{ "type": "Domain", "indicator": "lvlobkn.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/lvlobkn.com", "alexa": "http://www.alexa.com/siteinfo/lvlobkn.com", "indicator": "lvlobkn.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 143763588, "indicator": "lvlobkn.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69b7e41cea9a02da720fb5e8", "name": "CAPE Sandbox - DANGEROUS", "description": "", "modified": "2026-04-15T11:06:33.668000", "created": "2026-03-16T11:06:04.308000", "tags": [ "default", "shell folders", "parent pid", "full path", "command line", "inprocserver32", "k netsvcs", "wilerror03", "s storsvc", "k localservice" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659324&Signature=gTuWu7RcJi%2BzCiZU39tet0p%2FzZeheXngobZ2YJCk66DMEFWx0p6hnTCac0tEz9Bgs5BO6w1FQVTifbAjCTfJKJNLr%2FfVK57dEYQ6t%2FnGF%2FIvBHNQLHn%2Fzi490goABAyoYRVnvUmrXE2Ra98l%2FyCsoR2LcrF5zJ1sJ5J%2FS08d64060NOWS5GHBhi3oQ5R2SwBXRpnnHzCzvk4E7y8sINnhPH4TDS%2Fr5DYdf7%2Bb4g%2B" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 16, "domain": 1072, "hostname": 44 }, "indicator_count": 1156, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e41e5d98bcba695df0f3", "name": "CAPE Sandbox - DANGEROUS", "description": "", "modified": "2026-04-15T11:06:33.668000", "created": "2026-03-16T11:06:06.957000", "tags": [ "default", "shell folders", "parent pid", "full path", "command line", "inprocserver32", "k netsvcs", "wilerror03", "s storsvc", "k localservice" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659324&Signature=gTuWu7RcJi%2BzCiZU39tet0p%2FzZeheXngobZ2YJCk66DMEFWx0p6hnTCac0tEz9Bgs5BO6w1FQVTifbAjCTfJKJNLr%2FfVK57dEYQ6t%2FnGF%2FIvBHNQLHn%2Fzi490goABAyoYRVnvUmrXE2Ra98l%2FyCsoR2LcrF5zJ1sJ5J%2FS08d64060NOWS5GHBhi3oQ5R2SwBXRpnnHzCzvk4E7y8sINnhPH4TDS%2Fr5DYdf7%2Bb4g%2B" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 17, "domain": 1072, "hostname": 44 }, "indicator_count": 1157, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47d641141851768ab1a", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:41.085000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 10, "domain": 95, "hostname": 8 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47de441c57d5226111a", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:41.803000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 11, "domain": 95, "hostname": 8 }, "indicator_count": 122, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47eccf2f0eed9305d83", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:42.549000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 10, "domain": 95, "hostname": 8 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643e604105bff849b25b0a64", "name": "[2023-04-18] Domain generation algorithm List", "description": "test publication of indicators", "modified": "2023-04-18T09:22:51.891000", "created": "2023-04-18T09:17:53.943000", "tags": [ "fobber" ], "references": [ "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2203, "domain": 30756, "FileHash-MD5": 110 }, "indicator_count": 33069, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "1140 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK", "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659324&Signature=gTuWu7RcJi%2BzCiZU39tet0p%2FzZeheXngobZ2YJCk66DMEFWx0p6hnTCac0tEz9Bgs5BO6w1FQVTifbAjCTfJKJNLr%2FfVK57dEYQ6t%2FnGF%2FIvBHNQLHn%2Fzi490goABAyoYRVnvUmrXE2Ra98l%2FyCsoR2LcrF5zJ1sJ5J%2FS08d64060NOWS5GHBhi3oQ5R2SwBXRpnnHzCzvk4E7y8sINnhPH4TDS%2Fr5DYdf7%2Bb4g%2B", "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69b7e41cea9a02da720fb5e8", "name": "CAPE Sandbox - DANGEROUS", "description": "", "modified": "2026-04-15T11:06:33.668000", "created": "2026-03-16T11:06:04.308000", "tags": [ "default", "shell folders", "parent pid", "full path", "command line", "inprocserver32", "k netsvcs", "wilerror03", "s storsvc", "k localservice" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659324&Signature=gTuWu7RcJi%2BzCiZU39tet0p%2FzZeheXngobZ2YJCk66DMEFWx0p6hnTCac0tEz9Bgs5BO6w1FQVTifbAjCTfJKJNLr%2FfVK57dEYQ6t%2FnGF%2FIvBHNQLHn%2Fzi490goABAyoYRVnvUmrXE2Ra98l%2FyCsoR2LcrF5zJ1sJ5J%2FS08d64060NOWS5GHBhi3oQ5R2SwBXRpnnHzCzvk4E7y8sINnhPH4TDS%2Fr5DYdf7%2Bb4g%2B" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 16, "domain": 1072, "hostname": 44 }, "indicator_count": 1156, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e41e5d98bcba695df0f3", "name": "CAPE Sandbox - DANGEROUS", "description": "", "modified": "2026-04-15T11:06:33.668000", "created": "2026-03-16T11:06:06.957000", "tags": [ "default", "shell folders", "parent pid", "full path", "command line", "inprocserver32", "k netsvcs", "wilerror03", "s storsvc", "k localservice" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659324&Signature=gTuWu7RcJi%2BzCiZU39tet0p%2FzZeheXngobZ2YJCk66DMEFWx0p6hnTCac0tEz9Bgs5BO6w1FQVTifbAjCTfJKJNLr%2FfVK57dEYQ6t%2FnGF%2FIvBHNQLHn%2Fzi490goABAyoYRVnvUmrXE2Ra98l%2FyCsoR2LcrF5zJ1sJ5J%2FS08d64060NOWS5GHBhi3oQ5R2SwBXRpnnHzCzvk4E7y8sINnhPH4TDS%2Fr5DYdf7%2Bb4g%2B" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 8, "FileHash-SHA1": 8, "FileHash-SHA256": 8, "URL": 17, "domain": 1072, "hostname": 44 }, "indicator_count": 1157, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47d641141851768ab1a", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:41.085000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 10, "domain": 95, "hostname": 8 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47de441c57d5226111a", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:41.803000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 11, "domain": 95, "hostname": 8 }, "indicator_count": 122, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b7e47eccf2f0eed9305d83", "name": "VirusTotal report for file.exe 100/100 Malicious", "description": "Malicious: MZ.exe, a PE32 executable for MS Windows, is being investigated by the University of California, Berkeley, and the Department of Defense (DPC) in the US.", "modified": "2026-04-15T00:16:48.010000", "created": "2026-03-16T11:07:42.549000", "tags": [ "performs dns", "file type", "creates", "sigma", "suricata ids", "united", "shadow copy", "deletes", "ip address", "downloads", "window", "defender", "malicious", "persistence", "next" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/00a56d8d3171989dc2aa4c00b0595060a60072dd2a6352123e2c27e51735a3c7_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773659403&Signature=QJMYrJ%2FbZyUR%2FnXCFejuSKApxsi%2Baqbz3LQY0Zf%2BGRA%2FCJAReaZzynjUjdff8AvTdMwy%2BSlqO51qtGljyJi2xTjJwTibTeY9x8BDM2%2Fg1klYPQAx2WEL%2FBRcHfHwvjM0rC5aEGHepSAFknzLxU7anJ6MOKJ9jCuvkGHJTDLnrg4A0V1KL0h3bvXONdJAQgz3pmFcKi6Ky9MEKYGldmfaa6B9BXAhJHLfeQ2ARXhuM9XyhZdVdlxWpK" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1091", "name": "Replication Through Removable Media", "display_name": "T1091 - Replication Through Removable Media" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 6, "URL": 10, "domain": 95, "hostname": 8 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 65, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643e604105bff849b25b0a64", "name": "[2023-04-18] Domain generation algorithm List", "description": "test publication of indicators", "modified": "2023-04-18T09:22:51.891000", "created": "2023-04-18T09:17:53.943000", "tags": [ "fobber" ], "references": [ "https://1275.ru/spisok-aktivnyh-dga-domain-generation-algorithm-domenov/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Gnostis", "id": "44738", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_44738/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2203, "domain": 30756, "FileHash-MD5": 110 }, "indicator_count": 33069, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "1140 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "lvlobkn.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "lvlobkn.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780351194.2641308 }