{
  "type": "Domain",
  "indicator": "polldev.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/polldev.com",
    "alexa": "http://www.alexa.com/siteinfo/polldev.com",
    "indicator": "polldev.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4085482340,
      "indicator": "polldev.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "69decb6dd1bd6da78fc72d0a",
          "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED",
          "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.",
          "modified": "2026-04-14T23:19:09.495000",
          "created": "2026-04-14T23:19:09.495000",
          "tags": [
            "united",
            "aaaa",
            "certificate",
            "error",
            "read c",
            "rgba",
            "unicode",
            "memcommit",
            "delete",
            "dock",
            "execution",
            "command decode",
            "suricata ipv4",
            "suricata tcpv4",
            "flag",
            "localappdata",
            "windir",
            "openurl c",
            "programfiles",
            "suricata udpv4",
            "win64",
            "click",
            "strings",
            "anon",
            "username",
            "userprofile",
            "mitre att",
            "ck id",
            "ck matrix",
            "appdata",
            "comspec",
            "model",
            "path",
            "april",
            "hybrid",
            "general",
            "learn",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ck techniques",
            "mtb apr",
            "exploit",
            "trojan",
            "backdoor",
            "please",
            "x msedge",
            "all ipv4",
            "ransom",
            "date hash",
            "avast avg",
            "win32orbus apr",
            "dynamicloader",
            "yara rule",
            "high",
            "tofsee",
            "rndhex",
            "rndchar",
            "loaderid",
            "lidfileupd",
            "localcfg",
            "write",
            "stream",
            "push",
            "mtb alerts",
            "ee fc",
            "ff d5",
            "lredmond",
            "malware",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "yara detections",
            "av detections",
            "ids detections",
            "hostile",
            "unknown",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "stop data",
            "typ url",
            "url data",
            "typ no",
            "th all",
            "stop",
            "port",
            "destination",
            "ds detections",
            "tls sni",
            "nrv2x",
            "upxoepplace",
            "alerts",
            "contacted",
            "markus",
            "hostile alerts",
            "less see",
            "all ip",
            "tulach",
            "brian sabey",
            "quasi",
            "link",
            "script urls",
            "record value",
            "script domains",
            "fireeye",
            "create c",
            "as15169",
            "next",
            "all url",
            "http",
            "related pulses",
            "related tags",
            "google safe",
            "code",
            "y se",
            "included review",
            "io excluded",
            "suggeste",
            "ipv4",
            "unknown ns",
            "redacted admin",
            "fax redacted",
            "name redacted",
            "phone redacted",
            "code redacted",
            "redacted tech",
            "christopher ahmann",
            "solarwinds like?"
          ],
          "references": [
            "asp.net \u2022 cdnsrc.asp.net",
            "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
            "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
            "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
            "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
            "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
            "www.fireeye.com",
            "danilovstyle.ru",
            "ns4-04.azure-dns.info",
            "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
            "www.fireeye.com .",
            "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
            "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
            "Tulach\u2019s ASP.Net Open Source destruction"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
              "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
              "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB"
            },
            {
              "id": "Win.Ransomware.Tofsee-10015002",
              "display_name": "Win.Ransomware.Tofsee-10015002",
              "target": null
            },
            {
              "id": "Trojan:Win32/Comisproc!gmb I",
              "display_name": "Trojan:Win32/Comisproc!gmb I",
              "target": "/malware/Trojan:Win32/Comisproc!gmb I"
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1132.001",
              "name": "Standard Encoding",
              "display_name": "T1132.001 - Standard Encoding"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1518.001",
              "name": "Security Software Discovery",
              "display_name": "T1518.001 - Security Software Discovery"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 88,
            "FileHash-MD5": 211,
            "FileHash-SHA1": 186,
            "FileHash-SHA256": 1366,
            "URL": 1848,
            "domain": 418,
            "email": 4,
            "hostname": 622,
            "SSLCertFingerprint": 21
          },
          "indicator_count": 4764,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "4 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6964c08bf79bcb252eaa9e15",
          "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
          "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
          "modified": "2026-02-11T09:03:20.933000",
          "created": "2026-01-12T09:36:11.701000",
          "tags": [
            "google",
            "fastly",
            "googlecl",
            "january",
            "http",
            "domain",
            "akamaias",
            "cloudflar",
            "page url",
            "de summary",
            "april",
            "reverse dns",
            "url https",
            "general full",
            "software",
            "united",
            "resource hash",
            "protocol h3",
            "security quic",
            "protocol h2",
            "security tls",
            "main",
            "present jan",
            "title",
            "gmt max",
            "certificate",
            "moved",
            "lowfi",
            "gmt content",
            "meta",
            "present dec",
            "status",
            "aaaa",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "win32",
            "files",
            "verdict",
            "files ip",
            "address",
            "mtb jan",
            "trojandropper",
            "backdoor",
            "win32upatre jan",
            "origin trial",
            "gmt cache",
            "443 ma2592000",
            "possible",
            "worm",
            "trojan",
            "ip address",
            "record value",
            "dark",
            "found",
            "ipv4 add",
            "error",
            "trojanspy",
            "emails",
            "servers",
            "pegasus",
            "america flag",
            "america asn",
            "tlsv1",
            "read c",
            "show",
            "medium",
            "lstockholm",
            "ospotify ab",
            "odigicert inc",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "dynamicloader",
            "yara rule",
            "ms windows",
            "pe32",
            "named pipe",
            "smartassembly",
            "delphi",
            "malware",
            "united states",
            "pe file",
            "filehash",
            "md5 add",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "high",
            "write c",
            "tls sni",
            "tls handshake",
            "delete",
            "as15169",
            "stun binding",
            "request",
            "port",
            "win64",
            "themida",
            "guard",
            "risepro",
            "sha256",
            "sha1",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "ck id",
            "null",
            "refresh",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "ck techniques",
            "evasion att",
            "t1480 execution",
            "directui",
            "element",
            "hwndhost",
            "classinfobase",
            "hwndelement",
            "value",
            "explorer",
            "insert",
            "movie",
            "hacktool",
            "showing",
            "entries http",
            "scans show",
            "california",
            "location united",
            "next associated",
            "pulse pulses",
            "name servers",
            "found request",
            "unique",
            "url add",
            "related nids",
            "files location",
            "expiration",
            "flag united",
            "present nov",
            "present sep",
            "href",
            "suricata stream",
            "command decode",
            "starfield",
            "encrypt",
            "iframe",
            "date",
            "title error",
            "hostname",
            "pulse submit",
            "memcommit",
            "checks",
            "windows",
            "capture",
            "cloudfront",
            "colorado",
            "creation date",
            "hostname add",
            "eset",
            "binary file",
            "pdb path",
            "internalname",
            "nod32",
            "amon"
          ],
          "references": [
            "open.spotify.com \u2022",
            "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
            "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
            "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
            "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
            "https://target.tccwest.www.littleswimmers.fr/",
            "www.onyx-ware.com \u2022 endgamesystems.com",
            "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Win.Packed.Stealerc-10017074-0",
              "display_name": "Win.Packed.Stealerc-10017074-0",
              "target": null
            },
            {
              "id": "#Lowfi:Win32/AutoIt",
              "display_name": "#Lowfi:Win32/AutoIt",
              "target": "/malware/#Lowfi:Win32/AutoIt"
            },
            {
              "id": "Win.Packed.Generic-9967832-0",
              "display_name": "Win.Packed.Generic-9967832-0",
              "target": null
            },
            {
              "id": "TrojanSpy:MSIL/Yakbeex.A",
              "display_name": "TrojanSpy:MSIL/Yakbeex.A",
              "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Win32:HacktoolX-gen\\ [Trj]",
              "display_name": "Win32:HacktoolX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "nUFS_unicode",
              "display_name": "nUFS_unicode",
              "target": null
            },
            {
              "id": "HackTool:Win32/CobaltStrike.A",
              "display_name": "HackTool:Win32/CobaltStrike.A",
              "target": "/malware/HackTool:Win32/CobaltStrike.A"
            },
            {
              "id": "Win.Dropper.PoisonIvy-9876745-0",
              "display_name": "Win.Dropper.PoisonIvy-9876745-0",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            }
          ],
          "industries": [
            "Entertainment",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1293,
            "URL": 3389,
            "FileHash-MD5": 635,
            "FileHash-SHA1": 531,
            "FileHash-SHA256": 2345,
            "domain": 501,
            "email": 12,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 8722,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "67 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5e9f8cfc5fbc73142660",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:30:55.471000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5ea4d51d4a1cabdb4ee9",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:31:00.172000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c5d0cd10f7bf6c3e6fa513",
          "name": "Remote admin privileges affecting online payment service redirect",
          "description": "Openvision.ro.\nRemote admin privileges affecting online targeted users https://paypal.com redirect fed.paypal.com",
          "modified": "2025-10-13T19:29:11.484000",
          "created": "2025-09-13T20:15:09.236000",
          "tags": [
            "domain",
            "url analysis",
            "passive dns",
            "urls",
            "ip address",
            "extraction",
            "s data",
            "extrac data",
            "included",
            "review ioc",
            "excluded",
            "data upload",
            "failed",
            "extra data",
            "include review",
            "exclude suggest",
            "find s",
            "typ no",
            "exclude sugges",
            "typ hos",
            "error dec",
            "servers",
            "value name",
            "dnssec active",
            "domain name",
            "domain status",
            "ok expiration",
            "date",
            "name servers",
            "referral url",
            "files",
            "reverse dns",
            "romania asn",
            "as20616",
            "dns resolutions",
            "domains top",
            "level",
            "unique tld",
            "dynamicloader",
            "medium",
            "high",
            "yara detections",
            "upxoepplace",
            "yara rule",
            "bochs",
            "anomalous file",
            "dynamic",
            "reads",
            "ping",
            "markus",
            "april",
            "copy",
            "entries exif",
            "data show",
            "search",
            "value exe",
            "script",
            "fileflags",
            "fileflagsmask",
            "fileos win32",
            "executable",
            "large address",
            "next resource",
            "strings show",
            "value ud975",
            "uude17\u17e9",
            "\u1b53 ud9ff\u1818udf1e",
            "uda64",
            "udec3",
            "intel",
            "ms windows",
            "ascii text",
            "crlf line",
            "registry total",
            "read",
            "write",
            "delete",
            "type",
            "extra",
            "pulse",
            "record type",
            "ttl value",
            "a mx",
            "thumbprint",
            "match info",
            "info",
            "mitre att",
            "ta0002 command",
            "t1059 severity",
            "modules t1129",
            "windows api",
            "ta0003 modify",
            "registry t1112",
            "defense evasion",
            "resolved ips",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "date hash",
            "sabey type",
            "rexx type",
            "foundry type",
            "palantir"
          ],
          "references": [
            "openvision.ro",
            "sonar.tools.nonprod.civicalg.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win.Malware.Remoteadmin-7056666-0",
              "display_name": "Win.Malware.Remoteadmin-7056666-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1609",
              "name": "Container Administration Command",
              "display_name": "T1609 - Container Administration Command"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1447",
              "name": "Delete Device Data",
              "display_name": "T1447 - Delete Device Data"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            },
            {
              "id": "T1463",
              "name": "Manipulate Device Communication",
              "display_name": "T1463 - Manipulate Device Communication"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            }
          ],
          "industries": [
            "Financial",
            "Targeted",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 76,
            "FileHash-SHA256": 33,
            "FileHash-MD5": 27,
            "FileHash-SHA1": 35,
            "hostname": 213,
            "URL": 345
          },
          "indicator_count": 729,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "188 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "686cb765dc6737fd1e882630",
          "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
          "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
          "modified": "2025-08-07T05:01:52.697000",
          "created": "2025-07-08T06:15:01.296000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "iocs",
            "review iocs",
            "pulse show",
            "search",
            "type indicator",
            "role title",
            "expiration",
            "url http",
            "url https",
            "text drag",
            "drop or",
            "enter source",
            "url or",
            "hostname",
            "ipv4",
            "related pulses",
            "showing",
            "entries",
            "drop",
            "domain",
            "enter",
            "extract",
            "browse to",
            "domain xn",
            "select file",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "indicator role",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 840,
            "FileHash-SHA1": 725,
            "FileHash-SHA256": 863,
            "URL": 1663,
            "SSLCertFingerprint": 17,
            "domain": 520,
            "hostname": 734,
            "email": 11
          },
          "indicator_count": 5373,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "255 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "686cb7673e4d5a0067758fd7",
          "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
          "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
          "modified": "2025-08-07T05:01:52.697000",
          "created": "2025-07-08T06:15:03.501000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "iocs",
            "review iocs",
            "pulse show",
            "search",
            "type indicator",
            "role title",
            "expiration",
            "url http",
            "url https",
            "text drag",
            "drop or",
            "enter source",
            "url or",
            "hostname",
            "ipv4",
            "related pulses",
            "showing",
            "entries",
            "drop",
            "domain",
            "enter",
            "extract",
            "browse to",
            "domain xn",
            "select file",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "indicator role",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 840,
            "FileHash-SHA1": 725,
            "FileHash-SHA256": 863,
            "URL": 1663,
            "SSLCertFingerprint": 17,
            "domain": 520,
            "hostname": 734,
            "email": 11
          },
          "indicator_count": 5373,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "255 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
        "open.spotify.com \u2022",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "https://target.tccwest.www.littleswimmers.fr/",
        "ns4-04.azure-dns.info",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "bricked.wtf",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "openvision.ro",
        "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "asp.net \u2022 cdnsrc.asp.net",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "www.fireeye.com .",
        "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "Tulach\u2019s ASP.Net Open Source destruction",
        "www.fireeye.com",
        "http://api.jmtstudios.org/",
        "sonar.tools.nonprod.civicalg.com",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
        "https://www.jmtstudios.org/farewell/",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party.",
        "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
        "danilovstyle.ru",
        "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "http://www.visitbooker.com/Dropbox-07/index.htm"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.dropper.poisonivy-9876745-0",
            "Nufs_unicode",
            "Trojan:win32/comisproc!gmb i",
            "Win.malware.remoteadmin-7056666-0",
            "Upadter",
            "Ransom:win32/sodinokibicrypt.sk!mtb",
            "Win.packed.generic-9967832-0",
            "Win.trojan.barys-10005825-0",
            "Pegasus",
            "Win.ransomware.tofsee-10015002",
            "#lowfi:win32/autoit",
            "Hacktool:win32/cobaltstrike.a",
            "Win.malware.convagent-9981433-0",
            "Trojanspy:msil/yakbeex.a",
            "Trojan:win32/zombie.a",
            "Win.packed.stealerc-10017074-0",
            "Trojanspy",
            "Mydoom",
            "Win32:hacktoolx-gen\\ [trj]"
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Entertainment",
            "Targeted",
            "Financial"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "69decb6dd1bd6da78fc72d0a",
      "name": "Solarwinds Similarties? Tactics ASP.Net IoC\u2019s ISOLATED",
      "description": "Does this have similarities to the SolarWinds Attack? Anyone?\n\nASP.NET is a web application framework created by Microsoft for building dynamic web applications.\nIt enables developers to create web pages that can interact with databases and respond to user inputs.\nASP.NET supports various programming languages, including C# and VB.NET.\nContext: ASP.NET is widely used for developing modern web applications and services. It allows developers to create interactive and data-driven web pages that can run on various operating systems, including Windows, Linux, and macOS. The framework is open-source and supports various architectures, including MVC (Model-View-Controller) and Web API, which facilitate the organization and development of complex applications.\nIn many instances ASP.net has been seen connected to malicious Tulach , Apple , a browser agent that transmits data to New Relic's collectors by using either of the domains bam.nr-data.net or bam-cell.nr-data.net.",
      "modified": "2026-04-14T23:19:09.495000",
      "created": "2026-04-14T23:19:09.495000",
      "tags": [
        "united",
        "aaaa",
        "certificate",
        "error",
        "read c",
        "rgba",
        "unicode",
        "memcommit",
        "delete",
        "dock",
        "execution",
        "command decode",
        "suricata ipv4",
        "suricata tcpv4",
        "flag",
        "localappdata",
        "windir",
        "openurl c",
        "programfiles",
        "suricata udpv4",
        "win64",
        "click",
        "strings",
        "anon",
        "username",
        "userprofile",
        "mitre att",
        "ck id",
        "ck matrix",
        "appdata",
        "comspec",
        "model",
        "path",
        "april",
        "hybrid",
        "general",
        "learn",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ck techniques",
        "mtb apr",
        "exploit",
        "trojan",
        "backdoor",
        "please",
        "x msedge",
        "all ipv4",
        "ransom",
        "date hash",
        "avast avg",
        "win32orbus apr",
        "dynamicloader",
        "yara rule",
        "high",
        "tofsee",
        "rndhex",
        "rndchar",
        "loaderid",
        "lidfileupd",
        "localcfg",
        "write",
        "stream",
        "push",
        "mtb alerts",
        "ee fc",
        "ff d5",
        "lredmond",
        "malware",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "yara detections",
        "av detections",
        "ids detections",
        "hostile",
        "unknown",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "stop data",
        "typ url",
        "url data",
        "typ no",
        "th all",
        "stop",
        "port",
        "destination",
        "ds detections",
        "tls sni",
        "nrv2x",
        "upxoepplace",
        "alerts",
        "contacted",
        "markus",
        "hostile alerts",
        "less see",
        "all ip",
        "tulach",
        "brian sabey",
        "quasi",
        "link",
        "script urls",
        "record value",
        "script domains",
        "fireeye",
        "create c",
        "as15169",
        "next",
        "all url",
        "http",
        "related pulses",
        "related tags",
        "google safe",
        "code",
        "y se",
        "included review",
        "io excluded",
        "suggeste",
        "ipv4",
        "unknown ns",
        "redacted admin",
        "fax redacted",
        "name redacted",
        "phone redacted",
        "code redacted",
        "redacted tech",
        "christopher ahmann",
        "solarwinds like?"
      ],
      "references": [
        "asp.net \u2022 cdnsrc.asp.net",
        "https://www.countercept.com/assets/Uploads/whitepapers/MWRI-Countercept-Machine-Learning-Whitepaper-2017-04-01.pdf",
        "http://www.phonefactor.com/PfPaWs/ConfirmActivation",
        "IPv4 13.107.253.70 exploit_source \u2022 IPv4 13.107.226.70 malware_hosting",
        "https://wsps.ourschoolpages.com/Account/ForgotPasswor (typo",
        "https://hybrid-analysis.com/sample/529a0b900eef6657ce6c98b1b5bccebe6db2e021aa02a316b7eb2604df810d3f/69de30ef0a22c3b506077a8c",
        "www.fireeye.com",
        "danilovstyle.ru",
        "ns4-04.azure-dns.info",
        "ns4-04.azure-dns.info danilovst) ns4-04.azure-dns.info",
        "www.fireeye.com .",
        "https://hypic-anaivsis.com/sambrerb/a0p9veebo",
        "Are these table SolarWinds attackers? Using same tacktics, good? Unsure.",
        "Tulach\u2019s ASP.Net Open Source destruction"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
          "display_name": "Ransom:Win32/SodinokibiCrypt.SK!MTB",
          "target": "/malware/Ransom:Win32/SodinokibiCrypt.SK!MTB"
        },
        {
          "id": "Win.Ransomware.Tofsee-10015002",
          "display_name": "Win.Ransomware.Tofsee-10015002",
          "target": null
        },
        {
          "id": "Trojan:Win32/Comisproc!gmb I",
          "display_name": "Trojan:Win32/Comisproc!gmb I",
          "target": "/malware/Trojan:Win32/Comisproc!gmb I"
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1132.001",
          "name": "Standard Encoding",
          "display_name": "T1132.001 - Standard Encoding"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1518.001",
          "name": "Security Software Discovery",
          "display_name": "T1518.001 - Security Software Discovery"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 88,
        "FileHash-MD5": 211,
        "FileHash-SHA1": 186,
        "FileHash-SHA256": 1366,
        "URL": 1848,
        "domain": 418,
        "email": 4,
        "hostname": 622,
        "SSLCertFingerprint": 21
      },
      "indicator_count": 4764,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "4 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6964c08bf79bcb252eaa9e15",
      "name": "TrojanSpy -  Spotify account under an attack which conceals artists releases / deletes followers",
      "description": "Spotify Attacks: TrojanSpy - Streamer Spotify account under an attack which conceals artists releases / deletes followers. The attack is adversarial. I\u2019m unclear how widespread it is.  . Further research required. OTX auto generated Pegasus. Released work that was once viewable is now concealed, followers deleted.\n#cloudfront #spyware #delete_service #cloudfront_attacks",
      "modified": "2026-02-11T09:03:20.933000",
      "created": "2026-01-12T09:36:11.701000",
      "tags": [
        "google",
        "fastly",
        "googlecl",
        "january",
        "http",
        "domain",
        "akamaias",
        "cloudflar",
        "page url",
        "de summary",
        "april",
        "reverse dns",
        "url https",
        "general full",
        "software",
        "united",
        "resource hash",
        "protocol h3",
        "security quic",
        "protocol h2",
        "security tls",
        "main",
        "present jan",
        "title",
        "gmt max",
        "certificate",
        "moved",
        "lowfi",
        "gmt content",
        "meta",
        "present dec",
        "status",
        "aaaa",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "win32",
        "files",
        "verdict",
        "files ip",
        "address",
        "mtb jan",
        "trojandropper",
        "backdoor",
        "win32upatre jan",
        "origin trial",
        "gmt cache",
        "443 ma2592000",
        "possible",
        "worm",
        "trojan",
        "ip address",
        "record value",
        "dark",
        "found",
        "ipv4 add",
        "error",
        "trojanspy",
        "emails",
        "servers",
        "pegasus",
        "america flag",
        "america asn",
        "tlsv1",
        "read c",
        "show",
        "medium",
        "lstockholm",
        "ospotify ab",
        "odigicert inc",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "dynamicloader",
        "yara rule",
        "ms windows",
        "pe32",
        "named pipe",
        "smartassembly",
        "delphi",
        "malware",
        "united states",
        "pe file",
        "filehash",
        "md5 add",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "high",
        "write c",
        "tls sni",
        "tls handshake",
        "delete",
        "as15169",
        "stun binding",
        "request",
        "port",
        "win64",
        "themida",
        "guard",
        "risepro",
        "sha256",
        "sha1",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "ck id",
        "null",
        "refresh",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "ck techniques",
        "evasion att",
        "t1480 execution",
        "directui",
        "element",
        "hwndhost",
        "classinfobase",
        "hwndelement",
        "value",
        "explorer",
        "insert",
        "movie",
        "hacktool",
        "showing",
        "entries http",
        "scans show",
        "california",
        "location united",
        "next associated",
        "pulse pulses",
        "name servers",
        "found request",
        "unique",
        "url add",
        "related nids",
        "files location",
        "expiration",
        "flag united",
        "present nov",
        "present sep",
        "href",
        "suricata stream",
        "command decode",
        "starfield",
        "encrypt",
        "iframe",
        "date",
        "title error",
        "hostname",
        "pulse submit",
        "memcommit",
        "checks",
        "windows",
        "capture",
        "cloudfront",
        "colorado",
        "creation date",
        "hostname add",
        "eset",
        "binary file",
        "pdb path",
        "internalname",
        "nod32",
        "amon"
      ],
      "references": [
        "open.spotify.com \u2022",
        "https://open.spotify.com/intl-de/track/5KjB1j0u54VXg6M8SN8hH2",
        "https://open.spotify.com/track/5KjB1j0u54VXg6M8SN8hH2",
        "FileHash-SHA256 cb40cd426d6e55c2b175b5be3327bfdf8d5a0074bf48b823121bd4720ed2ad95",
        "events.launchdarkly.com \u2022 clientstream.launchdarkly. \u2022 app.launchdarkly.com",
        "https://target.tccwest.www.littleswimmers.fr/",
        "www.onyx-ware.com \u2022 endgamesystems.com",
        "cloudfront.net \u2022  d127qq8ld0aiq5.cloudfront.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Win.Packed.Stealerc-10017074-0",
          "display_name": "Win.Packed.Stealerc-10017074-0",
          "target": null
        },
        {
          "id": "#Lowfi:Win32/AutoIt",
          "display_name": "#Lowfi:Win32/AutoIt",
          "target": "/malware/#Lowfi:Win32/AutoIt"
        },
        {
          "id": "Win.Packed.Generic-9967832-0",
          "display_name": "Win.Packed.Generic-9967832-0",
          "target": null
        },
        {
          "id": "TrojanSpy:MSIL/Yakbeex.A",
          "display_name": "TrojanSpy:MSIL/Yakbeex.A",
          "target": "/malware/TrojanSpy:MSIL/Yakbeex.A"
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Win32:HacktoolX-gen\\ [Trj]",
          "display_name": "Win32:HacktoolX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "nUFS_unicode",
          "display_name": "nUFS_unicode",
          "target": null
        },
        {
          "id": "HackTool:Win32/CobaltStrike.A",
          "display_name": "HackTool:Win32/CobaltStrike.A",
          "target": "/malware/HackTool:Win32/CobaltStrike.A"
        },
        {
          "id": "Win.Dropper.PoisonIvy-9876745-0",
          "display_name": "Win.Dropper.PoisonIvy-9876745-0",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        }
      ],
      "industries": [
        "Entertainment",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1293,
        "URL": 3389,
        "FileHash-MD5": 635,
        "FileHash-SHA1": 531,
        "FileHash-SHA256": 2345,
        "domain": 501,
        "email": 12,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 8722,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "67 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5e9f8cfc5fbc73142660",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:30:55.471000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5ea4d51d4a1cabdb4ee9",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:31:00.172000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c5d0cd10f7bf6c3e6fa513",
      "name": "Remote admin privileges affecting online payment service redirect",
      "description": "Openvision.ro.\nRemote admin privileges affecting online targeted users https://paypal.com redirect fed.paypal.com",
      "modified": "2025-10-13T19:29:11.484000",
      "created": "2025-09-13T20:15:09.236000",
      "tags": [
        "domain",
        "url analysis",
        "passive dns",
        "urls",
        "ip address",
        "extraction",
        "s data",
        "extrac data",
        "included",
        "review ioc",
        "excluded",
        "data upload",
        "failed",
        "extra data",
        "include review",
        "exclude suggest",
        "find s",
        "typ no",
        "exclude sugges",
        "typ hos",
        "error dec",
        "servers",
        "value name",
        "dnssec active",
        "domain name",
        "domain status",
        "ok expiration",
        "date",
        "name servers",
        "referral url",
        "files",
        "reverse dns",
        "romania asn",
        "as20616",
        "dns resolutions",
        "domains top",
        "level",
        "unique tld",
        "dynamicloader",
        "medium",
        "high",
        "yara detections",
        "upxoepplace",
        "yara rule",
        "bochs",
        "anomalous file",
        "dynamic",
        "reads",
        "ping",
        "markus",
        "april",
        "copy",
        "entries exif",
        "data show",
        "search",
        "value exe",
        "script",
        "fileflags",
        "fileflagsmask",
        "fileos win32",
        "executable",
        "large address",
        "next resource",
        "strings show",
        "value ud975",
        "uude17\u17e9",
        "\u1b53 ud9ff\u1818udf1e",
        "uda64",
        "udec3",
        "intel",
        "ms windows",
        "ascii text",
        "crlf line",
        "registry total",
        "read",
        "write",
        "delete",
        "type",
        "extra",
        "pulse",
        "record type",
        "ttl value",
        "a mx",
        "thumbprint",
        "match info",
        "info",
        "mitre att",
        "ta0002 command",
        "t1059 severity",
        "modules t1129",
        "windows api",
        "ta0003 modify",
        "registry t1112",
        "defense evasion",
        "resolved ips",
        "files matching",
        "number",
        "sample analysis",
        "hide samples",
        "date hash",
        "sabey type",
        "rexx type",
        "foundry type",
        "palantir"
      ],
      "references": [
        "openvision.ro",
        "sonar.tools.nonprod.civicalg.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win.Malware.Remoteadmin-7056666-0",
          "display_name": "Win.Malware.Remoteadmin-7056666-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1609",
          "name": "Container Administration Command",
          "display_name": "T1609 - Container Administration Command"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1447",
          "name": "Delete Device Data",
          "display_name": "T1447 - Delete Device Data"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        },
        {
          "id": "T1463",
          "name": "Manipulate Device Communication",
          "display_name": "T1463 - Manipulate Device Communication"
        },
        {
          "id": "T1450",
          "name": "Exploit SS7 to Track Device Location",
          "display_name": "T1450 - Exploit SS7 to Track Device Location"
        }
      ],
      "industries": [
        "Financial",
        "Targeted",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 76,
        "FileHash-SHA256": 33,
        "FileHash-MD5": 27,
        "FileHash-SHA1": 35,
        "hostname": 213,
        "URL": 345
      },
      "indicator_count": 729,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "188 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "686cb765dc6737fd1e882630",
      "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
      "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
      "modified": "2025-08-07T05:01:52.697000",
      "created": "2025-07-08T06:15:01.296000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "iocs",
        "review iocs",
        "pulse show",
        "search",
        "type indicator",
        "role title",
        "expiration",
        "url http",
        "url https",
        "text drag",
        "drop or",
        "enter source",
        "url or",
        "hostname",
        "ipv4",
        "related pulses",
        "showing",
        "entries",
        "drop",
        "domain",
        "enter",
        "extract",
        "browse to",
        "domain xn",
        "select file",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "indicator role",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 840,
        "FileHash-SHA1": 725,
        "FileHash-SHA256": 863,
        "URL": 1663,
        "SSLCertFingerprint": 17,
        "domain": 520,
        "hostname": 734,
        "email": 11
      },
      "indicator_count": 5373,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "255 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "686cb7673e4d5a0067758fd7",
      "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
      "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
      "modified": "2025-08-07T05:01:52.697000",
      "created": "2025-07-08T06:15:03.501000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "iocs",
        "review iocs",
        "pulse show",
        "search",
        "type indicator",
        "role title",
        "expiration",
        "url http",
        "url https",
        "text drag",
        "drop or",
        "enter source",
        "url or",
        "hostname",
        "ipv4",
        "related pulses",
        "showing",
        "entries",
        "drop",
        "domain",
        "enter",
        "extract",
        "browse to",
        "domain xn",
        "select file",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "indicator role",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 840,
        "FileHash-SHA1": 725,
        "FileHash-SHA256": 863,
        "URL": 1663,
        "SSLCertFingerprint": 17,
        "domain": 520,
        "hostname": 734,
        "email": 11
      },
      "indicator_count": 5373,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "255 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "polldev.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "polldev.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638494.5427842
}