{
  "type": "Domain",
  "indicator": "pbcom.com.ph",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/pbcom.com.ph",
    "alexa": "http://www.alexa.com/siteinfo/pbcom.com.ph",
    "indicator": "pbcom.com.ph",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3383299980,
      "indicator": "pbcom.com.ph",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "65c012b5e56cc9474ebb701f",
          "name": "Cyber espionage & Ransomware attacks spread via Phone calls",
          "description": "Very strange and critical occurrences of businesses, healthcare facilities and individuals becoming part of a botnet and hacking attack when call connects with certain individuals. Healthcare facilities may be spreading this very critical vulnerability.  Attacker has access to every device & camera of affected.\n*Smoke Loader\nSmoke Loader is a malicious bot application that can be used to load other malware.Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins.",
          "modified": "2024-03-05T22:00:26.685000",
          "created": "2024-02-04T22:41:55.432000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "execution",
            "historical ssl",
            "contacted urls",
            "whois whois",
            "zfglddkl58a url",
            "q0gpyr1balpdgpo",
            "relacionada",
            "formbook",
            "smoke loader",
            "iframe",
            "january",
            "resolutions",
            "referrer",
            "threat roundup",
            "snatch",
            "ransomware",
            "hacktool",
            "record type",
            "ttl value",
            "tsara brashears",
            "apple",
            "apple ios",
            "password bypass",
            "malware",
            "password",
            "apple phone",
            "download",
            "crypto",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "core",
            "qakbot",
            "lumma stealer",
            "ransomexx",
            "communicating",
            "el0kpmhlfz",
            "qdkxgr24yz",
            "kgs0",
            "kls0",
            "malicious",
            "phi",
            "pii",
            "dofoil",
            "worn",
            "rat",
            "network",
            "dns",
            "trojan",
            "remote",
            "phone hacking",
            "hacked by phone call",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "nginx",
            "html info",
            "information",
            "meta tags",
            "network",
            "march",
            "july",
            "september",
            "february",
            "redline stealer",
            "probe",
            "raccoonstealer",
            "no data",
            "tag count",
            "thu apr",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "asyncrat",
            "redlinestealer",
            "diamondfox",
            "first",
            "botnet command and control",
            "python connection",
            "tulach"
          ],
          "references": [
            "https://www.crccolorado.com/dr-adam-sang",
            "CS IDS Rules: MALWARE Possible Compromised Host",
            "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
            "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
            "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
            "http://www.defi-realty.com/jem9/  [phishing]",
            "http://45.159.189.105/bot/regex    [phishing | tracking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
            "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
            "https://attack.mitre.org/software/S0226/",
            "http://watchhers.net/index.php. [ data collection]",
            "remotewd.com",
            "https://remote.krogerlaw.com",
            "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
            "www.pornhub.com [password decryption]",
            "www.supernetforme.com [CnC]",
            "ddos.dnsnb8.net  [CnC]",
            "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
            "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
            "https://us-bankofamerica.com/PhoneVerification.php/",
            "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
            "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
            "http://iphones.email   [redirection chain]",
            "*Patient PII & PHI at critical risk"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Smoke Loader",
              "display_name": "Smoke Loader",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Razy",
              "display_name": "Razy",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "DangerousObject.Multi",
              "display_name": "DangerousObject.Multi",
              "target": null
            },
            {
              "id": "Trojan.Injector",
              "display_name": "Trojan.Injector",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1111",
              "name": "Two-Factor Authentication Interception",
              "display_name": "T1111 - Two-Factor Authentication Interception"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Patients"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 62,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 244,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 5468,
            "URL": 3747,
            "domain": 2512,
            "hostname": 1593,
            "CVE": 4
          },
          "indicator_count": 13805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "818 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c09e487b3899f3442aed96",
          "name": "Cyber espionage & Ransomware attacks spread via Phone call?",
          "description": "",
          "modified": "2024-03-05T22:00:26.685000",
          "created": "2024-02-05T08:37:28.774000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "execution",
            "historical ssl",
            "contacted urls",
            "whois whois",
            "zfglddkl58a url",
            "q0gpyr1balpdgpo",
            "relacionada",
            "formbook",
            "smoke loader",
            "iframe",
            "january",
            "resolutions",
            "referrer",
            "threat roundup",
            "snatch",
            "ransomware",
            "hacktool",
            "record type",
            "ttl value",
            "tsara brashears",
            "apple",
            "apple ios",
            "password bypass",
            "malware",
            "password",
            "apple phone",
            "download",
            "crypto",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "core",
            "qakbot",
            "lumma stealer",
            "ransomexx",
            "communicating",
            "el0kpmhlfz",
            "qdkxgr24yz",
            "kgs0",
            "kls0",
            "malicious",
            "phi",
            "pii",
            "dofoil",
            "worn",
            "rat",
            "network",
            "dns",
            "trojan",
            "remote",
            "phone hacking",
            "hacked by phone call",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "nginx",
            "html info",
            "information",
            "meta tags",
            "network",
            "march",
            "july",
            "september",
            "february",
            "redline stealer",
            "probe",
            "raccoonstealer",
            "no data",
            "tag count",
            "thu apr",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "asyncrat",
            "redlinestealer",
            "diamondfox",
            "first",
            "botnet command and control",
            "python connection",
            "tulach"
          ],
          "references": [
            "https://www.crccolorado.com/dr-adam-sang",
            "CS IDS Rules: MALWARE Possible Compromised Host",
            "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
            "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
            "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
            "http://www.defi-realty.com/jem9/  [phishing]",
            "http://45.159.189.105/bot/regex    [phishing | tracking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
            "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
            "https://attack.mitre.org/software/S0226/",
            "http://watchhers.net/index.php. [ data collection]",
            "remotewd.com",
            "https://remote.krogerlaw.com",
            "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
            "www.pornhub.com [password decryption]",
            "www.supernetforme.com [CnC]",
            "ddos.dnsnb8.net  [CnC]",
            "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
            "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
            "https://us-bankofamerica.com/PhoneVerification.php/",
            "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
            "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
            "http://iphones.email   [redirection chain]",
            "*Patient PII & PHI at critical risk"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Smoke Loader",
              "display_name": "Smoke Loader",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Razy",
              "display_name": "Razy",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "DangerousObject.Multi",
              "display_name": "DangerousObject.Multi",
              "target": null
            },
            {
              "id": "Trojan.Injector",
              "display_name": "Trojan.Injector",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1111",
              "name": "Two-Factor Authentication Interception",
              "display_name": "T1111 - Two-Factor Authentication Interception"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Patients"
          ],
          "TLP": "white",
          "cloned_from": "65c012b5e56cc9474ebb701f",
          "export_count": 58,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 244,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 5468,
            "URL": 3747,
            "domain": 2512,
            "hostname": 1593,
            "CVE": 4
          },
          "indicator_count": 13805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "818 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c970ef974adf44ef24c9a2",
          "name": "Cyber espionage & Ransomware attacks spread via Phone call?",
          "description": "",
          "modified": "2024-03-05T22:00:26.685000",
          "created": "2024-02-12T01:14:23.337000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "execution",
            "historical ssl",
            "contacted urls",
            "whois whois",
            "zfglddkl58a url",
            "q0gpyr1balpdgpo",
            "relacionada",
            "formbook",
            "smoke loader",
            "iframe",
            "january",
            "resolutions",
            "referrer",
            "threat roundup",
            "snatch",
            "ransomware",
            "hacktool",
            "record type",
            "ttl value",
            "tsara brashears",
            "apple",
            "apple ios",
            "password bypass",
            "malware",
            "password",
            "apple phone",
            "download",
            "crypto",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "core",
            "qakbot",
            "lumma stealer",
            "ransomexx",
            "communicating",
            "el0kpmhlfz",
            "qdkxgr24yz",
            "kgs0",
            "kls0",
            "malicious",
            "phi",
            "pii",
            "dofoil",
            "worn",
            "rat",
            "network",
            "dns",
            "trojan",
            "remote",
            "phone hacking",
            "hacked by phone call",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "nginx",
            "html info",
            "information",
            "meta tags",
            "network",
            "march",
            "july",
            "september",
            "february",
            "redline stealer",
            "probe",
            "raccoonstealer",
            "no data",
            "tag count",
            "thu apr",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "asyncrat",
            "redlinestealer",
            "diamondfox",
            "first",
            "botnet command and control",
            "python connection",
            "tulach"
          ],
          "references": [
            "https://www.crccolorado.com/dr-adam-sang",
            "CS IDS Rules: MALWARE Possible Compromised Host",
            "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
            "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
            "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
            "http://www.defi-realty.com/jem9/  [phishing]",
            "http://45.159.189.105/bot/regex    [phishing | tracking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
            "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
            "https://attack.mitre.org/software/S0226/",
            "http://watchhers.net/index.php. [ data collection]",
            "remotewd.com",
            "https://remote.krogerlaw.com",
            "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
            "www.pornhub.com [password decryption]",
            "www.supernetforme.com [CnC]",
            "ddos.dnsnb8.net  [CnC]",
            "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
            "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
            "https://us-bankofamerica.com/PhoneVerification.php/",
            "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
            "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
            "http://iphones.email   [redirection chain]",
            "*Patient PII & PHI at critical risk"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Smoke Loader",
              "display_name": "Smoke Loader",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Razy",
              "display_name": "Razy",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "DangerousObject.Multi",
              "display_name": "DangerousObject.Multi",
              "target": null
            },
            {
              "id": "Trojan.Injector",
              "display_name": "Trojan.Injector",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1111",
              "name": "Two-Factor Authentication Interception",
              "display_name": "T1111 - Two-Factor Authentication Interception"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Patients"
          ],
          "TLP": "white",
          "cloned_from": "65c09e487b3899f3442aed96",
          "export_count": 65,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 244,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 5468,
            "URL": 3747,
            "domain": 2512,
            "hostname": 1593,
            "CVE": 4
          },
          "indicator_count": 13805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "818 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e1ece3b935bda6b9d3e10b",
          "name": "Cyber espionage & Ransomware attacks spread via Phone call? II.",
          "description": "",
          "modified": "2024-03-05T22:00:26.685000",
          "created": "2024-03-01T14:57:39.828000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "execution",
            "historical ssl",
            "contacted urls",
            "whois whois",
            "zfglddkl58a url",
            "q0gpyr1balpdgpo",
            "relacionada",
            "formbook",
            "smoke loader",
            "iframe",
            "january",
            "resolutions",
            "referrer",
            "threat roundup",
            "snatch",
            "ransomware",
            "hacktool",
            "record type",
            "ttl value",
            "tsara brashears",
            "apple",
            "apple ios",
            "password bypass",
            "malware",
            "password",
            "apple phone",
            "download",
            "crypto",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "core",
            "qakbot",
            "lumma stealer",
            "ransomexx",
            "communicating",
            "el0kpmhlfz",
            "qdkxgr24yz",
            "kgs0",
            "kls0",
            "malicious",
            "phi",
            "pii",
            "dofoil",
            "worn",
            "rat",
            "network",
            "dns",
            "trojan",
            "remote",
            "phone hacking",
            "hacked by phone call",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "nginx",
            "html info",
            "information",
            "meta tags",
            "network",
            "march",
            "july",
            "september",
            "february",
            "redline stealer",
            "probe",
            "raccoonstealer",
            "no data",
            "tag count",
            "thu apr",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "asyncrat",
            "redlinestealer",
            "diamondfox",
            "first",
            "botnet command and control",
            "python connection",
            "tulach"
          ],
          "references": [
            "https://www.crccolorado.com/dr-adam-sang",
            "CS IDS Rules: MALWARE Possible Compromised Host",
            "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
            "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
            "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
            "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
            "http://www.defi-realty.com/jem9/  [phishing]",
            "http://45.159.189.105/bot/regex    [phishing | tracking]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
            "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
            "https://attack.mitre.org/software/S0226/",
            "http://watchhers.net/index.php. [ data collection]",
            "remotewd.com",
            "https://remote.krogerlaw.com",
            "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
            "www.pornhub.com [password decryption]",
            "www.supernetforme.com [CnC]",
            "ddos.dnsnb8.net  [CnC]",
            "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
            "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
            "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
            "https://us-bankofamerica.com/PhoneVerification.php/",
            "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
            "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
            "http://iphones.email   [redirection chain]",
            "*Patient PII & PHI at critical risk"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "Smoke Loader",
              "display_name": "Smoke Loader",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Qakbot",
              "display_name": "Qakbot",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Razy",
              "display_name": "Razy",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "DangerousObject.Multi",
              "display_name": "DangerousObject.Multi",
              "target": null
            },
            {
              "id": "Trojan.Injector",
              "display_name": "Trojan.Injector",
              "target": null
            },
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1111",
              "name": "Two-Factor Authentication Interception",
              "display_name": "T1111 - Two-Factor Authentication Interception"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1497.001",
              "name": "System Checks",
              "display_name": "T1497.001 - System Checks"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1059.006",
              "name": "Python",
              "display_name": "T1059.006 - Python"
            },
            {
              "id": "T1059.005",
              "name": "Visual Basic",
              "display_name": "T1059.005 - Visual Basic"
            }
          ],
          "industries": [
            "Healthcare",
            "Civil Society",
            "Patients"
          ],
          "TLP": "white",
          "cloned_from": "65c09e487b3899f3442aed96",
          "export_count": 88,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Enqrypted",
            "id": "272105",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 244,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 5468,
            "URL": 3747,
            "domain": 2512,
            "hostname": 1593,
            "CVE": 4
          },
          "indicator_count": 13805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "818 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657092f9499206cd87c73969",
          "name": "iphone",
          "description": "",
          "modified": "2023-12-06T15:27:53.981000",
          "created": "2023-12-06T15:27:53.981000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1768,
            "hostname": 808,
            "domain": 306,
            "URL": 1938,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4821,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657080e2831409d23c8d24a5",
          "name": "iMessages.app 03.01.2022",
          "description": "",
          "modified": "2023-12-06T14:10:42.459000",
          "created": "2023-12-06T14:10:42.459000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1768,
            "hostname": 808,
            "domain": 306,
            "URL": 1937,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4820,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707f3f51e635c843c1f5b9",
          "name": "www.centergate.com",
          "description": "",
          "modified": "2023-12-06T14:03:43.279000",
          "created": "2023-12-06T14:03:43.279000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "hostname": 949,
            "FileHash-SHA256": 1386,
            "URL": 2014,
            "domain": 417,
            "FileHash-MD5": 1,
            "email": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4771,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707eab85e2a9a917487148",
          "name": "Centergate.com",
          "description": "",
          "modified": "2023-12-06T14:01:15.794000",
          "created": "2023-12-06T14:01:15.794000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "hostname": 810,
            "FileHash-SHA256": 1327,
            "URL": 2177,
            "domain": 453,
            "FileHash-MD5": 1,
            "email": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4772,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6342b2b087554c9d5209b50b",
          "name": "iphone",
          "description": "",
          "modified": "2022-11-09T00:03:32.403000",
          "created": "2022-10-09T11:38:24.078000",
          "tags": [],
          "references": [
            "iMessages.app"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "622775d4f2c38a89fdd0128a",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Lazzo115",
            "id": "210949",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 306,
            "URL": 1938,
            "hostname": 808,
            "FileHash-SHA256": 1768,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4821,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 8,
          "modified_text": "1301 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "622775d4f2c38a89fdd0128a",
          "name": "iMessages.app 03.01.2022",
          "description": "",
          "modified": "2022-04-07T00:04:02.553000",
          "created": "2022-03-08T15:27:16.349000",
          "tags": [],
          "references": [
            "iMessages.app"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 306,
            "URL": 1937,
            "hostname": 808,
            "FileHash-SHA256": 1768,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4820,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1517 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6218f5b29464e15d018f8721",
          "name": "www.centergate.com",
          "description": "",
          "modified": "2022-03-27T00:00:39.057000",
          "created": "2022-02-25T15:28:50.343000",
          "tags": [
            "whois record",
            "whois",
            "ssl certificate"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransom:Win32/CVE-2017-0147.A",
              "display_name": "Ransom:Win32/CVE-2017-0147.A",
              "target": "/malware/Ransom:Win32/CVE-2017-0147.A"
            },
            {
              "id": "Win.Ransomware.WannaCry-6313787-0",
              "display_name": "Win.Ransomware.WannaCry-6313787-0",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Prorat.AZ",
              "display_name": "Backdoor:Win32/Prorat.AZ",
              "target": "/malware/Backdoor:Win32/Prorat.AZ"
            },
            {
              "id": "Win.Trojan.Prorat-45",
              "display_name": "Win.Trojan.Prorat-45",
              "target": null
            },
            {
              "id": "Win32:Agent-QJD\\ [Trj]",
              "display_name": "Win32:Agent-QJD\\ [Trj]",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 949,
            "URL": 2014,
            "domain": 417,
            "FileHash-SHA256": 1386,
            "CVE": 2,
            "FileHash-MD5": 1,
            "email": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4771,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 405,
          "modified_text": "1528 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6211ee3ffa661501f2caa803",
          "name": "Centergate.com",
          "description": "",
          "modified": "2022-03-25T00:03:52.440000",
          "created": "2022-02-20T07:31:11.659000",
          "tags": [
            "whois",
            "whois record",
            "redacted for",
            "date",
            "tucows domains",
            "server",
            "privacy tech",
            "tucows",
            "iana id",
            "registrar abuse",
            "registrar whois",
            "code",
            "win32 exe",
            "detections type",
            "name",
            "dns replication",
            "subdomains",
            "communicating",
            "files referring",
            "domain status",
            "ranks rank",
            "value ingestion",
            "time cisco",
            "umbrella",
            "utc statvoo",
            "utc alexa",
            "dns records",
            "record type",
            "submission",
            "links community",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "ip address",
            "status code",
            "body length"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2177,
            "FileHash-SHA256": 1327,
            "hostname": 810,
            "domain": 453,
            "CVE": 2,
            "email": 1,
            "FileHash-SHA1": 1,
            "FileHash-MD5": 1
          },
          "indicator_count": 4772,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 405,
          "modified_text": "1530 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "remotewd.com",
        "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
        "https://www.crccolorado.com/dr-adam-sang",
        "http://45.159.189.105/bot/regex    [phishing | tracking]",
        "https://us-bankofamerica.com/PhoneVerification.php/",
        "www.pornhub.com [password decryption]",
        "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
        "https://remote.krogerlaw.com",
        "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
        "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
        "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "iMessages.app",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://watchhers.net/index.php. [ data collection]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
        "https://attack.mitre.org/software/S0226/",
        "www.supernetforme.com [CnC]",
        "ddos.dnsnb8.net  [CnC]",
        "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
        "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
        "*Patient PII & PHI at critical risk",
        "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
        "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
        "http://www.defi-realty.com/jem9/  [phishing]",
        "http://iphones.email   [redirection chain]",
        "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
        "CS IDS Rules: MALWARE Possible Compromised Host"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Smoke loader",
            "Lumma stealer",
            "Win.trojan.prorat-45",
            "Formbook",
            "Suppobox",
            "Generic.malware",
            "Tofsee",
            "Qakbot",
            "Simda",
            "Dangerousobject.multi",
            "Backdoor:win32/prorat.az",
            "Gen:variant.zusy",
            "Trojan.injector",
            "Relic",
            "Win32:agent-qjd\\ [trj]",
            "Ransomexx",
            "Ransom:win32/cve-2017-0147.a",
            "Ransomware",
            "Hacktool",
            "Defacement",
            "Razy",
            "Win.ransomware.wannacry-6313787-0"
          ],
          "industries": [
            "Civil society",
            "Patients",
            "Healthcare"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "65c012b5e56cc9474ebb701f",
      "name": "Cyber espionage & Ransomware attacks spread via Phone calls",
      "description": "Very strange and critical occurrences of businesses, healthcare facilities and individuals becoming part of a botnet and hacking attack when call connects with certain individuals. Healthcare facilities may be spreading this very critical vulnerability.  Attacker has access to every device & camera of affected.\n*Smoke Loader\nSmoke Loader is a malicious bot application that can be used to load other malware.Smoke Loader has been seen in the wild since at least 2011 and has included a number of different payloads. It is notorious for its use of deception and self-protection. It also comes with several plug-ins.",
      "modified": "2024-03-05T22:00:26.685000",
      "created": "2024-02-04T22:41:55.432000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "execution",
        "historical ssl",
        "contacted urls",
        "whois whois",
        "zfglddkl58a url",
        "q0gpyr1balpdgpo",
        "relacionada",
        "formbook",
        "smoke loader",
        "iframe",
        "january",
        "resolutions",
        "referrer",
        "threat roundup",
        "snatch",
        "ransomware",
        "hacktool",
        "record type",
        "ttl value",
        "tsara brashears",
        "apple",
        "apple ios",
        "password bypass",
        "malware",
        "password",
        "apple phone",
        "download",
        "crypto",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "core",
        "qakbot",
        "lumma stealer",
        "ransomexx",
        "communicating",
        "el0kpmhlfz",
        "qdkxgr24yz",
        "kgs0",
        "kls0",
        "malicious",
        "phi",
        "pii",
        "dofoil",
        "worn",
        "rat",
        "network",
        "dns",
        "trojan",
        "remote",
        "phone hacking",
        "hacked by phone call",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "nginx",
        "html info",
        "information",
        "meta tags",
        "network",
        "march",
        "july",
        "september",
        "february",
        "redline stealer",
        "probe",
        "raccoonstealer",
        "no data",
        "tag count",
        "thu apr",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "asyncrat",
        "redlinestealer",
        "diamondfox",
        "first",
        "botnet command and control",
        "python connection",
        "tulach"
      ],
      "references": [
        "https://www.crccolorado.com/dr-adam-sang",
        "CS IDS Rules: MALWARE Possible Compromised Host",
        "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
        "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
        "http://www.defi-realty.com/jem9/  [phishing]",
        "http://45.159.189.105/bot/regex    [phishing | tracking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
        "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
        "https://attack.mitre.org/software/S0226/",
        "http://watchhers.net/index.php. [ data collection]",
        "remotewd.com",
        "https://remote.krogerlaw.com",
        "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
        "www.pornhub.com [password decryption]",
        "www.supernetforme.com [CnC]",
        "ddos.dnsnb8.net  [CnC]",
        "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
        "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
        "https://us-bankofamerica.com/PhoneVerification.php/",
        "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
        "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
        "http://iphones.email   [redirection chain]",
        "*Patient PII & PHI at critical risk"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Smoke Loader",
          "display_name": "Smoke Loader",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Razy",
          "display_name": "Razy",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "DangerousObject.Multi",
          "display_name": "DangerousObject.Multi",
          "target": null
        },
        {
          "id": "Trojan.Injector",
          "display_name": "Trojan.Injector",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1111",
          "name": "Two-Factor Authentication Interception",
          "display_name": "T1111 - Two-Factor Authentication Interception"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Patients"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 62,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 244,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 5468,
        "URL": 3747,
        "domain": 2512,
        "hostname": 1593,
        "CVE": 4
      },
      "indicator_count": 13805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "818 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c09e487b3899f3442aed96",
      "name": "Cyber espionage & Ransomware attacks spread via Phone call?",
      "description": "",
      "modified": "2024-03-05T22:00:26.685000",
      "created": "2024-02-05T08:37:28.774000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "execution",
        "historical ssl",
        "contacted urls",
        "whois whois",
        "zfglddkl58a url",
        "q0gpyr1balpdgpo",
        "relacionada",
        "formbook",
        "smoke loader",
        "iframe",
        "january",
        "resolutions",
        "referrer",
        "threat roundup",
        "snatch",
        "ransomware",
        "hacktool",
        "record type",
        "ttl value",
        "tsara brashears",
        "apple",
        "apple ios",
        "password bypass",
        "malware",
        "password",
        "apple phone",
        "download",
        "crypto",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "core",
        "qakbot",
        "lumma stealer",
        "ransomexx",
        "communicating",
        "el0kpmhlfz",
        "qdkxgr24yz",
        "kgs0",
        "kls0",
        "malicious",
        "phi",
        "pii",
        "dofoil",
        "worn",
        "rat",
        "network",
        "dns",
        "trojan",
        "remote",
        "phone hacking",
        "hacked by phone call",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "nginx",
        "html info",
        "information",
        "meta tags",
        "network",
        "march",
        "july",
        "september",
        "february",
        "redline stealer",
        "probe",
        "raccoonstealer",
        "no data",
        "tag count",
        "thu apr",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "asyncrat",
        "redlinestealer",
        "diamondfox",
        "first",
        "botnet command and control",
        "python connection",
        "tulach"
      ],
      "references": [
        "https://www.crccolorado.com/dr-adam-sang",
        "CS IDS Rules: MALWARE Possible Compromised Host",
        "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
        "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
        "http://www.defi-realty.com/jem9/  [phishing]",
        "http://45.159.189.105/bot/regex    [phishing | tracking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
        "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
        "https://attack.mitre.org/software/S0226/",
        "http://watchhers.net/index.php. [ data collection]",
        "remotewd.com",
        "https://remote.krogerlaw.com",
        "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
        "www.pornhub.com [password decryption]",
        "www.supernetforme.com [CnC]",
        "ddos.dnsnb8.net  [CnC]",
        "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
        "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
        "https://us-bankofamerica.com/PhoneVerification.php/",
        "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
        "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
        "http://iphones.email   [redirection chain]",
        "*Patient PII & PHI at critical risk"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Smoke Loader",
          "display_name": "Smoke Loader",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Razy",
          "display_name": "Razy",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "DangerousObject.Multi",
          "display_name": "DangerousObject.Multi",
          "target": null
        },
        {
          "id": "Trojan.Injector",
          "display_name": "Trojan.Injector",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1111",
          "name": "Two-Factor Authentication Interception",
          "display_name": "T1111 - Two-Factor Authentication Interception"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Patients"
      ],
      "TLP": "white",
      "cloned_from": "65c012b5e56cc9474ebb701f",
      "export_count": 58,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 244,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 5468,
        "URL": 3747,
        "domain": 2512,
        "hostname": 1593,
        "CVE": 4
      },
      "indicator_count": 13805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "818 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c970ef974adf44ef24c9a2",
      "name": "Cyber espionage & Ransomware attacks spread via Phone call?",
      "description": "",
      "modified": "2024-03-05T22:00:26.685000",
      "created": "2024-02-12T01:14:23.337000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "execution",
        "historical ssl",
        "contacted urls",
        "whois whois",
        "zfglddkl58a url",
        "q0gpyr1balpdgpo",
        "relacionada",
        "formbook",
        "smoke loader",
        "iframe",
        "january",
        "resolutions",
        "referrer",
        "threat roundup",
        "snatch",
        "ransomware",
        "hacktool",
        "record type",
        "ttl value",
        "tsara brashears",
        "apple",
        "apple ios",
        "password bypass",
        "malware",
        "password",
        "apple phone",
        "download",
        "crypto",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "core",
        "qakbot",
        "lumma stealer",
        "ransomexx",
        "communicating",
        "el0kpmhlfz",
        "qdkxgr24yz",
        "kgs0",
        "kls0",
        "malicious",
        "phi",
        "pii",
        "dofoil",
        "worn",
        "rat",
        "network",
        "dns",
        "trojan",
        "remote",
        "phone hacking",
        "hacked by phone call",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "nginx",
        "html info",
        "information",
        "meta tags",
        "network",
        "march",
        "july",
        "september",
        "february",
        "redline stealer",
        "probe",
        "raccoonstealer",
        "no data",
        "tag count",
        "thu apr",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "asyncrat",
        "redlinestealer",
        "diamondfox",
        "first",
        "botnet command and control",
        "python connection",
        "tulach"
      ],
      "references": [
        "https://www.crccolorado.com/dr-adam-sang",
        "CS IDS Rules: MALWARE Possible Compromised Host",
        "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
        "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
        "http://www.defi-realty.com/jem9/  [phishing]",
        "http://45.159.189.105/bot/regex    [phishing | tracking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
        "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
        "https://attack.mitre.org/software/S0226/",
        "http://watchhers.net/index.php. [ data collection]",
        "remotewd.com",
        "https://remote.krogerlaw.com",
        "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
        "www.pornhub.com [password decryption]",
        "www.supernetforme.com [CnC]",
        "ddos.dnsnb8.net  [CnC]",
        "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
        "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
        "https://us-bankofamerica.com/PhoneVerification.php/",
        "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
        "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
        "http://iphones.email   [redirection chain]",
        "*Patient PII & PHI at critical risk"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Smoke Loader",
          "display_name": "Smoke Loader",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Razy",
          "display_name": "Razy",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "DangerousObject.Multi",
          "display_name": "DangerousObject.Multi",
          "target": null
        },
        {
          "id": "Trojan.Injector",
          "display_name": "Trojan.Injector",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1111",
          "name": "Two-Factor Authentication Interception",
          "display_name": "T1111 - Two-Factor Authentication Interception"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Patients"
      ],
      "TLP": "white",
      "cloned_from": "65c09e487b3899f3442aed96",
      "export_count": 65,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 244,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 5468,
        "URL": 3747,
        "domain": 2512,
        "hostname": 1593,
        "CVE": 4
      },
      "indicator_count": 13805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "818 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65e1ece3b935bda6b9d3e10b",
      "name": "Cyber espionage & Ransomware attacks spread via Phone call? II.",
      "description": "",
      "modified": "2024-03-05T22:00:26.685000",
      "created": "2024-03-01T14:57:39.828000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "execution",
        "historical ssl",
        "contacted urls",
        "whois whois",
        "zfglddkl58a url",
        "q0gpyr1balpdgpo",
        "relacionada",
        "formbook",
        "smoke loader",
        "iframe",
        "january",
        "resolutions",
        "referrer",
        "threat roundup",
        "snatch",
        "ransomware",
        "hacktool",
        "record type",
        "ttl value",
        "tsara brashears",
        "apple",
        "apple ios",
        "password bypass",
        "malware",
        "password",
        "apple phone",
        "download",
        "crypto",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "core",
        "qakbot",
        "lumma stealer",
        "ransomexx",
        "communicating",
        "el0kpmhlfz",
        "qdkxgr24yz",
        "kgs0",
        "kls0",
        "malicious",
        "phi",
        "pii",
        "dofoil",
        "worn",
        "rat",
        "network",
        "dns",
        "trojan",
        "remote",
        "phone hacking",
        "hacked by phone call",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "nginx",
        "html info",
        "information",
        "meta tags",
        "network",
        "march",
        "july",
        "september",
        "february",
        "redline stealer",
        "probe",
        "raccoonstealer",
        "no data",
        "tag count",
        "thu apr",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "asyncrat",
        "redlinestealer",
        "diamondfox",
        "first",
        "botnet command and control",
        "python connection",
        "tulach"
      ],
      "references": [
        "https://www.crccolorado.com/dr-adam-sang",
        "CS IDS Rules: MALWARE Possible Compromised Host",
        "CS IDS Rules: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz",
        "CS IDS Rules: SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "CS IDS Rules: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses",
        "CS IDS Rules: ET AnubisNetworks Sinkhole Cookie Value btst",
        "http://www.defi-realty.com/jem9/  [phishing]",
        "http://45.159.189.105/bot/regex    [phishing | tracking]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/    [phishing | data collection| browser vulnerability]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  [password decryption]",
        "https://www.sentinelone.com/blog/going-deep-a-guide-to-reversing-smoke-loader-malware/",
        "https://attack.mitre.org/software/S0226/",
        "http://watchhers.net/index.php. [ data collection]",
        "remotewd.com",
        "https://remote.krogerlaw.com",
        "device-local-7e6b3aa6-e3de-4e8f-9213-9f15c92d1d81.remotewd.com",
        "www.pornhub.com [password decryption]",
        "www.supernetforme.com [CnC]",
        "ddos.dnsnb8.net  [CnC]",
        "http://happylifehappywife.com/wp-content/themes/theme78222/images/top-right.jpg    [phishing]",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://amaiorpascoadetodas2.com/cgi-sys/suspendedpage.cgi?smart-tv-led-55-samsung-55ru7100-ultra-hd-4k-com-conversor-digital-3-hdmi-2-usb-wi-fi-visual-livre-de-cabos-controle-remoto-%C3%9Anico-e-bluetooth-&skullid=539293743",
        "http://url7639.ascglobal-email.com/wf/open?upn=HDu-2BON2WuckNVJ2U1s3AlMizU2CbfEvFl7S9TXTdQm2nLS-2F0QX6mc4PxuUDVyCyIzMeTvJRSiC633rEV-2B8mukshW0CHiC-2FvQOWOgJR6RGOtzDWutJV4OtjBHGduMDUigvEESSJQD8KXk1UU3bXtRdyd7QpBC-2F7Ti-2Bq6tNr1C4yz-2FXcUbYvtJX4ip5d5t5eXud233BW97tdcojPu0yKWZ0Zm2DyXbj1RIwt-2FO0RcYLC7feNtrpw6OxBd8r4Tc3uHoT7Z9NFErDUBbBuYpsze-2FiBRziGeeMExS5l82Xna4au56co0IdOcfscmwGtC-2BxD3xiJW4v560wXMZQU0G9hqqPVeYTnwZwyfebBz1KLSW-2BIJtHMF6DCNHhatvrb3WM84-2BGpgCxOK1dFKPiKsmPzSc-2BdCAO9BzU3K6G7EaDYNu2cRHdGmat-2BCJs",
        "https://darkforums.me/Thread-Check-Any-Indian-Vehicle-Owner-Details-home-address-phone-number [Whoa Nelly!]",
        "https://us-bankofamerica.com/PhoneVerification.php/",
        "http://www.w3.org/TR/html4/loose.dtd | www.w3.org  [collection]",
        "http://dl.ariamobile.net/mobile/2008.10.a/applications/My_Phone-v2.01-S60v3-[wWw.Ariamobile.Net].zip",
        "http://iphones.email   [redirection chain]",
        "*Patient PII & PHI at critical risk"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "Smoke Loader",
          "display_name": "Smoke Loader",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Qakbot",
          "display_name": "Qakbot",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Razy",
          "display_name": "Razy",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "DangerousObject.Multi",
          "display_name": "DangerousObject.Multi",
          "target": null
        },
        {
          "id": "Trojan.Injector",
          "display_name": "Trojan.Injector",
          "target": null
        },
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1111",
          "name": "Two-Factor Authentication Interception",
          "display_name": "T1111 - Two-Factor Authentication Interception"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1497.001",
          "name": "System Checks",
          "display_name": "T1497.001 - System Checks"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1059.006",
          "name": "Python",
          "display_name": "T1059.006 - Python"
        },
        {
          "id": "T1059.005",
          "name": "Visual Basic",
          "display_name": "T1059.005 - Visual Basic"
        }
      ],
      "industries": [
        "Healthcare",
        "Civil Society",
        "Patients"
      ],
      "TLP": "white",
      "cloned_from": "65c09e487b3899f3442aed96",
      "export_count": 88,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Enqrypted",
        "id": "272105",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 244,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 5468,
        "URL": 3747,
        "domain": 2512,
        "hostname": 1593,
        "CVE": 4
      },
      "indicator_count": 13805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "818 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657092f9499206cd87c73969",
      "name": "iphone",
      "description": "",
      "modified": "2023-12-06T15:27:53.981000",
      "created": "2023-12-06T15:27:53.981000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1768,
        "hostname": 808,
        "domain": 306,
        "URL": 1938,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4821,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657080e2831409d23c8d24a5",
      "name": "iMessages.app 03.01.2022",
      "description": "",
      "modified": "2023-12-06T14:10:42.459000",
      "created": "2023-12-06T14:10:42.459000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1768,
        "hostname": 808,
        "domain": 306,
        "URL": 1937,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4820,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707f3f51e635c843c1f5b9",
      "name": "www.centergate.com",
      "description": "",
      "modified": "2023-12-06T14:03:43.279000",
      "created": "2023-12-06T14:03:43.279000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "hostname": 949,
        "FileHash-SHA256": 1386,
        "URL": 2014,
        "domain": 417,
        "FileHash-MD5": 1,
        "email": 1,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4771,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707eab85e2a9a917487148",
      "name": "Centergate.com",
      "description": "",
      "modified": "2023-12-06T14:01:15.794000",
      "created": "2023-12-06T14:01:15.794000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "hostname": 810,
        "FileHash-SHA256": 1327,
        "URL": 2177,
        "domain": 453,
        "FileHash-MD5": 1,
        "email": 1,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4772,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6342b2b087554c9d5209b50b",
      "name": "iphone",
      "description": "",
      "modified": "2022-11-09T00:03:32.403000",
      "created": "2022-10-09T11:38:24.078000",
      "tags": [],
      "references": [
        "iMessages.app"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "622775d4f2c38a89fdd0128a",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Lazzo115",
        "id": "210949",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 306,
        "URL": 1938,
        "hostname": 808,
        "FileHash-SHA256": 1768,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4821,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 8,
      "modified_text": "1301 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "622775d4f2c38a89fdd0128a",
      "name": "iMessages.app 03.01.2022",
      "description": "",
      "modified": "2022-04-07T00:04:02.553000",
      "created": "2022-03-08T15:27:16.349000",
      "tags": [],
      "references": [
        "iMessages.app"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 306,
        "URL": 1937,
        "hostname": 808,
        "FileHash-SHA256": 1768,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4820,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 407,
      "modified_text": "1517 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "pbcom.com.ph",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "pbcom.com.ph",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780373801.8937964
}