=2.08#ip=1",
            "https://www.hallrender.com/attorney/brian-sabey",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png | www.hallrender.com | rexxfield.com",
            "http://usb.smithtech.us  \u2022 http://usb.smithtech.us/apps/downloads/NSISPortable.exe \u2022 http://usb.smithtech.us/apps/downloads/xplorer2.lite.portable.exe",
            "http://usb.smithtech.us/projects/downloads/\u2022 http://usb.smithtech.us/projects/downloads/psu.exe \u2022 smithsthermopadtool.com",
            "servicer.mgid.com \u2022 http://iv-u15.com/imbd-104-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-\u00e5\u00a4\u008f\u00e5\u00b0\u2018\u00e5\u00a5\u00b3-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-blu-ray \u2022 https://load77.exelator.com/pixel.gif",
            "brain-portal.net",
            "303 Status. Ide redirect from: https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
            "https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
            "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
            "https://otx.alienvault.com/pulse/64d018ee4623e8fcd386c2e1",
            "https://otx.alienvault.com/pulse/65418472eb20b10ee5510fde",
            "https://otx.alienvault.com/pulse/64d65255c80d866add600bac",
            "https://otx.alienvault.com/pulse/65204565ac1e8bce4de26df3",
            "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
            "https://otx.alienvault.com/pulse/65a342310ab3d2c69778d608",
            "Refuses to remove target from adult content \"tagging\""
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Win.Malware.Farfli-6824119-0",
              "display_name": "Win.Malware.Farfli-6824119-0",
              "target": null
            },
            {
              "id": "Win32:TrojanX-Gen[Trj]",
              "display_name": "Win32:TrojanX-Gen[Trj]",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1574.006",
              "name": "Dynamic Linker Hijacking",
              "display_name": "T1574.006 - Dynamic Linker Hijacking"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1602.002",
              "name": "Network Device Configuration Dump",
              "display_name": "T1602.002 - Network Device Configuration Dump"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1156",
              "name": "Malicious Shell Modification",
              "display_name": "T1156 - Malicious Shell Modification"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5328,
            "domain": 2339,
            "hostname": 2434,
            "FileHash-MD5": 1210,
            "FileHash-SHA1": 721,
            "FileHash-SHA256": 2784,
            "SSLCertFingerprint": 5,
            "CVE": 2,
            "URI": 2,
            "email": 10,
            "CIDR": 3
          },
          "indicator_count": 14838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
        "https://bgp.tools/as/852",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/66b3cdc9971b263122bd14db",
        "Ransomware: message.htm.com",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
        "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
        "Tracey Richter smear included Brashears: http://video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "https://bgp.he.net/AS852#_prefixes",
        "https://mxtoolbox.com/SuperTool.aspx?action=asn%3aAS852&run=toolpage",
        "Malware hosting: http://videolan.mirror.triple-it.nl/vlc-android/3.0.4/VLC-Android-3.0.4-ARMv7.apk",
        "https://asnlookup.com/asn/AS852/",
        "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
        "http://usb.smithtech.us/projects/downloads/\u2022 http://usb.smithtech.us/projects/downloads/psu.exe \u2022 smithsthermopadtool.com",
        "https://urlscan.io/search/#asn%3A%22AS852%22",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
        "https://www.searchw3.com/",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/project.pbxproj.auto.html",
        "http://tx-p2p-pull.video-voip.com.dorm.com/Accept-Language",
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "brain-portal.net",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "https://otx.alienvault.com/pulse/64d018ee4623e8fcd386c2e1",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe | smithsthermopadtool.com",
        "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
        "https://otx.alienvault.com/pulse/65418472eb20b10ee5510fde",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/iocs",
        "https://leakix.net/search?scope=leak&q=telus.com",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "Tracey Richter smear:  video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/roots/",
        "Refuses to remove target from adult content \"tagging\"",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "servicer.mgid.com \u2022 http://iv-u15.com/imbd-104-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-\u00e5\u00a4\u008f\u00e5\u00b0\u2018\u00e5\u00a5\u00b3-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-blu-ray \u2022 https://load77.exelator.com/pixel.gif",
        "https://viz.greynoise.io/analysis/7a369df9-bcbf-4540-ad0f-6d52c0c55cdb",
        "https://crt.sh/?q=videolal.com",
        "https://viz.greynoise.io/query/AS852%20classification:%22malicious%22",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Smith tech may refer to Det. Ben Smith. HallRender; a media company, producing nonsensical, albeit convincing evidence of deeply fake content.",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/Makefile.auto.html",
        "https://viz.greynoise.io/analysis/1ba1e524-0d96-4cc6-9426-d01abbe75443",
        "https://whiteintel.io/",
        "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
        "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
        "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "https://inteltechniques.com/tools/Domain.html",
        "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
        "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
        "http://secure.applegiftcard.com \u2022 199.59.243.224: http://tx-p2p-pull.video-voip.com.dorm.com \u2022 199.59.243.224: http://wpad.dorm.com",
        "https://www.ipvoid.com/whois/",
        "https://otx.alienvault.com/pulse/65a342310ab3d2c69778d608",
        "https://opensource.apple.com/source/security_certificates/",
        "Tracey Richter smear:  video-lal.com/videos/diabolical-sentencing.html",
        "https://urlscan.io/screenshots/e40cd846-7c34-45a5-9f79-fea139f5b1ee.png",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
        "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "08.05.24 - https://viz.greynoise.io/query/AS852",
        "https://dnschecker.org/asn-whois-lookup.php?query=AS852",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
        "https://intelx.io/?s=telus.com",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "https://www.telus.com/en/ab/outages?INTCMP=contactus_outage_AB_V2",
        "videolal.com [Exploitation for privilege - Turns victim into target then spys, smears, embeds pornography in devices]",
        "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Crazy: video-lal.com/videos/michael-roberts.html",
        "https://ipinfo.io",
        "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
        "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
        "http://ci-www.threatcrowd.org/domain.php?domain=telus.com",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/graph",
        "https://informationlaundromat.com/content-search",
        "192.124.249.187",
        "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "303 Status. Ide redirect from: https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "notonmytrack.info \u2022 http://notonmytrack.info \u2022 https://pochta-rf.ru/track74157857 \u2022 patch-tracker.gnewsense.org \u2022 mysql.snore.co",
        "Sabey: https://www.google.com/search?q=tsara+brashears&client=ms-android-tmus-us-rvc3&sca_esv=52c806ab62ec5c59&cs=1&prmd=inv&filter=0&biw=347&bih=710&dpr=2.08#ip=1",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/michael.pbxuser.auto.html",
        "Denver Attorney Frank Azar Smear: video-lal.com/videos/sherryce-emery-frank-azar-&-associates.html",
        "https://viz.greynoise.io/query/AS852",
        "https://www.hallrender.com/attorney/brian-sabey",
        "Unclear given names authentic. Michael Roberts, Darren Mitchell Meade , M. Brian Sabey could be used interchangeably. Black hats w/pseudonyms.",
        "https://www.virustotal.com/graph/embed/gbe89575feac440f0b831e98562c12d0534475b1006e54221acffc624919deef7?theme=dark",
        "http://usb.smithtech.us  \u2022 http://usb.smithtech.us/apps/downloads/NSISPortable.exe \u2022 http://usb.smithtech.us/apps/downloads/xplorer2.lite.portable.exe",
        "https://dnstwist.it/#9966d7b4-2d66-4349-9129-21d2adc26c89",
        "https://otx.alienvault.com/pulse/64d65255c80d866add600bac",
        "https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "https://urlscan.io/asn/AS852",
        "https://crt.sh/?graph=410492573&opt=nometadata",
        "Darren Meade: https://urlscan.io/result/e5f1d6fe-036e-4291-8595-0a33e5dacba5/#behaviour \u2022 alleged partner turned enemy of Michael Roberts",
        "https://www.virustotal.com/graph/embed/gf794b7e0cba442578197356822e0457b8d920ff9ea32461e85ddb716b3c771cf?theme=dark",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
        "video-lal.com/videos/sandra-richter-video.html",
        "https://otx.alienvault.com/pulse/65204565ac1e8bce4de26df3",
        "http://www.hallrender.com/attorney/brian-sabey |",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png | www.hallrender.com | rexxfield.com",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Possibly false names given by individual involved. Brian Sabey Hall Render | Michael Roberts Rexxfield |  Darren Meade former partner of Roberts",
        "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
        "https://urlscan.io/search/#page.asn%3AAS852",
        "https://crt.sh/?spkisha256=2c5ef644a15ed2d591aee707a125b2870da480a0bc16d78022a311c93aca5b15",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe \u2022",
        "Tracey Richter smear: video-lal.com/video/fbcwPGTSo5lrA7e/tracey-richter-documentary?cpc=no",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
        "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
        "Responsible reopening Richter case via alleged Detective Ben Smith | Names Below  linked to porn spewing Videolan , Videolal, Video-lal (Honeypots?) |",
        "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
        "https://viz.greynoise.io/analysis/8be38b3f-73d9-4f4c-bb64-508ee329596e",
        "Brashears smear: video-lal.com/videos/tsara-brashears-dead-by-daylight.html",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
        "https://urlhaus.abuse.ch/asn/852",
        "videolal.com was first found hosted : https://rexxfield.com/ | https://crt.sh/?id=410492573 | https://crt.sh/?id=411260982",
        "https://urlscan.io/search/#asn:%22AS852%22",
        "https://dnschecker.org/asn-whois-lookup.php?query=852",
        "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/summary"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Alf:trojandownloader:win32/vadokrist.a",
            "Win.trojan.knigsfot-125",
            "Worm.bagle-44",
            "Trojanspy:win32/nivdort.de",
            "Win.trojan.generic-9897526-0",
            "Win.trojan.generic-9957168-0",
            "Win.malware.farfli-6824119-0",
            "Win32:crypterx-gen\\ [trj]",
            "Trojanspy",
            "Generic",
            "Formbook",
            "Hacktool",
            "Win32:trojanx-gen[trj]",
            "Win32.renos/artro",
            "Redline",
            "Cl0p",
            "Win.adware.relevantknowledge-9821121-0",
            "Other:malware-gen\\ [trj]",
            "Alf:heraklezeval:trojan:win32/neurevt",
            "I-worm/bagle.qe",
            "Artro"
          ],
          "industries": [
            "Healthcare",
            "Education",
            "Energy",
            "Media",
            "Finance",
            "Telecommunications",
            "Retail",
            "Government",
            "Technology"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "6a126fcffc60a71dfab01f24",
      "name": "credit scoreblue - clone of another researchers post [Google Spy engine | Tracking, Malware Repository CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by scoreblue] + added 10 iocs",
      "description": "",
      "modified": "2026-05-24T03:32:22.109000",
      "created": "2026-05-24T03:26:07.144000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6688e0ffb31d4881f3238713",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4130,
        "URL": 11958,
        "hostname": 4644,
        "domain": 4304,
        "FileHash-MD5": 2256,
        "FileHash-SHA1": 1161,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1,
        "IPv6": 4,
        "IPv4": 6
      },
      "indicator_count": 28500,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "7 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a126fcc3620af2edeb95e57",
      "name": "credit scoreblue - clone of another researchers post [Google Spy engine | Tracking, Malware Repository CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by scoreblue] + added 10 iocs",
      "description": "",
      "modified": "2026-05-24T03:26:04.439000",
      "created": "2026-05-24T03:26:04.439000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6688e0ffb31d4881f3238713",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4080,
        "URL": 11952,
        "hostname": 4638,
        "domain": 4301,
        "FileHash-MD5": 2236,
        "FileHash-SHA1": 1140,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 28384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "7 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68743733a69ce827f6156f5c",
      "name": "W3.org | Google Spy engine | Tracking, Malware Repository | www.W3.org https://www.searchw3.com/ > ww.google.com.uy",
      "description": "",
      "modified": "2025-07-13T22:46:11.685000",
      "created": "2025-07-13T22:46:11.685000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6688e0ffb31d4881f3238713",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4080,
        "URL": 11952,
        "hostname": 4638,
        "domain": 4301,
        "FileHash-MD5": 2236,
        "FileHash-SHA1": 1140,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 28384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 147,
      "modified_text": "321 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "666cc0893636f98479e34f6e",
      "name": "Telus Communications ASN 852 - part 1.5",
      "description": "https://asnlookup.com/asn/AS852/\n\nhttps://www.virustotal.com/graph/embed/gf794b7e0cba442578197356822e0457b8d920ff9ea32461e85ddb716b3c771cf?theme=dark\n\nhttps://www.filescan.io/search-result?query=dGVsdXMuY29t",
      "modified": "2024-09-22T18:06:53.325000",
      "created": "2024-06-14T22:13:29.917000",
      "tags": [
        "entity",
        "please",
        "javascript",
        "mirai",
        "mozi",
        "hajime"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/gf794b7e0cba442578197356822e0457b8d920ff9ea32461e85ddb716b3c771cf?theme=dark",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/iocs",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/graph",
        "https://www.virustotal.com/gui/collection/0b3c0a84782018d8bafc47ebd40c4eaf993f40ca3de61aa98eb15302a7a80b04/summary",
        "https://asnlookup.com/asn/AS852/",
        "https://viz.greynoise.io/analysis/7a369df9-bcbf-4540-ad0f-6d52c0c55cdb",
        "https://www.virustotal.com/graph/embed/gbe89575feac440f0b831e98562c12d0534475b1006e54221acffc624919deef7?theme=dark",
        "https://urlscan.io/search/#page.asn%3AAS852",
        "https://viz.greynoise.io/analysis/8be38b3f-73d9-4f4c-bb64-508ee329596e",
        "https://dnschecker.org/asn-whois-lookup.php?query=AS852",
        "https://mxtoolbox.com/SuperTool.aspx?action=asn%3aAS852&run=toolpage",
        "https://viz.greynoise.io/query/AS852",
        "https://viz.greynoise.io/query/AS852%20classification:%22malicious%22",
        "https://ipinfo.io",
        "https://viz.greynoise.io/analysis/1ba1e524-0d96-4cc6-9426-d01abbe75443",
        "https://bgp.tools/as/852",
        "https://www.ipvoid.com/whois/",
        "https://urlscan.io/search/#asn%3A%22AS852%22",
        "https://dnschecker.org/asn-whois-lookup.php?query=852",
        "https://leakix.net/search?scope=leak&q=telus.com",
        "http://ci-www.threatcrowd.org/domain.php?domain=telus.com",
        "https://intelx.io/?s=telus.com",
        "https://whiteintel.io/",
        "https://inteltechniques.com/tools/Domain.html",
        "https://informationlaundromat.com/content-search",
        "https://urlhaus.abuse.ch/asn/852",
        "https://bgp.he.net/AS852#_prefixes",
        "https://dnstwist.it/#9966d7b4-2d66-4349-9129-21d2adc26c89",
        "https://urlscan.io/search/#asn:%22AS852%22",
        "08.05.24 - https://viz.greynoise.io/query/AS852",
        "https://urlscan.io/asn/AS852",
        "https://www.telus.com/en/ab/outages?INTCMP=contactus_outage_AB_V2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/66b3cdc9971b263122bd14db"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Telecommunications",
        "Technology",
        "Healthcare",
        "Government",
        "Media",
        "Finance",
        "Retail",
        "Education",
        "Energy"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 55,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 12,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 4696,
        "FileHash-MD5": 69,
        "FileHash-SHA256": 1211,
        "URL": 3453,
        "domain": 2060,
        "hostname": 1853,
        "FileHash-SHA1": 68,
        "email": 5,
        "CVE": 11
      },
      "indicator_count": 13426,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "616 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6688e0ffb31d4881f3238713",
      "name": "Google Spy engine | Tracking, Malware Repository",
      "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
      "modified": "2024-08-05T04:01:42.283000",
      "created": "2024-07-06T06:15:27.994000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 89,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4080,
        "URL": 11952,
        "hostname": 4638,
        "domain": 4301,
        "FileHash-MD5": 2236,
        "FileHash-SHA1": 1140,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 28384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "664 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6688e142f0c8f5ddecbc788c",
      "name": "Google Spy engine | Tracking, Malware Repository",
      "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)",
      "modified": "2024-08-05T04:01:42.283000",
      "created": "2024-07-06T06:16:34.388000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "network",
        "fakedout threat",
        "urls http",
        "maltiverse safe",
        "malicious url",
        "team",
        "phishtank",
        "services",
        "botnet command",
        "control server",
        "mining",
        "betabot",
        "team malware",
        "engineering",
        "stealer",
        "service",
        "vawtrak",
        "virut",
        "emotet",
        "simda",
        "redline",
        "fri oct",
        "media sharing",
        "known infection source",
        "bot networks",
        "malware",
        "malware repository",
        "spyware"
      ],
      "references": [
        "https://www.searchw3.com/ = google.analytics.com, google.com, google.net, adservice.google.com.uy,https://plus.google.com/",
        "ns1.google.com, nussbaumlaw-ca.webpkgcache.com, plus.google.com, tddctx-com.webpkgcache.com,",
        "Ransomware: message.htm.com | nr-data.net [Apple Private Data Collection]",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "IP\u2019s Contacted: 192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk  antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile",
        "Alerts: clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "www.google.com/images/branding/googlelogo/1x/googlelogo, https://www.google.com/recaptcha/api.js?onload=recaptchaCallback&render=explicit&hl=",
        "www.google.com/images/branding/googlelogo/2x/googlelogo, www.google.com/images/errors/robot.png, www.google.com, www.google.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 94,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 4080,
        "URL": 11952,
        "hostname": 4638,
        "domain": 4301,
        "FileHash-MD5": 2236,
        "FileHash-SHA1": 1140,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 28384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "664 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6688e15588a794b95443b46d",
      "name": "Google Spy engine | Tracking, Malware Repository",
      "description": "www.W3.org https://www.searchw3.com/ >  ww.google.com.uy. All tags auto populated. Did not spend time documenting all as pulse is quite large. I was able to prove the the compromises are active. I will make much smaller reports.\n(Botnet Commands, Google Spy engine | Tracking, Malware Repository, Stealer, iPhone unlocker)\nSorry so sloppy and large.\nAll tags , malware families and ATT&CK mechanisms auto populated",
      "modified": "2024-08-05T02:03:31.529000",
      "created": "2024-07-06T06:16:53.461000",
      "tags": [
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "expired",
        "acceptencoding",
        "html info",
        "title home",
        "tags viewport",
        "trackers google",
        "tag manager",
        "gsddf3d2bzf",
        "historical ssl",
        "referrer",
        "december",
        "formbook",
        "round",
        "apple ios",
        "tsara brashears",
        "unlocker",
        "collection",
        "vt graph",
        "socgholish",
        "blister",
        "hacktool",
        "hiddentear",
        "gootloader",
        "agent tesla",
        "crypto",
        "installer",
        "life",
        "malware",
        "open",
        "korplug",
        "tofsee",
        "date",
        "name servers",
        "status",
        "passive dns",
        "urls",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "files",
        "no data",
        "tag count",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "heur",
        "cisco umbrella",
        "alexa top",
        "million",
        "site",
        "alexa",
        "maltiverse",
        "xcnfe",
        "safe site",
        "phishing",
        "remcos",
        "malicious",
        "miner",
        "bank",
        "agenttesla",
        "agent",
        "unknown",
        "downloader",
        "unsafe",
        "trojan",
        "detplock",
        "artemis",
        "networm",
        "win64",
        "redline stealer",
        "limerat",
        "venom rat",
        "trojanspy",
        "tld count",
        "png image",
        "jpeg image",
        "rgba",
        "exif standard",
        "tiff image",
        "pattern match",
        "ascii text",
        "united",
        "jfif",
        "sha1",
        "core",
        "general",
        "starfield",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "adobea",
        "daga",
        "as30148 sucuri",
        "td tr",
        "search",
        "span td",
        "as44273 host",
        "creation date",
        "a domains",
        "xtra",
        "meta",
        "back",
        "verdict",
        "domain",
        "aaaa",
        "as15169 google",
        "asnone united",
        "nxdomain",
        "sucuri security",
        "a li",
        "span",
        "class",
        "body",
        "sucuri website",
        "a div",
        "authority",
        "record value",
        "showing",
        "gmt content",
        "x sucuri",
        "high",
        "related pulses",
        "show",
        "guard",
        "entries",
        "win32",
        "west domains",
        "next",
        "ipv4",
        "asnone germany",
        "object",
        "com cnt",
        "dem fin",
        "gov int",
        "nav onl",
        "phy pre",
        "formbook cnc",
        "checkin",
        "found",
        "error",
        "code",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "dock",
        "execution",
        "copy",
        "xport",
        "firewall",
        "body doctype",
        "section",
        "dcrat",
        "analyzer paste",
        "iocs",
        "hostnames",
        "url https",
        "blacklist",
        "cl0p ransomware",
        "zbot",
        "malware site",
        "team memscan",
        "cl0p",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus starizona",
        "cngo daddy",
        "g2 validity",
        "subject public",
        "key info",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "as174",
        "as3257",
        "sucuri",
        "sucur2",
        "verisign",
        "whois database",
        "server",
        "registrar abuse",
        "icann whois",
        "whois status",
        "registrar iana",
        "form",
        "temple",
        "first",
        "android",
        "win32 exe",
        "html",
        "bobby fischer",
        "office open",
        "detections type",
        "name",
        "pdf dealer",
        "price list",
        "pdf my",
        "crime",
        "taiwan unknown",
        "as3462",
        "as131148 bank",
        "as21342",
        "all search",
        "otx scoreblue",
        "pulse pulses",
        "cname",
        "as22612",
        "as43350 nforce",
        "win32upatre jun",
        "expiration date",
        "hostname",
        "lowfi",
        "date hash",
        "avast avg",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jun",
        "files show",
        "registrar",
        "china unknown",
        "title",
        "file size",
        "b file",
        "detections file",
        "gzip chrome",
        "cache entry",
        "graph",
        "ip detections",
        "country",
        "domains",
        "internet domain",
        "service bs",
        "corp",
        "namecheap inc",
        "csc corporate",
        "tucows",
        "epik llc",
        "tucows domains"
      ],
      "references": [
        "https://www.searchw3.com/",
        "IP\u2019s Contacted: 192.124.249.187",
        "Ransomware: message.htm.com",
        "https://otx.alienvault.com/indicator/file/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/e590f6ad5d0a831e297ed14c29af8467085d33bb26216501b621fbe8e8eca23b",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk uses_windows_utilities",
        "Alerts: cmdline_http_link clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint",
        "Alerts: anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self",
        "Alerts: stealth_window cmdline_http_link uses_windows_utilities suspicious_command_tools dead_connect",
        "192.124.249.187",
        "Possible Fake AV Checkin Kazy/Kryptor/Cycbot Trojan Checkin BetterInstaller Win32.AdWare.iBryte.C Install Dooptroop CnC Beacon Win32/DownloadAssistant.A PUP CnC Win32.Sality-GR Checkin Win32/FlyStudio Activity W32/InstallRex.Adware Initial CnC Beacon PUP Win32/DownloadAssistant.A Checkin",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities",
        "Alerts: ransomware_file_modifications script_created_process antivm_generic_bios antivm_generic_disk enumerates_physical_drives clears_logs registry_credential_store_access infostealer_cookies recon_fingerprint suspicious_command_tools anomalous_deletefile antidebug_guardpages antisandbox_sleep dynamic_function_loading encrypted_ioc reads_self stealth_window cmdline_http_link uses_windows_utilities"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 73,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3731,
        "URL": 11926,
        "hostname": 4626,
        "domain": 4135,
        "FileHash-MD5": 1530,
        "FileHash-SHA1": 762,
        "CVE": 8,
        "SSLCertFingerprint": 20,
        "email": 8,
        "CIDR": 1
      },
      "indicator_count": 26747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 234,
      "modified_text": "664 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65eff46bdd371899ca5be7d7",
      "name": "CrypterX-gen | Video-lal.com | M. Brian Sabey \u2022 Hall Render | Rexxfield",
      "description": "Videolal results. Parked. Owner of domain has subsidiaries including Huge Domains. It's possible for attacker to post a 404 error page,  park, post it for sale, malvertize. HoneyPotBot? \n\nFireeye. A bit much. william.ballenthin@fireeye.com\t\ncontain a resource (.rsrc) section moritz.raabe@fireeye.com. Overkill. What would Scooby Doo? Scooby!? \nTarget reports opening her MacBook Pro after it was replaced by Apple. It hadn't been in use. She opened it, surprised it was on, automatically connected to a store wifi (she was home) A worker was typing away in terminal. Fought hacker for recordings app containing Jeffrey Reimers aggressions. She lost. Terrified she murdered her MacBook by drowning  & dismemberment. Big mistake. Cloned MacBook.  Clicked on links trigger malicious downloads, network & DNS issues.",
      "modified": "2024-04-11T04:01:24.166000",
      "created": "2024-03-12T06:21:31.484000",
      "tags": [
        "upatre malware",
        "rwi dtools",
        "page dow",
        "security",
        "bitfender",
        "yandex",
        "malware",
        "all octoseek",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "file score",
        "fireeye",
        "injection",
        "worm",
        "trojan",
        "network",
        "poster",
        "honeybots",
        "united",
        "unknown",
        "win32upatre mar",
        "passive dns",
        "entries",
        "ipv4",
        "body",
        "artro",
        "generic malware",
        "formbook",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "generic",
        "hostnames",
        "pattern match",
        "ascii text",
        "png image",
        "root ca",
        "file",
        "authority",
        "indicator",
        "mitre att",
        "ck id",
        "class",
        "date",
        "enterprise",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "trident",
        "as47846",
        "germany unknown",
        "as2906 netflix",
        "scan endpoints",
        "domain",
        "urls",
        "files",
        "trojanspy",
        "mozilla",
        "dynamicloader",
        "medium",
        "title",
        "ms windows",
        "head",
        "intel",
        "inetsim http",
        "delete c",
        "show",
        "winnt",
        "copy",
        "powershell",
        "write",
        "next",
        "suspicious",
        "shop",
        "graph api",
        "status",
        "join",
        "vt community",
        "api key",
        "xcitium verdict",
        "cloud",
        "contacted",
        "contacted urls",
        "ssl certificate",
        "referrer",
        "historical ssl",
        "parent domain",
        "apple ios",
        "resolutions",
        "execution",
        "hacktool",
        "outbound connection",
        "detection list",
        "blacklist"
      ],
      "references": [
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
        "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
        "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
        "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
        "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
        "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
        "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
        "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
        "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
        "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
        "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
        "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
        "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
        "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
        "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
        "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
        "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
        "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
        "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
        "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32:CrypterX-gen\\ [Trj]",
          "display_name": "Win32:CrypterX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Win32.Renos/Artro",
          "display_name": "Win32.Renos/Artro",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "I-Worm/Bagle.QE",
          "display_name": "I-Worm/Bagle.QE",
          "target": null
        },
        {
          "id": "Worm.Bagle-44",
          "display_name": "Worm.Bagle-44",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.DE",
          "display_name": "TrojanSpy:Win32/Nivdort.DE",
          "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
        },
        {
          "id": "Win.Trojan.Generic-9897526-0",
          "display_name": "Win.Trojan.Generic-9897526-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Knigsfot-125",
          "display_name": "Win.Trojan.Knigsfot-125",
          "target": null
        },
        {
          "id": "ALF:TrojanDownloader:Win32/Vadokrist.A",
          "display_name": "ALF:TrojanDownloader:Win32/Vadokrist.A",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-9957168-0",
          "display_name": "Win.Trojan.Generic-9957168-0",
          "target": null
        },
        {
          "id": "Win.Adware.RelevantKnowledge-9821121-0",
          "display_name": "Win.Adware.RelevantKnowledge-9821121-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1622,
        "FileHash-SHA1": 934,
        "FileHash-SHA256": 3289,
        "URL": 9605,
        "domain": 2321,
        "hostname": 2411,
        "CVE": 1,
        "email": 3
      },
      "indicator_count": 20186,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "780 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65eedf74b7bdda41057bef3e",
      "name": "Source Browse- DNS poisoning \u2022 Device CnC",
      "description": "Smear + Fear campaign. Parked domain schemes.   Swatting, social engineering, crime staging/framing.  Cyber bully,  shocking, false online content, posters, porn dumping,  injection, CnC devices, master keys, break  & enter. Victim becomes the accused. Framing.  Ability to close bank accounts, skim, call, text, email collection, redirect phone calls, create botnets, engineer malware, injection,divert tax refunds, divert funds, royalties, mail erase job history, attack, hospital, CnC event, IRS audits, fake documentaries, stalkers, attackers, death threats.  MD articulated outcome after being SA'd by their employee they vowed to protect.",
      "modified": "2024-04-10T09:00:27.994000",
      "created": "2024-03-11T10:39:48.949000",
      "tags": [
        "iocs",
        "all octoseek",
        "blacklist https",
        "gmbh version",
        "legal",
        "service privacy",
        "general full",
        "reverse dns",
        "san francisco",
        "asn13335",
        "cloudflarenet",
        "cloudflare",
        "domains",
        "service privacy",
        "modernizr",
        "domainpath name",
        "migrate",
        "phishing",
        "url https",
        "united",
        "line",
        "threat",
        "paste",
        "analyze",
        "value",
        "z6s3i string",
        "a7i string",
        "y3i string",
        "e0b function",
        "x8i string",
        "source level",
        "threat analyzer",
        "urls https",
        "domain",
        "webzilla",
        "cloudflar",
        "system",
        "hostnames",
        "sample",
        "security tls",
        "ecdheecdsa",
        "resource",
        "hash",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "veryhigh",
        "limited",
        "lsalford",
        "ocomodo ca",
        "cncomodo ecc",
        "secure server",
        "olet",
        "encrypt",
        "cnlet",
        "identity search",
        "group",
        "google https",
        "expired",
        "comodo",
        "tls web",
        "log id",
        "criteria id",
        "1663014711",
        "summary leaf",
        "timestamp entry",
        "log operator",
        "error",
        "name size",
        "parent",
        "directory",
        "displays",
        "targets",
        "smartfolder",
        "frame",
        "bookmarks",
        "splitcount",
        "nib files",
        "design",
        "boundsstr",
        "rows",
        "source browser",
        "ruby logo",
        "license",
        "python",
        "python software",
        "foundation",
        "apple inc",
        "php logo",
        "visit",
        "valid",
        "no na",
        "no no",
        "ip security",
        "ca id",
        "research group",
        "cnisrg root",
        "mozilla",
        "android",
        "binrm",
        "targetdisk",
        "create",
        "crlcachedir",
        "makefile",
        "dstroot",
        "keychainssrc",
        "srcroot",
        "crl cache",
        "install",
        "ev server",
        "authentication",
        "subject",
        "digicert https",
        "sectigo https",
        "certificate",
        "ca limited",
        "salford",
        "greater",
        "key usage",
        "access",
        "ca issuers",
        "ocsp",
        "x509v3 subject",
        "lets",
        "identifier",
        "411260982",
        "poison",
        "search",
        "status page",
        "impressum",
        "protocol h2",
        "main",
        "framing",
        "geoip",
        "as13335",
        "centos",
        "as32244",
        "liquidweb",
        "redirect",
        "as16509",
        "as133618",
        "z6s3i y3i",
        "as62597",
        "france unknown",
        "showing",
        "link",
        "z6s3i",
        "date",
        "unknown",
        "meta",
        "sha256",
        "google safe",
        "browsing",
        "hostname",
        "samples",
        "td td",
        "tr tr",
        "a td",
        "a domains",
        "passive dns",
        "a th",
        "urls",
        "as50295 triple",
        "triple mirrors",
        "contact",
        "moved",
        "show",
        "accept",
        "body",
        "microsoft",
        "e4609l",
        "urls http",
        "yoa https",
        "url http",
        "scan endpoints",
        "report spam",
        "created",
        "weeks ago",
        "pulse",
        "brashears",
        "xvideos",
        "capture",
        "expiration",
        "no expiration",
        "entries",
        "status",
        "as58110 ip",
        "for privacy",
        "aaaa",
        "creation date",
        "domain name",
        "germany unknown",
        "bq mar",
        "ipv4",
        "pulse pulses",
        "files",
        "artro",
        "files domain",
        "files related",
        "pulses otx",
        "pulses",
        "tags",
        "servers",
        "record value",
        "body doctype",
        "html public",
        "macintosh",
        "intel mac",
        "os x",
        "technology",
        "dns replication",
        "email",
        "server",
        "registrar abuse",
        "dnssec",
        "expiration date",
        "registrar iana",
        "admin country",
        "tech country",
        "registry admin",
        "url text",
        "facebook url",
        "google url",
        "google",
        "software",
        "asn15169",
        "ip https",
        "february",
        "request chain",
        "http",
        "referer",
        "aes128gcm",
        "pragma",
        "frankfurt",
        "germany",
        "asn213250",
        "itpsolutions",
        "full url",
        "software caddy",
        "express",
        "ubuntu",
        "as14061",
        "digitaloceanasn",
        "address as",
        "april",
        "facebook",
        "march",
        "hashes",
        "ip address",
        "as autonomous",
        "fastly",
        "packet",
        "kb script",
        "b script",
        "october",
        "resource path",
        "size",
        "type mimetype",
        "redirect chain",
        "kb image",
        "b image",
        "cname",
        "as32244 liquid",
        "trojan",
        "high",
        "yara rule",
        "sniffs",
        "windows",
        "anomalous file",
        "medium",
        "guard",
        "filehash",
        "js user",
        "python connection",
        "brian sabey",
        "smithtech",
        "rexxfield",
        "connect facebook",
        "open",
        "emails",
        "next",
        "ssl certificate",
        "contacted",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "execution",
        "whois whois",
        "contacted urls",
        "linkid69157 url",
        "formbook",
        "spyware",
        "generic malware",
        "tag count",
        "sat jul",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "generic",
        "alerts",
        "icmp traffic",
        "cust exe",
        "depot tech",
        "office depot",
        "tech",
        "customer client",
        "june",
        "copy",
        "network_icmp",
        "inject-x64.exe",
        "tsara brashears",
        "apple ios",
        "hacktool",
        "download",
        "malware",
        "relic",
        "monitoring",
        "tofsee",
        "https://otx.alienvault.com/pulse/65acace20c18a7d6c5da2e27",
        "darklivity",
        "hijacker",
        "remote attackers",
        "cybercrime",
        "fear factor",
        "criminal gang",
        "jeffrey reimer",
        "miles it",
        "history killer",
        "apple",
        "apple control",
        "sreredrum",
        "men",
        "man",
        "hit"
      ],
      "references": [
        "videolal.com [Exploitation for privilege - Turns victim into target then spys, smears, embeds pornography in devices]",
        "videolal.com was first found hosted : https://rexxfield.com/ | https://crt.sh/?id=410492573 | https://crt.sh/?id=411260982",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/michael.pbxuser.auto.html",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/security_certificates.xcode/project.pbxproj.auto.html",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/roots/",
        "https://crt.sh/?q=videolal.com",
        "https://opensource.apple.com/source/security_certificates/security_certificates-2/Makefile.auto.html",
        "https://opensource.apple.com/source/security_certificates/",
        "https://crt.sh/?q=videolal.com",
        "https://crt.sh/?graph=410492573&opt=nometadata",
        "https://crt.sh/?spkisha256=2c5ef644a15ed2d591aee707a125b2870da480a0bc16d78022a311c93aca5b15",
        "Tracey Richter smear included Brashears: http://video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "Tracey Richter smear:  video-lal.com/videos/diabolical-sentencing.html",
        "Tracey Richter smear:  video-lal.com/video/26kiRlUTTmGzje2/diabolical-women-tracey-richter-s1-e2?cpc=n",
        "Tracey Richter smear: video-lal.com/video/fbcwPGTSo5lrA7e/tracey-richter-documentary?cpc=no",
        "Malware hosting: http://videolan.mirror.triple-it.nl/vlc-android/3.0.4/VLC-Android-3.0.4-ARMv7.apk",
        "video-lal.com/videos/sandra-richter-video.html",
        "Denver Attorney Frank Azar Smear: video-lal.com/videos/sherryce-emery-frank-azar-&-associates.html",
        "Brashears smear: video-lal.com/videos/tsara-brashears-dead-by-daylight.html",
        "http://tx-p2p-pull.video-voip.com.dorm.com/Accept-Language",
        "Crazy: video-lal.com/videos/michael-roberts.html",
        "https://urlscan.io/screenshots/e40cd846-7c34-45a5-9f79-fea139f5b1ee.png",
        "http://secure.applegiftcard.com \u2022 199.59.243.224: http://tx-p2p-pull.video-voip.com.dorm.com \u2022 199.59.243.224: http://wpad.dorm.com",
        "notonmytrack.info \u2022 http://notonmytrack.info \u2022 https://pochta-rf.ru/track74157857 \u2022 patch-tracker.gnewsense.org \u2022 mysql.snore.co",
        "Darren Meade: https://urlscan.io/result/e5f1d6fe-036e-4291-8595-0a33e5dacba5/#behaviour \u2022 alleged partner turned enemy of Michael Roberts",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe | smithsthermopadtool.com",
        "http://usb.smithtech.us/projects/downloads/shortcutcreator4u3-setup.exe \u2022",
        "Unclear given names authentic. Michael Roberts, Darren Mitchell Meade , M. Brian Sabey could be used interchangeably. Black hats w/pseudonyms.",
        "Smith tech may refer to Det. Ben Smith. HallRender; a media company, producing nonsensical, albeit convincing evidence of deeply fake content.",
        "Possibly false names given by individual involved. Brian Sabey Hall Render | Michael Roberts Rexxfield |  Darren Meade former partner of Roberts",
        "Responsible reopening Richter case via alleged Detective Ben Smith | Names Below  linked to porn spewing Videolan , Videolal, Video-lal (Honeypots?) |",
        "http://www.hallrender.com/attorney/brian-sabey |",
        "Sabey: https://www.google.com/search?q=tsara+brashears&client=ms-android-tmus-us-rvc3&sca_esv=52c806ab62ec5c59&cs=1&prmd=inv&filter=0&biw=347&bih=710&dpr=2.08#ip=1",
        "https://www.hallrender.com/attorney/brian-sabey",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-150x150.png | www.hallrender.com | rexxfield.com",
        "http://usb.smithtech.us  \u2022 http://usb.smithtech.us/apps/downloads/NSISPortable.exe \u2022 http://usb.smithtech.us/apps/downloads/xplorer2.lite.portable.exe",
        "http://usb.smithtech.us/projects/downloads/\u2022 http://usb.smithtech.us/projects/downloads/psu.exe \u2022 smithsthermopadtool.com",
        "servicer.mgid.com \u2022 http://iv-u15.com/imbd-104-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-\u00e5\u00a4\u008f\u00e5\u00b0\u2018\u00e5\u00a5\u00b3-\u00e9\u00bb\u2019\u00e5\u00ae\u00ae\u00e3\u201a\u0152\u00e3\u0081\u201e-blu-ray \u2022 https://load77.exelator.com/pixel.gif",
        "brain-portal.net",
        "303 Status. Ide redirect from: https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
        "https://otx.alienvault.com/pulse/64d018ee4623e8fcd386c2e1",
        "https://otx.alienvault.com/pulse/65418472eb20b10ee5510fde",
        "https://otx.alienvault.com/pulse/64d65255c80d866add600bac",
        "https://otx.alienvault.com/pulse/65204565ac1e8bce4de26df3",
        "https://otx.alienvault.com/pulse/64cf438a574eae18716e5954",
        "https://otx.alienvault.com/pulse/65a342310ab3d2c69778d608",
        "Refuses to remove target from adult content \"tagging\""
      ],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "Australia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Win.Malware.Farfli-6824119-0",
          "display_name": "Win.Malware.Farfli-6824119-0",
          "target": null
        },
        {
          "id": "Win32:TrojanX-Gen[Trj]",
          "display_name": "Win32:TrojanX-Gen[Trj]",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1049",
          "name": "System Network Connections Discovery",
          "display_name": "T1049 - System Network Connections Discovery"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1574.006",
          "name": "Dynamic Linker Hijacking",
          "display_name": "T1574.006 - Dynamic Linker Hijacking"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1602.002",
          "name": "Network Device Configuration Dump",
          "display_name": "T1602.002 - Network Device Configuration Dump"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1156",
          "name": "Malicious Shell Modification",
          "display_name": "T1156 - Malicious Shell Modification"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5328,
        "domain": 2339,
        "hostname": 2434,
        "FileHash-MD5": 1210,
        "FileHash-SHA1": 721,
        "FileHash-SHA256": 2784,
        "SSLCertFingerprint": 5,
        "CVE": 2,
        "URI": 2,
        "email": 10,
        "CIDR": 3
      },
      "indicator_count": 14838,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "iptvmove.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "iptvmove.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780265162.6139493
}