{
  "type": "Domain",
  "indicator": "onlinesoft.space",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/onlinesoft.space",
    "alexa": "http://www.alexa.com/siteinfo/onlinesoft.space",
    "indicator": "onlinesoft.space",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2225893,
      "indicator": "onlinesoft.space",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "58906402c435af366d5e8835",
          "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
          "description": "DustySky is a campaign which others have attributed to the Gaza Cybergang group, a group that targets government interests in the region.\nThe initial infection vector in this attack is not clear, but it results in installing the \u201cDowneks\u201d downloader, which in turn infects the victim computer with the \u201cQuasar\u201d RAT.\n\nDowneks uses third party websites to determine the external IP of the victim machine, possibly to determine victim location with GeoIP. It also drops decoy documents in an attempt to camouflage the attack.\n\nQuasar is a .NET Framework-based open-source RAT. The attackers invested significant effort in attempting to hide the tool by changing the source code of the RAT and the RAT server, and by using an obfuscator and packer.",
          "modified": "2017-01-31T10:16:33.856000",
          "created": "2017-01-31T10:16:33.856000",
          "tags": [
            "Downeks",
            "Quasar",
            "rat",
            "remote access tool",
            "DustySky",
            "unit42"
          ],
          "references": [
            "http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/"
          ],
          "public": 1,
          "adversary": "Gaza Cybergang",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "government"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 52,
          "upvotes_count": 1.0,
          "downvotes_count": 0.0,
          "votes_count": 1.0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 101,
            "domain": 14,
            "hostname": 20
          },
          "indicator_count": 135,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386576,
          "modified_text": "3407 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "652fd1d09a8174c23bd308aa",
          "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
          "description": "",
          "modified": "2023-10-18T12:38:40.078000",
          "created": "2023-10-18T12:38:40.078000",
          "tags": [
            "downeks",
            "dustysky",
            "rat server",
            "gaza cybergang"
          ],
          "references": [
            "https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/",
            "New Text Document.txt"
          ],
          "public": 1,
          "adversary": "Gaza Cybergang",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Quasar\u201d",
              "display_name": "Quasar\u201d",
              "target": null
            },
            {
              "id": "Quasar Code",
              "display_name": "Quasar Code",
              "target": null
            },
            {
              "id": "SHA256",
              "display_name": "SHA256",
              "target": null
            },
            {
              "id": "Downeks",
              "display_name": "Downeks",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1104",
              "name": "Multi-Stage Channels",
              "display_name": "T1104 - Multi-Stage Channels"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6528c2481a29b470a69eeaaa",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 89,
            "FileHash-SHA1": 89,
            "FileHash-SHA256": 101,
            "domain": 14,
            "hostname": 10
          },
          "indicator_count": 303,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 276,
          "modified_text": "956 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6528c2481a29b470a69eeaaa",
          "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
          "description": "Unit 42 researchers have published their analysis of the Downeks RAT used in recent targeted attacks against governments in Gaza and the Middle East, as well as a report from Palo Alto Networks in Japan.",
          "modified": "2023-10-13T04:06:32.060000",
          "created": "2023-10-13T04:06:32.060000",
          "tags": [
            "downeks",
            "dustysky",
            "rat server",
            "gaza cybergang"
          ],
          "references": [
            "https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/",
            "New Text Document.txt"
          ],
          "public": 1,
          "adversary": "Gaza Cybergang",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Quasar\u201d",
              "display_name": "Quasar\u201d",
              "target": null
            },
            {
              "id": "Quasar Code",
              "display_name": "Quasar Code",
              "target": null
            },
            {
              "id": "SHA256",
              "display_name": "SHA256",
              "target": null
            },
            {
              "id": "Downeks",
              "display_name": "Downeks",
              "target": null
            },
            {
              "id": "Quasar",
              "display_name": "Quasar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1104",
              "name": "Multi-Stage Channels",
              "display_name": "T1104 - Multi-Stage Channels"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1127",
              "name": "Trusted Developer Utilities Proxy Execution",
              "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tr2222200",
            "id": "207905",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 89,
            "FileHash-SHA1": 89,
            "FileHash-SHA256": 101,
            "domain": 14,
            "hostname": 10
          },
          "indicator_count": 303,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 187,
          "modified_text": "961 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62b00ed09599b17422a32668",
          "name": "NewDom-3-20220620",
          "description": "ICANN-Dom",
          "modified": "2022-08-04T00:01:35.847000",
          "created": "2022-06-20T06:08:16.567000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 202,
          "modified_text": "1396 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "62aed50702f7d366cd8e5e16",
          "name": "NewDom-3-20220619",
          "description": "ICANN-Dom",
          "modified": "2022-08-03T00:05:10.569000",
          "created": "2022-06-19T07:49:27.438000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 202,
          "modified_text": "1397 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        }
      ],
      "references": [
        "New Text Document.txt",
        "http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/",
        "https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/"
      ],
      "related": {
        "alienvault": {
          "adversary": [
            "Gaza Cybergang"
          ],
          "malware_families": [],
          "industries": [
            "Government"
          ]
        },
        "other": {
          "adversary": [
            "Gaza Cybergang"
          ],
          "malware_families": [
            "Quasar",
            "Quasar\u201d",
            "Sha256",
            "Downeks",
            "Quasar code"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "58906402c435af366d5e8835",
      "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
      "description": "DustySky is a campaign which others have attributed to the Gaza Cybergang group, a group that targets government interests in the region.\nThe initial infection vector in this attack is not clear, but it results in installing the \u201cDowneks\u201d downloader, which in turn infects the victim computer with the \u201cQuasar\u201d RAT.\n\nDowneks uses third party websites to determine the external IP of the victim machine, possibly to determine victim location with GeoIP. It also drops decoy documents in an attempt to camouflage the attack.\n\nQuasar is a .NET Framework-based open-source RAT. The attackers invested significant effort in attempting to hide the tool by changing the source code of the RAT and the RAT server, and by using an obfuscator and packer.",
      "modified": "2017-01-31T10:16:33.856000",
      "created": "2017-01-31T10:16:33.856000",
      "tags": [
        "Downeks",
        "Quasar",
        "rat",
        "remote access tool",
        "DustySky",
        "unit42"
      ],
      "references": [
        "http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/"
      ],
      "public": 1,
      "adversary": "Gaza Cybergang",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "government"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 52,
      "upvotes_count": 1.0,
      "downvotes_count": 0.0,
      "votes_count": 1.0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 101,
        "domain": 14,
        "hostname": 20
      },
      "indicator_count": 135,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386576,
      "modified_text": "3407 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "652fd1d09a8174c23bd308aa",
      "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
      "description": "",
      "modified": "2023-10-18T12:38:40.078000",
      "created": "2023-10-18T12:38:40.078000",
      "tags": [
        "downeks",
        "dustysky",
        "rat server",
        "gaza cybergang"
      ],
      "references": [
        "https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/",
        "New Text Document.txt"
      ],
      "public": 1,
      "adversary": "Gaza Cybergang",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Quasar\u201d",
          "display_name": "Quasar\u201d",
          "target": null
        },
        {
          "id": "Quasar Code",
          "display_name": "Quasar Code",
          "target": null
        },
        {
          "id": "SHA256",
          "display_name": "SHA256",
          "target": null
        },
        {
          "id": "Downeks",
          "display_name": "Downeks",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1104",
          "name": "Multi-Stage Channels",
          "display_name": "T1104 - Multi-Stage Channels"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6528c2481a29b470a69eeaaa",
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 89,
        "FileHash-SHA1": 89,
        "FileHash-SHA256": 101,
        "domain": 14,
        "hostname": 10
      },
      "indicator_count": 303,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 276,
      "modified_text": "956 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6528c2481a29b470a69eeaaa",
      "name": "Downeks and Quasar RAT Used in Recent Targeted Attacks Against Governments",
      "description": "Unit 42 researchers have published their analysis of the Downeks RAT used in recent targeted attacks against governments in Gaza and the Middle East, as well as a report from Palo Alto Networks in Japan.",
      "modified": "2023-10-13T04:06:32.060000",
      "created": "2023-10-13T04:06:32.060000",
      "tags": [
        "downeks",
        "dustysky",
        "rat server",
        "gaza cybergang"
      ],
      "references": [
        "https://unit42.paloaltonetworks.com/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments/",
        "New Text Document.txt"
      ],
      "public": 1,
      "adversary": "Gaza Cybergang",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Quasar\u201d",
          "display_name": "Quasar\u201d",
          "target": null
        },
        {
          "id": "Quasar Code",
          "display_name": "Quasar Code",
          "target": null
        },
        {
          "id": "SHA256",
          "display_name": "SHA256",
          "target": null
        },
        {
          "id": "Downeks",
          "display_name": "Downeks",
          "target": null
        },
        {
          "id": "Quasar",
          "display_name": "Quasar",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1104",
          "name": "Multi-Stage Channels",
          "display_name": "T1104 - Multi-Stage Channels"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1127",
          "name": "Trusted Developer Utilities Proxy Execution",
          "display_name": "T1127 - Trusted Developer Utilities Proxy Execution"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "tr2222200",
        "id": "207905",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 89,
        "FileHash-SHA1": 89,
        "FileHash-SHA256": 101,
        "domain": 14,
        "hostname": 10
      },
      "indicator_count": 303,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 187,
      "modified_text": "961 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62b00ed09599b17422a32668",
      "name": "NewDom-3-20220620",
      "description": "ICANN-Dom",
      "modified": "2022-08-04T00:01:35.847000",
      "created": "2022-06-20T06:08:16.567000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ZENDataGELowC",
        "id": "152785",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 202,
      "modified_text": "1396 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    },
    {
      "id": "62aed50702f7d366cd8e5e16",
      "name": "NewDom-3-20220619",
      "description": "ICANN-Dom",
      "modified": "2022-08-03T00:05:10.569000",
      "created": "2022-06-19T07:49:27.438000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ZENDataGELowC",
        "id": "152785",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 202,
      "modified_text": "1397 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "onlinesoft.space",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "onlinesoft.space",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780245592.7380836
}