{
  "type": "Domain",
  "indicator": "puvymul.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/puvymul.com",
    "alexa": "http://www.alexa.com/siteinfo/puvymul.com",
    "indicator": "puvymul.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 144246907,
      "indicator": "puvymul.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "68705b9e13e074fa3c778902",
          "name": "check",
          "description": "",
          "modified": "2026-01-23T01:10:39.457000",
          "created": "2025-07-11T00:32:30.277000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 421,
            "FileHash-MD5": 25,
            "FileHash-SHA1": 22,
            "FileHash-SHA256": 133,
            "domain": 270,
            "hostname": 35
          },
          "indicator_count": 906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "688c8526be7a4df33863b5c5",
          "name": "VirusTotal - Shiz.ivr",
          "description": "*Win.Trojan.Shiz.ivr\n*PWS:Win32/Simda.D\n*virtool #injection#infostealer #network #cnc #block_not #virustotal_google #cnc #checking #procmem_yara\n#injection_inter_process\n#injection_create_remote_thread\n#antidebug_windows\n#multiple_useragents\n#network_fake_useragent\n#persistence_autorun\n#cape_detected_threat\n#antiav_detectfile\n#modify_proxy\n#deletes_self\n#infostealer_cookies\n#injection_createremotethread\n#suricata_alert\n~ vashti",
          "modified": "2025-08-31T08:01:04.297000",
          "created": "2025-08-01T09:13:10.510000",
          "tags": [
            "dynamicloader",
            "unknown",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "suspicious",
            "search",
            "high",
            "show",
            "copy",
            "possible",
            "write",
            "internal",
            "malware",
            "push",
            "local",
            "next",
            "contacted",
            "domains",
            "pulses",
            "related tags",
            "file type",
            "date april",
            "pm size",
            "sha1 sha256",
            "imphash pehash",
            "virustotal api",
            "bq jul",
            "united",
            "trojan",
            "backdoor",
            "virtool",
            "cnc beacon",
            "entries",
            "path max",
            "passive dns",
            "next associated",
            "cookie",
            "twitter",
            "body",
            "date",
            "medium",
            "simda",
            "global"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 10303,
            "hostname": 1413,
            "FileHash-SHA256": 1868,
            "domain": 1877,
            "FileHash-MD5": 357,
            "FileHash-SHA1": 348,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 16168,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "274 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "5daf09a6d16f1e2c5c594c22",
          "name": "Simda - Malware Domain Feed V2",
          "description": "Command and Control domains for malware known as Simda. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
          "modified": "2025-07-15T21:13:57.066000",
          "created": "2019-10-22T13:52:38.770000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "otxrobottwo",
            "id": "78495",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 209,
            "hostname": 5
          },
          "indicator_count": 214,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1085,
          "modified_text": "320 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67fb185eb96e9791cf24ced4",
          "name": "Shiz/Packy",
          "description": "",
          "modified": "2025-05-13T01:03:15.390000",
          "created": "2025-04-13T01:50:22.707000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/gf9fb2090ae8e450dadda45c0596ab774ed1984e89aab4679bc3fc02096e22fa3"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 26,
            "URL": 191,
            "domain": 344,
            "hostname": 2
          },
          "indicator_count": 563,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "384 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d34c8a64436a7aee2e25a1",
          "name": "Locky: File Deletion targeting incriminating archived files.",
          "description": "redhatdelete.com : Adversaries are deleting files in bulk  from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.",
          "modified": "2024-03-20T12:00:39.809000",
          "created": "2024-02-19T12:41:46.707000",
          "tags": [
            "it consultant",
            "uk collection",
            "dns intel",
            "ips collection",
            "suspicous ip",
            "whois file",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "whois lookup",
            "region create",
            "domain",
            "name server",
            "registrant name",
            "technical city",
            "region update",
            "united",
            "command decode",
            "mitre att",
            "suricata ipv4",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ck id",
            "cookie",
            "meta",
            "february",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "dns replication",
            "code",
            "namecheap",
            "registrar abuse",
            "namecheap inc",
            "privacy service",
            "withheld",
            "privacy",
            "dnssec",
            "email",
            "first",
            "bodis",
            "unknown",
            "creation date",
            "search",
            "emails",
            "as397240",
            "date",
            "next",
            "all octoseek",
            "threat roundup",
            "january",
            "june",
            "historical ssl",
            "referrer",
            "contacted",
            "group",
            "execution",
            "phishing",
            "malware",
            "core",
            "malicious",
            "dark power",
            "play ransomware",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "icons library",
            "os2 executable",
            "pe32 linker",
            "gnu linker",
            "compiler",
            "info header",
            "name md5",
            "overlay",
            "passive dns",
            "entries",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "trojan",
            "location united",
            "query",
            "activity dns",
            "observed dns",
            "msie",
            "high",
            "copy",
            "write",
            "win32",
            "hashes",
            "host interaction",
            "sabey type",
            "hallrender",
            "brian sabey",
            "memory pattern",
            "http requests",
            "http method",
            "get response",
            "dns resolutions",
            "ip traffic",
            "domains",
            "mutex",
            "samplepath",
            "created",
            "shell commands",
            "r processes",
            "tree",
            "analyze",
            "hostnames",
            "url https",
            "samples",
            "hostname",
            "pattern urls",
            "memory",
            "pattern",
            "pattern domains",
            "roundup",
            "formbook",
            "mirai",
            "ben c",
            "injection",
            "server",
            "scan endpoints",
            "show",
            "august",
            "bq feb",
            "chrome",
            "precondition",
            "virtool",
            "downloadmr",
            "body",
            "status",
            "servers",
            "record value",
            "name servers",
            "showing",
            "mailrubar",
            "trojanclicker",
            "slcc2",
            "media center",
            "delete c",
            "malware beacon",
            "suspicious",
            "class",
            "internal",
            "local",
            "encrypt",
            "as15169 google",
            "gmt cache",
            "twitter",
            "rostpay",
            "date hash",
            "avast avg",
            "mtb may",
            "susp",
            "cryp",
            "win32upatre may",
            "mtb showing",
            "lowfi",
            "aaaa",
            "win32pcmega jan",
            "urlshortner dec",
            "urlshortner sep",
            "as133618",
            "nxdomain",
            "as133775 xiamen",
            "germany unknown",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "cobalt strike",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "resolutions",
            "critical risk",
            "apple phone",
            "unlocker",
            "shell code",
            "installer",
            "ursnif",
            "hacktool",
            "emotet",
            "tracker",
            "chaos",
            "ransomexx",
            "xor ddos",
            "xorddos",
            "mitre attack",
            "parent domain",
            "urls url",
            "siblings",
            "metro",
            "communicating",
            "collection",
            "dropped",
            "skynet",
            "youth",
            "com laude",
            "ltd dba",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "akamaias",
            "digitaloceanasn",
            "csc corporate",
            "pt mora",
            "univjos",
            "etisalat misr",
            "acurix networks",
            "pty ltd",
            "beijing baidu",
            "highly targeted",
            "http",
            "network hijacks",
            "redline stealer",
            "whois sslcert",
            "contacted urls",
            "whois whois",
            "september",
            "hidden cobra",
            "threats",
            "kimsuky",
            "service",
            "read c",
            "create c",
            "write c",
            "regsetvalueexa",
            "mozilla",
            "capture",
            "asnone",
            "domain http",
            "request",
            "malware dns",
            "lookup wannacry",
            "default",
            "ransom",
            "push",
            "playgame",
            "command",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "yara detections",
            "debug",
            "icmp traffic",
            "pdb path",
            "pe section",
            "low software",
            "packing t1045",
            "ransomware",
            "egregor",
            "find",
            "false",
            "psexec",
            "powershell",
            "qakbot",
            "qbot",
            "icedid"
          ],
          "references": [
            "redhatdelete.com",
            "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
            "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
            "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
            "Trojan-Ransom.Win32.Blocker.jgb Checkin",
            "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "target": null
            },
            {
              "id": "Rostpay",
              "display_name": "Rostpay",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Mitre Attack",
              "display_name": "Mitre Attack",
              "target": null
            },
            {
              "id": "Chaos (ELF)",
              "display_name": "Chaos (ELF)",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/GameHack",
              "display_name": "TrojanDropper:Win32/GameHack",
              "target": "/malware/TrojanDropper:Win32/GameHack"
            },
            {
              "id": "Win.Ransomware.Locky-7766366-0",
              "display_name": "Win.Ransomware.Locky-7766366-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt.A!rsm",
              "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
              "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_pid",
              "display_name": "ALF:E5.SpikeAex.rhh_pid",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1107",
              "name": "File Deletion",
              "display_name": "T1107 - File Deletion"
            },
            {
              "id": "T1563",
              "name": "Remote Service Session Hijacking",
              "display_name": "T1563 - Remote Service Session Hijacking"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 65,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1848,
            "FileHash-SHA1": 1783,
            "FileHash-SHA256": 7170,
            "domain": 1649,
            "hostname": 1191,
            "email": 9,
            "URL": 729,
            "CVE": 2,
            "SSLCertFingerprint": 2,
            "CIDR": 1
          },
          "indicator_count": 14384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d34c91868744aa1449fef2",
          "name": "Locky: File Deletion targeting incriminating archived files.",
          "description": "redhatdelete.com : Adversaries are deleting files in bulk  from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.",
          "modified": "2024-03-20T12:00:39.809000",
          "created": "2024-02-19T12:41:52.846000",
          "tags": [
            "it consultant",
            "uk collection",
            "dns intel",
            "ips collection",
            "suspicous ip",
            "whois file",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "whois lookup",
            "region create",
            "domain",
            "name server",
            "registrant name",
            "technical city",
            "region update",
            "united",
            "command decode",
            "mitre att",
            "suricata ipv4",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ck id",
            "cookie",
            "meta",
            "february",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "dns replication",
            "code",
            "namecheap",
            "registrar abuse",
            "namecheap inc",
            "privacy service",
            "withheld",
            "privacy",
            "dnssec",
            "email",
            "first",
            "bodis",
            "unknown",
            "creation date",
            "search",
            "emails",
            "as397240",
            "date",
            "next",
            "all octoseek",
            "threat roundup",
            "january",
            "june",
            "historical ssl",
            "referrer",
            "contacted",
            "group",
            "execution",
            "phishing",
            "malware",
            "core",
            "malicious",
            "dark power",
            "play ransomware",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "icons library",
            "os2 executable",
            "pe32 linker",
            "gnu linker",
            "compiler",
            "info header",
            "name md5",
            "overlay",
            "passive dns",
            "entries",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "trojan",
            "location united",
            "query",
            "activity dns",
            "observed dns",
            "msie",
            "high",
            "copy",
            "write",
            "win32",
            "hashes",
            "host interaction",
            "sabey type",
            "hallrender",
            "brian sabey",
            "memory pattern",
            "http requests",
            "http method",
            "get response",
            "dns resolutions",
            "ip traffic",
            "domains",
            "mutex",
            "samplepath",
            "created",
            "shell commands",
            "r processes",
            "tree",
            "analyze",
            "hostnames",
            "url https",
            "samples",
            "hostname",
            "pattern urls",
            "memory",
            "pattern",
            "pattern domains",
            "roundup",
            "formbook",
            "mirai",
            "ben c",
            "injection",
            "server",
            "scan endpoints",
            "show",
            "august",
            "bq feb",
            "chrome",
            "precondition",
            "virtool",
            "downloadmr",
            "body",
            "status",
            "servers",
            "record value",
            "name servers",
            "showing",
            "mailrubar",
            "trojanclicker",
            "slcc2",
            "media center",
            "delete c",
            "malware beacon",
            "suspicious",
            "class",
            "internal",
            "local",
            "encrypt",
            "as15169 google",
            "gmt cache",
            "twitter",
            "rostpay",
            "date hash",
            "avast avg",
            "mtb may",
            "susp",
            "cryp",
            "win32upatre may",
            "mtb showing",
            "lowfi",
            "aaaa",
            "win32pcmega jan",
            "urlshortner dec",
            "urlshortner sep",
            "as133618",
            "nxdomain",
            "as133775 xiamen",
            "germany unknown",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "cobalt strike",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "resolutions",
            "critical risk",
            "apple phone",
            "unlocker",
            "shell code",
            "installer",
            "ursnif",
            "hacktool",
            "emotet",
            "tracker",
            "chaos",
            "ransomexx",
            "xor ddos",
            "xorddos",
            "mitre attack",
            "parent domain",
            "urls url",
            "siblings",
            "metro",
            "communicating",
            "collection",
            "dropped",
            "skynet",
            "youth",
            "com laude",
            "ltd dba",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "akamaias",
            "digitaloceanasn",
            "csc corporate",
            "pt mora",
            "univjos",
            "etisalat misr",
            "acurix networks",
            "pty ltd",
            "beijing baidu",
            "highly targeted",
            "http",
            "network hijacks",
            "redline stealer",
            "whois sslcert",
            "contacted urls",
            "whois whois",
            "september",
            "hidden cobra",
            "threats",
            "kimsuky",
            "service",
            "read c",
            "create c",
            "write c",
            "regsetvalueexa",
            "mozilla",
            "capture",
            "asnone",
            "domain http",
            "request",
            "malware dns",
            "lookup wannacry",
            "default",
            "ransom",
            "push",
            "playgame",
            "command",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "yara detections",
            "debug",
            "icmp traffic",
            "pdb path",
            "pe section",
            "low software",
            "packing t1045",
            "ransomware",
            "egregor",
            "find",
            "false",
            "psexec",
            "powershell",
            "qakbot",
            "qbot",
            "icedid"
          ],
          "references": [
            "redhatdelete.com",
            "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
            "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
            "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
            "Trojan-Ransom.Win32.Blocker.jgb Checkin",
            "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "target": null
            },
            {
              "id": "Rostpay",
              "display_name": "Rostpay",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Mitre Attack",
              "display_name": "Mitre Attack",
              "target": null
            },
            {
              "id": "Chaos (ELF)",
              "display_name": "Chaos (ELF)",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/GameHack",
              "display_name": "TrojanDropper:Win32/GameHack",
              "target": "/malware/TrojanDropper:Win32/GameHack"
            },
            {
              "id": "Win.Ransomware.Locky-7766366-0",
              "display_name": "Win.Ransomware.Locky-7766366-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt.A!rsm",
              "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
              "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_pid",
              "display_name": "ALF:E5.SpikeAex.rhh_pid",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1107",
              "name": "File Deletion",
              "display_name": "T1107 - File Deletion"
            },
            {
              "id": "T1563",
              "name": "Remote Service Session Hijacking",
              "display_name": "T1563 - Remote Service Session Hijacking"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 57,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1848,
            "FileHash-SHA1": 1783,
            "FileHash-SHA256": 7170,
            "domain": 1649,
            "hostname": 1191,
            "email": 9,
            "URL": 729,
            "CVE": 2,
            "SSLCertFingerprint": 2,
            "CIDR": 1
          },
          "indicator_count": 14384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d3acf32e1088e76165a307",
          "name": "Locky: File Deletion targeting incriminating archived files.",
          "description": "",
          "modified": "2024-03-20T12:00:39.809000",
          "created": "2024-02-19T19:33:07.504000",
          "tags": [
            "it consultant",
            "uk collection",
            "dns intel",
            "ips collection",
            "suspicous ip",
            "whois file",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "whois lookup",
            "region create",
            "domain",
            "name server",
            "registrant name",
            "technical city",
            "region update",
            "united",
            "command decode",
            "mitre att",
            "suricata ipv4",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ck id",
            "cookie",
            "meta",
            "february",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "dns replication",
            "code",
            "namecheap",
            "registrar abuse",
            "namecheap inc",
            "privacy service",
            "withheld",
            "privacy",
            "dnssec",
            "email",
            "first",
            "bodis",
            "unknown",
            "creation date",
            "search",
            "emails",
            "as397240",
            "date",
            "next",
            "all octoseek",
            "threat roundup",
            "january",
            "june",
            "historical ssl",
            "referrer",
            "contacted",
            "group",
            "execution",
            "phishing",
            "malware",
            "core",
            "malicious",
            "dark power",
            "play ransomware",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "icons library",
            "os2 executable",
            "pe32 linker",
            "gnu linker",
            "compiler",
            "info header",
            "name md5",
            "overlay",
            "passive dns",
            "entries",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "trojan",
            "location united",
            "query",
            "activity dns",
            "observed dns",
            "msie",
            "high",
            "copy",
            "write",
            "win32",
            "hashes",
            "host interaction",
            "sabey type",
            "hallrender",
            "brian sabey",
            "memory pattern",
            "http requests",
            "http method",
            "get response",
            "dns resolutions",
            "ip traffic",
            "domains",
            "mutex",
            "samplepath",
            "created",
            "shell commands",
            "r processes",
            "tree",
            "analyze",
            "hostnames",
            "url https",
            "samples",
            "hostname",
            "pattern urls",
            "memory",
            "pattern",
            "pattern domains",
            "roundup",
            "formbook",
            "mirai",
            "ben c",
            "injection",
            "server",
            "scan endpoints",
            "show",
            "august",
            "bq feb",
            "chrome",
            "precondition",
            "virtool",
            "downloadmr",
            "body",
            "status",
            "servers",
            "record value",
            "name servers",
            "showing",
            "mailrubar",
            "trojanclicker",
            "slcc2",
            "media center",
            "delete c",
            "malware beacon",
            "suspicious",
            "class",
            "internal",
            "local",
            "encrypt",
            "as15169 google",
            "gmt cache",
            "twitter",
            "rostpay",
            "date hash",
            "avast avg",
            "mtb may",
            "susp",
            "cryp",
            "win32upatre may",
            "mtb showing",
            "lowfi",
            "aaaa",
            "win32pcmega jan",
            "urlshortner dec",
            "urlshortner sep",
            "as133618",
            "nxdomain",
            "as133775 xiamen",
            "germany unknown",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "cobalt strike",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "resolutions",
            "critical risk",
            "apple phone",
            "unlocker",
            "shell code",
            "installer",
            "ursnif",
            "hacktool",
            "emotet",
            "tracker",
            "chaos",
            "ransomexx",
            "xor ddos",
            "xorddos",
            "mitre attack",
            "parent domain",
            "urls url",
            "siblings",
            "metro",
            "communicating",
            "collection",
            "dropped",
            "skynet",
            "youth",
            "com laude",
            "ltd dba",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "akamaias",
            "digitaloceanasn",
            "csc corporate",
            "pt mora",
            "univjos",
            "etisalat misr",
            "acurix networks",
            "pty ltd",
            "beijing baidu",
            "highly targeted",
            "http",
            "network hijacks",
            "redline stealer",
            "whois sslcert",
            "contacted urls",
            "whois whois",
            "september",
            "hidden cobra",
            "threats",
            "kimsuky",
            "service",
            "read c",
            "create c",
            "write c",
            "regsetvalueexa",
            "mozilla",
            "capture",
            "asnone",
            "domain http",
            "request",
            "malware dns",
            "lookup wannacry",
            "default",
            "ransom",
            "push",
            "playgame",
            "command",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "yara detections",
            "debug",
            "icmp traffic",
            "pdb path",
            "pe section",
            "low software",
            "packing t1045",
            "ransomware",
            "egregor",
            "find",
            "false",
            "psexec",
            "powershell",
            "qakbot",
            "qbot",
            "icedid"
          ],
          "references": [
            "redhatdelete.com",
            "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
            "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
            "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
            "Trojan-Ransom.Win32.Blocker.jgb Checkin",
            "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "target": null
            },
            {
              "id": "Rostpay",
              "display_name": "Rostpay",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Mitre Attack",
              "display_name": "Mitre Attack",
              "target": null
            },
            {
              "id": "Chaos (ELF)",
              "display_name": "Chaos (ELF)",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/GameHack",
              "display_name": "TrojanDropper:Win32/GameHack",
              "target": "/malware/TrojanDropper:Win32/GameHack"
            },
            {
              "id": "Win.Ransomware.Locky-7766366-0",
              "display_name": "Win.Ransomware.Locky-7766366-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt.A!rsm",
              "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
              "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_pid",
              "display_name": "ALF:E5.SpikeAex.rhh_pid",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1107",
              "name": "File Deletion",
              "display_name": "T1107 - File Deletion"
            },
            {
              "id": "T1563",
              "name": "Remote Service Session Hijacking",
              "display_name": "T1563 - Remote Service Session Hijacking"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65d34c91868744aa1449fef2",
          "export_count": 64,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1848,
            "FileHash-SHA1": 1783,
            "FileHash-SHA256": 7170,
            "domain": 1649,
            "hostname": 1191,
            "email": 9,
            "URL": 729,
            "CVE": 2,
            "SSLCertFingerprint": 2,
            "CIDR": 1
          },
          "indicator_count": 14384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 234,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d3c31230455f6d8da3a9f0",
          "name": "Locky: File Deletion targeting incriminating archived files II",
          "description": "",
          "modified": "2024-03-20T12:00:39.809000",
          "created": "2024-02-19T21:07:30.887000",
          "tags": [
            "it consultant",
            "uk collection",
            "dns intel",
            "ips collection",
            "suspicous ip",
            "whois file",
            "cname",
            "record type",
            "ttl value",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "whois lookup",
            "region create",
            "domain",
            "name server",
            "registrant name",
            "technical city",
            "region update",
            "united",
            "command decode",
            "mitre att",
            "suricata ipv4",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ck id",
            "cookie",
            "meta",
            "february",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "dns replication",
            "code",
            "namecheap",
            "registrar abuse",
            "namecheap inc",
            "privacy service",
            "withheld",
            "privacy",
            "dnssec",
            "email",
            "first",
            "bodis",
            "unknown",
            "creation date",
            "search",
            "emails",
            "as397240",
            "date",
            "next",
            "all octoseek",
            "threat roundup",
            "january",
            "june",
            "historical ssl",
            "referrer",
            "contacted",
            "group",
            "execution",
            "phishing",
            "malware",
            "core",
            "malicious",
            "dark power",
            "play ransomware",
            "pe32",
            "intel",
            "ms windows",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "icons library",
            "os2 executable",
            "pe32 linker",
            "gnu linker",
            "compiler",
            "info header",
            "name md5",
            "overlay",
            "passive dns",
            "entries",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "trojan",
            "location united",
            "query",
            "activity dns",
            "observed dns",
            "msie",
            "high",
            "copy",
            "write",
            "win32",
            "hashes",
            "host interaction",
            "sabey type",
            "hallrender",
            "brian sabey",
            "memory pattern",
            "http requests",
            "http method",
            "get response",
            "dns resolutions",
            "ip traffic",
            "domains",
            "mutex",
            "samplepath",
            "created",
            "shell commands",
            "r processes",
            "tree",
            "analyze",
            "hostnames",
            "url https",
            "samples",
            "hostname",
            "pattern urls",
            "memory",
            "pattern",
            "pattern domains",
            "roundup",
            "formbook",
            "mirai",
            "ben c",
            "injection",
            "server",
            "scan endpoints",
            "show",
            "august",
            "bq feb",
            "chrome",
            "precondition",
            "virtool",
            "downloadmr",
            "body",
            "status",
            "servers",
            "record value",
            "name servers",
            "showing",
            "mailrubar",
            "trojanclicker",
            "slcc2",
            "media center",
            "delete c",
            "malware beacon",
            "suspicious",
            "class",
            "internal",
            "local",
            "encrypt",
            "as15169 google",
            "gmt cache",
            "twitter",
            "rostpay",
            "date hash",
            "avast avg",
            "mtb may",
            "susp",
            "cryp",
            "win32upatre may",
            "mtb showing",
            "lowfi",
            "aaaa",
            "win32pcmega jan",
            "urlshortner dec",
            "urlshortner sep",
            "as133618",
            "nxdomain",
            "as133775 xiamen",
            "germany unknown",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "cobalt strike",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "resolutions",
            "critical risk",
            "apple phone",
            "unlocker",
            "shell code",
            "installer",
            "ursnif",
            "hacktool",
            "emotet",
            "tracker",
            "chaos",
            "ransomexx",
            "xor ddos",
            "xorddos",
            "mitre attack",
            "parent domain",
            "urls url",
            "siblings",
            "metro",
            "communicating",
            "collection",
            "dropped",
            "skynet",
            "youth",
            "com laude",
            "ltd dba",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "akamaias",
            "digitaloceanasn",
            "csc corporate",
            "pt mora",
            "univjos",
            "etisalat misr",
            "acurix networks",
            "pty ltd",
            "beijing baidu",
            "highly targeted",
            "http",
            "network hijacks",
            "redline stealer",
            "whois sslcert",
            "contacted urls",
            "whois whois",
            "september",
            "hidden cobra",
            "threats",
            "kimsuky",
            "service",
            "read c",
            "create c",
            "write c",
            "regsetvalueexa",
            "mozilla",
            "capture",
            "asnone",
            "domain http",
            "request",
            "malware dns",
            "lookup wannacry",
            "default",
            "ransom",
            "push",
            "playgame",
            "command",
            "email document",
            "exploit domain",
            "owner exploit",
            "kit exploit",
            "source file",
            "hacking tools",
            "hunting macro",
            "malware hosting",
            "memory scanning",
            "yara detections",
            "debug",
            "icmp traffic",
            "pdb path",
            "pe section",
            "low software",
            "packing t1045",
            "ransomware",
            "egregor",
            "find",
            "false",
            "psexec",
            "powershell",
            "qakbot",
            "qbot",
            "icedid"
          ],
          "references": [
            "redhatdelete.com",
            "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
            "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
            "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
            "Trojan-Ransom.Win32.Blocker.jgb Checkin",
            "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Australia",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
              "target": null
            },
            {
              "id": "Rostpay",
              "display_name": "Rostpay",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Mitre Attack",
              "display_name": "Mitre Attack",
              "target": null
            },
            {
              "id": "Chaos (ELF)",
              "display_name": "Chaos (ELF)",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/GameHack",
              "display_name": "TrojanDropper:Win32/GameHack",
              "target": "/malware/TrojanDropper:Win32/GameHack"
            },
            {
              "id": "Win.Ransomware.Locky-7766366-0",
              "display_name": "Win.Ransomware.Locky-7766366-0",
              "target": null
            },
            {
              "id": "Ransom:Win32/WannaCrypt.A!rsm",
              "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
              "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_pid",
              "display_name": "ALF:E5.SpikeAex.rhh_pid",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1107",
              "name": "File Deletion",
              "display_name": "T1107 - File Deletion"
            },
            {
              "id": "T1563",
              "name": "Remote Service Session Hijacking",
              "display_name": "T1563 - Remote Service Session Hijacking"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65d34c8a64436a7aee2e25a1",
          "export_count": 73,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Enqrypted",
            "id": "272105",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1848,
            "FileHash-SHA1": 1783,
            "FileHash-SHA256": 7170,
            "domain": 1649,
            "hostname": 1191,
            "email": 9,
            "URL": 729,
            "CVE": 2,
            "SSLCertFingerprint": 2,
            "CIDR": 1
          },
          "indicator_count": 14384,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 62,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "redhatdelete.com",
        "Trojan-Ransom.Win32.Blocker.jgb Checkin",
        "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695",
        "https://www.virustotal.com/graph/gf9fb2090ae8e450dadda45c0596ab774ed1984e89aab4679bc3fc02096e22fa3",
        "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
        "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
        "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Mitre attack",
            "Ransom:win32/wannacrypt.a!rsm",
            "Trojan-ransom.win32.blocker.jgb checkin",
            "Mirai",
            "Win.ransomware.locky-7766366-0",
            "Trojandropper:win32/gamehack",
            "Chaos (elf)",
            "Alf:e5.spikeaex.rhh_pid",
            "Virtool",
            "Rostpay"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "68705b9e13e074fa3c778902",
      "name": "check",
      "description": "",
      "modified": "2026-01-23T01:10:39.457000",
      "created": "2025-07-11T00:32:30.277000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 421,
        "FileHash-MD5": 25,
        "FileHash-SHA1": 22,
        "FileHash-SHA256": 133,
        "domain": 270,
        "hostname": 35
      },
      "indicator_count": 906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "688c8526be7a4df33863b5c5",
      "name": "VirusTotal - Shiz.ivr",
      "description": "*Win.Trojan.Shiz.ivr\n*PWS:Win32/Simda.D\n*virtool #injection#infostealer #network #cnc #block_not #virustotal_google #cnc #checking #procmem_yara\n#injection_inter_process\n#injection_create_remote_thread\n#antidebug_windows\n#multiple_useragents\n#network_fake_useragent\n#persistence_autorun\n#cape_detected_threat\n#antiav_detectfile\n#modify_proxy\n#deletes_self\n#infostealer_cookies\n#injection_createremotethread\n#suricata_alert\n~ vashti",
      "modified": "2025-08-31T08:01:04.297000",
      "created": "2025-08-01T09:13:10.510000",
      "tags": [
        "dynamicloader",
        "unknown",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "suspicious",
        "search",
        "high",
        "show",
        "copy",
        "possible",
        "write",
        "internal",
        "malware",
        "push",
        "local",
        "next",
        "contacted",
        "domains",
        "pulses",
        "related tags",
        "file type",
        "date april",
        "pm size",
        "sha1 sha256",
        "imphash pehash",
        "virustotal api",
        "bq jul",
        "united",
        "trojan",
        "backdoor",
        "virtool",
        "cnc beacon",
        "entries",
        "path max",
        "passive dns",
        "next associated",
        "cookie",
        "twitter",
        "body",
        "date",
        "medium",
        "simda",
        "global"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 10303,
        "hostname": 1413,
        "FileHash-SHA256": 1868,
        "domain": 1877,
        "FileHash-MD5": 357,
        "FileHash-SHA1": 348,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 16168,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "274 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "5daf09a6d16f1e2c5c594c22",
      "name": "Simda - Malware Domain Feed V2",
      "description": "Command and Control domains for malware known as Simda. These domains are extracted from malware sandbox reports using                             a Machine Learning model trained on a corpus of good and bad domains.",
      "modified": "2025-07-15T21:13:57.066000",
      "created": "2019-10-22T13:52:38.770000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "otxrobottwo",
        "id": "78495",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 209,
        "hostname": 5
      },
      "indicator_count": 214,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1085,
      "modified_text": "320 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67fb185eb96e9791cf24ced4",
      "name": "Shiz/Packy",
      "description": "",
      "modified": "2025-05-13T01:03:15.390000",
      "created": "2025-04-13T01:50:22.707000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/gf9fb2090ae8e450dadda45c0596ab774ed1984e89aab4679bc3fc02096e22fa3"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 26,
        "URL": 191,
        "domain": 344,
        "hostname": 2
      },
      "indicator_count": 563,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "384 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d34c8a64436a7aee2e25a1",
      "name": "Locky: File Deletion targeting incriminating archived files.",
      "description": "redhatdelete.com : Adversaries are deleting files in bulk  from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.",
      "modified": "2024-03-20T12:00:39.809000",
      "created": "2024-02-19T12:41:46.707000",
      "tags": [
        "it consultant",
        "uk collection",
        "dns intel",
        "ips collection",
        "suspicous ip",
        "whois file",
        "cname",
        "record type",
        "ttl value",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "whois lookup",
        "region create",
        "domain",
        "name server",
        "registrant name",
        "technical city",
        "region update",
        "united",
        "command decode",
        "mitre att",
        "suricata ipv4",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ck id",
        "cookie",
        "meta",
        "february",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "dns replication",
        "code",
        "namecheap",
        "registrar abuse",
        "namecheap inc",
        "privacy service",
        "withheld",
        "privacy",
        "dnssec",
        "email",
        "first",
        "bodis",
        "unknown",
        "creation date",
        "search",
        "emails",
        "as397240",
        "date",
        "next",
        "all octoseek",
        "threat roundup",
        "january",
        "june",
        "historical ssl",
        "referrer",
        "contacted",
        "group",
        "execution",
        "phishing",
        "malware",
        "core",
        "malicious",
        "dark power",
        "play ransomware",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "icons library",
        "os2 executable",
        "pe32 linker",
        "gnu linker",
        "compiler",
        "info header",
        "name md5",
        "overlay",
        "passive dns",
        "entries",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "trojan",
        "location united",
        "query",
        "activity dns",
        "observed dns",
        "msie",
        "high",
        "copy",
        "write",
        "win32",
        "hashes",
        "host interaction",
        "sabey type",
        "hallrender",
        "brian sabey",
        "memory pattern",
        "http requests",
        "http method",
        "get response",
        "dns resolutions",
        "ip traffic",
        "domains",
        "mutex",
        "samplepath",
        "created",
        "shell commands",
        "r processes",
        "tree",
        "analyze",
        "hostnames",
        "url https",
        "samples",
        "hostname",
        "pattern urls",
        "memory",
        "pattern",
        "pattern domains",
        "roundup",
        "formbook",
        "mirai",
        "ben c",
        "injection",
        "server",
        "scan endpoints",
        "show",
        "august",
        "bq feb",
        "chrome",
        "precondition",
        "virtool",
        "downloadmr",
        "body",
        "status",
        "servers",
        "record value",
        "name servers",
        "showing",
        "mailrubar",
        "trojanclicker",
        "slcc2",
        "media center",
        "delete c",
        "malware beacon",
        "suspicious",
        "class",
        "internal",
        "local",
        "encrypt",
        "as15169 google",
        "gmt cache",
        "twitter",
        "rostpay",
        "date hash",
        "avast avg",
        "mtb may",
        "susp",
        "cryp",
        "win32upatre may",
        "mtb showing",
        "lowfi",
        "aaaa",
        "win32pcmega jan",
        "urlshortner dec",
        "urlshortner sep",
        "as133618",
        "nxdomain",
        "as133775 xiamen",
        "germany unknown",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "cobalt strike",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "resolutions",
        "critical risk",
        "apple phone",
        "unlocker",
        "shell code",
        "installer",
        "ursnif",
        "hacktool",
        "emotet",
        "tracker",
        "chaos",
        "ransomexx",
        "xor ddos",
        "xorddos",
        "mitre attack",
        "parent domain",
        "urls url",
        "siblings",
        "metro",
        "communicating",
        "collection",
        "dropped",
        "skynet",
        "youth",
        "com laude",
        "ltd dba",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "akamaias",
        "digitaloceanasn",
        "csc corporate",
        "pt mora",
        "univjos",
        "etisalat misr",
        "acurix networks",
        "pty ltd",
        "beijing baidu",
        "highly targeted",
        "http",
        "network hijacks",
        "redline stealer",
        "whois sslcert",
        "contacted urls",
        "whois whois",
        "september",
        "hidden cobra",
        "threats",
        "kimsuky",
        "service",
        "read c",
        "create c",
        "write c",
        "regsetvalueexa",
        "mozilla",
        "capture",
        "asnone",
        "domain http",
        "request",
        "malware dns",
        "lookup wannacry",
        "default",
        "ransom",
        "push",
        "playgame",
        "command",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "yara detections",
        "debug",
        "icmp traffic",
        "pdb path",
        "pe section",
        "low software",
        "packing t1045",
        "ransomware",
        "egregor",
        "find",
        "false",
        "psexec",
        "powershell",
        "qakbot",
        "qbot",
        "icedid"
      ],
      "references": [
        "redhatdelete.com",
        "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
        "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
        "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
        "Trojan-Ransom.Win32.Blocker.jgb Checkin",
        "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Australia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "target": null
        },
        {
          "id": "Rostpay",
          "display_name": "Rostpay",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Mitre Attack",
          "display_name": "Mitre Attack",
          "target": null
        },
        {
          "id": "Chaos (ELF)",
          "display_name": "Chaos (ELF)",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/GameHack",
          "display_name": "TrojanDropper:Win32/GameHack",
          "target": "/malware/TrojanDropper:Win32/GameHack"
        },
        {
          "id": "Win.Ransomware.Locky-7766366-0",
          "display_name": "Win.Ransomware.Locky-7766366-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt.A!rsm",
          "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
          "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_pid",
          "display_name": "ALF:E5.SpikeAex.rhh_pid",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1107",
          "name": "File Deletion",
          "display_name": "T1107 - File Deletion"
        },
        {
          "id": "T1563",
          "name": "Remote Service Session Hijacking",
          "display_name": "T1563 - Remote Service Session Hijacking"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 65,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1848,
        "FileHash-SHA1": 1783,
        "FileHash-SHA256": 7170,
        "domain": 1649,
        "hostname": 1191,
        "email": 9,
        "URL": 729,
        "CVE": 2,
        "SSLCertFingerprint": 2,
        "CIDR": 1
      },
      "indicator_count": 14384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d34c91868744aa1449fef2",
      "name": "Locky: File Deletion targeting incriminating archived files.",
      "description": "redhatdelete.com : Adversaries are deleting files in bulk  from Virustotal, otx AlienVault, WebArchive, Perma.cc Urlscan.io, Archive.Today, Archive.ph, iCloud, apple data, photo deletion.\nVarious ransomware used. iOS service modified, cloud encrypted by adversary. Indicator point to a target with a zombie device. An iPhone and potentially other devices were targeted in a specific attack. | Locky Ransomware is a piece of malware that encrypts important files on your device, rendering them inaccessible and unusable.",
      "modified": "2024-03-20T12:00:39.809000",
      "created": "2024-02-19T12:41:52.846000",
      "tags": [
        "it consultant",
        "uk collection",
        "dns intel",
        "ips collection",
        "suspicous ip",
        "whois file",
        "cname",
        "record type",
        "ttl value",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "whois lookup",
        "region create",
        "domain",
        "name server",
        "registrant name",
        "technical city",
        "region update",
        "united",
        "command decode",
        "mitre att",
        "suricata ipv4",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ck id",
        "cookie",
        "meta",
        "february",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "dns replication",
        "code",
        "namecheap",
        "registrar abuse",
        "namecheap inc",
        "privacy service",
        "withheld",
        "privacy",
        "dnssec",
        "email",
        "first",
        "bodis",
        "unknown",
        "creation date",
        "search",
        "emails",
        "as397240",
        "date",
        "next",
        "all octoseek",
        "threat roundup",
        "january",
        "june",
        "historical ssl",
        "referrer",
        "contacted",
        "group",
        "execution",
        "phishing",
        "malware",
        "core",
        "malicious",
        "dark power",
        "play ransomware",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "icons library",
        "os2 executable",
        "pe32 linker",
        "gnu linker",
        "compiler",
        "info header",
        "name md5",
        "overlay",
        "passive dns",
        "entries",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "trojan",
        "location united",
        "query",
        "activity dns",
        "observed dns",
        "msie",
        "high",
        "copy",
        "write",
        "win32",
        "hashes",
        "host interaction",
        "sabey type",
        "hallrender",
        "brian sabey",
        "memory pattern",
        "http requests",
        "http method",
        "get response",
        "dns resolutions",
        "ip traffic",
        "domains",
        "mutex",
        "samplepath",
        "created",
        "shell commands",
        "r processes",
        "tree",
        "analyze",
        "hostnames",
        "url https",
        "samples",
        "hostname",
        "pattern urls",
        "memory",
        "pattern",
        "pattern domains",
        "roundup",
        "formbook",
        "mirai",
        "ben c",
        "injection",
        "server",
        "scan endpoints",
        "show",
        "august",
        "bq feb",
        "chrome",
        "precondition",
        "virtool",
        "downloadmr",
        "body",
        "status",
        "servers",
        "record value",
        "name servers",
        "showing",
        "mailrubar",
        "trojanclicker",
        "slcc2",
        "media center",
        "delete c",
        "malware beacon",
        "suspicious",
        "class",
        "internal",
        "local",
        "encrypt",
        "as15169 google",
        "gmt cache",
        "twitter",
        "rostpay",
        "date hash",
        "avast avg",
        "mtb may",
        "susp",
        "cryp",
        "win32upatre may",
        "mtb showing",
        "lowfi",
        "aaaa",
        "win32pcmega jan",
        "urlshortner dec",
        "urlshortner sep",
        "as133618",
        "nxdomain",
        "as133775 xiamen",
        "germany unknown",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "cobalt strike",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "resolutions",
        "critical risk",
        "apple phone",
        "unlocker",
        "shell code",
        "installer",
        "ursnif",
        "hacktool",
        "emotet",
        "tracker",
        "chaos",
        "ransomexx",
        "xor ddos",
        "xorddos",
        "mitre attack",
        "parent domain",
        "urls url",
        "siblings",
        "metro",
        "communicating",
        "collection",
        "dropped",
        "skynet",
        "youth",
        "com laude",
        "ltd dba",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "akamaias",
        "digitaloceanasn",
        "csc corporate",
        "pt mora",
        "univjos",
        "etisalat misr",
        "acurix networks",
        "pty ltd",
        "beijing baidu",
        "highly targeted",
        "http",
        "network hijacks",
        "redline stealer",
        "whois sslcert",
        "contacted urls",
        "whois whois",
        "september",
        "hidden cobra",
        "threats",
        "kimsuky",
        "service",
        "read c",
        "create c",
        "write c",
        "regsetvalueexa",
        "mozilla",
        "capture",
        "asnone",
        "domain http",
        "request",
        "malware dns",
        "lookup wannacry",
        "default",
        "ransom",
        "push",
        "playgame",
        "command",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "yara detections",
        "debug",
        "icmp traffic",
        "pdb path",
        "pe section",
        "low software",
        "packing t1045",
        "ransomware",
        "egregor",
        "find",
        "false",
        "psexec",
        "powershell",
        "qakbot",
        "qbot",
        "icedid"
      ],
      "references": [
        "redhatdelete.com",
        "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
        "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
        "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
        "Trojan-Ransom.Win32.Blocker.jgb Checkin",
        "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Australia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "target": null
        },
        {
          "id": "Rostpay",
          "display_name": "Rostpay",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Mitre Attack",
          "display_name": "Mitre Attack",
          "target": null
        },
        {
          "id": "Chaos (ELF)",
          "display_name": "Chaos (ELF)",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/GameHack",
          "display_name": "TrojanDropper:Win32/GameHack",
          "target": "/malware/TrojanDropper:Win32/GameHack"
        },
        {
          "id": "Win.Ransomware.Locky-7766366-0",
          "display_name": "Win.Ransomware.Locky-7766366-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt.A!rsm",
          "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
          "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_pid",
          "display_name": "ALF:E5.SpikeAex.rhh_pid",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1107",
          "name": "File Deletion",
          "display_name": "T1107 - File Deletion"
        },
        {
          "id": "T1563",
          "name": "Remote Service Session Hijacking",
          "display_name": "T1563 - Remote Service Session Hijacking"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 57,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1848,
        "FileHash-SHA1": 1783,
        "FileHash-SHA256": 7170,
        "domain": 1649,
        "hostname": 1191,
        "email": 9,
        "URL": 729,
        "CVE": 2,
        "SSLCertFingerprint": 2,
        "CIDR": 1
      },
      "indicator_count": 14384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d3acf32e1088e76165a307",
      "name": "Locky: File Deletion targeting incriminating archived files.",
      "description": "",
      "modified": "2024-03-20T12:00:39.809000",
      "created": "2024-02-19T19:33:07.504000",
      "tags": [
        "it consultant",
        "uk collection",
        "dns intel",
        "ips collection",
        "suspicous ip",
        "whois file",
        "cname",
        "record type",
        "ttl value",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "whois lookup",
        "region create",
        "domain",
        "name server",
        "registrant name",
        "technical city",
        "region update",
        "united",
        "command decode",
        "mitre att",
        "suricata ipv4",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ck id",
        "cookie",
        "meta",
        "february",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "dns replication",
        "code",
        "namecheap",
        "registrar abuse",
        "namecheap inc",
        "privacy service",
        "withheld",
        "privacy",
        "dnssec",
        "email",
        "first",
        "bodis",
        "unknown",
        "creation date",
        "search",
        "emails",
        "as397240",
        "date",
        "next",
        "all octoseek",
        "threat roundup",
        "january",
        "june",
        "historical ssl",
        "referrer",
        "contacted",
        "group",
        "execution",
        "phishing",
        "malware",
        "core",
        "malicious",
        "dark power",
        "play ransomware",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "icons library",
        "os2 executable",
        "pe32 linker",
        "gnu linker",
        "compiler",
        "info header",
        "name md5",
        "overlay",
        "passive dns",
        "entries",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "trojan",
        "location united",
        "query",
        "activity dns",
        "observed dns",
        "msie",
        "high",
        "copy",
        "write",
        "win32",
        "hashes",
        "host interaction",
        "sabey type",
        "hallrender",
        "brian sabey",
        "memory pattern",
        "http requests",
        "http method",
        "get response",
        "dns resolutions",
        "ip traffic",
        "domains",
        "mutex",
        "samplepath",
        "created",
        "shell commands",
        "r processes",
        "tree",
        "analyze",
        "hostnames",
        "url https",
        "samples",
        "hostname",
        "pattern urls",
        "memory",
        "pattern",
        "pattern domains",
        "roundup",
        "formbook",
        "mirai",
        "ben c",
        "injection",
        "server",
        "scan endpoints",
        "show",
        "august",
        "bq feb",
        "chrome",
        "precondition",
        "virtool",
        "downloadmr",
        "body",
        "status",
        "servers",
        "record value",
        "name servers",
        "showing",
        "mailrubar",
        "trojanclicker",
        "slcc2",
        "media center",
        "delete c",
        "malware beacon",
        "suspicious",
        "class",
        "internal",
        "local",
        "encrypt",
        "as15169 google",
        "gmt cache",
        "twitter",
        "rostpay",
        "date hash",
        "avast avg",
        "mtb may",
        "susp",
        "cryp",
        "win32upatre may",
        "mtb showing",
        "lowfi",
        "aaaa",
        "win32pcmega jan",
        "urlshortner dec",
        "urlshortner sep",
        "as133618",
        "nxdomain",
        "as133775 xiamen",
        "germany unknown",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "cobalt strike",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "resolutions",
        "critical risk",
        "apple phone",
        "unlocker",
        "shell code",
        "installer",
        "ursnif",
        "hacktool",
        "emotet",
        "tracker",
        "chaos",
        "ransomexx",
        "xor ddos",
        "xorddos",
        "mitre attack",
        "parent domain",
        "urls url",
        "siblings",
        "metro",
        "communicating",
        "collection",
        "dropped",
        "skynet",
        "youth",
        "com laude",
        "ltd dba",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "akamaias",
        "digitaloceanasn",
        "csc corporate",
        "pt mora",
        "univjos",
        "etisalat misr",
        "acurix networks",
        "pty ltd",
        "beijing baidu",
        "highly targeted",
        "http",
        "network hijacks",
        "redline stealer",
        "whois sslcert",
        "contacted urls",
        "whois whois",
        "september",
        "hidden cobra",
        "threats",
        "kimsuky",
        "service",
        "read c",
        "create c",
        "write c",
        "regsetvalueexa",
        "mozilla",
        "capture",
        "asnone",
        "domain http",
        "request",
        "malware dns",
        "lookup wannacry",
        "default",
        "ransom",
        "push",
        "playgame",
        "command",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "yara detections",
        "debug",
        "icmp traffic",
        "pdb path",
        "pe section",
        "low software",
        "packing t1045",
        "ransomware",
        "egregor",
        "find",
        "false",
        "psexec",
        "powershell",
        "qakbot",
        "qbot",
        "icedid"
      ],
      "references": [
        "redhatdelete.com",
        "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
        "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
        "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
        "Trojan-Ransom.Win32.Blocker.jgb Checkin",
        "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Australia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "target": null
        },
        {
          "id": "Rostpay",
          "display_name": "Rostpay",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Mitre Attack",
          "display_name": "Mitre Attack",
          "target": null
        },
        {
          "id": "Chaos (ELF)",
          "display_name": "Chaos (ELF)",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/GameHack",
          "display_name": "TrojanDropper:Win32/GameHack",
          "target": "/malware/TrojanDropper:Win32/GameHack"
        },
        {
          "id": "Win.Ransomware.Locky-7766366-0",
          "display_name": "Win.Ransomware.Locky-7766366-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt.A!rsm",
          "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
          "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_pid",
          "display_name": "ALF:E5.SpikeAex.rhh_pid",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1107",
          "name": "File Deletion",
          "display_name": "T1107 - File Deletion"
        },
        {
          "id": "T1563",
          "name": "Remote Service Session Hijacking",
          "display_name": "T1563 - Remote Service Session Hijacking"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65d34c91868744aa1449fef2",
      "export_count": 64,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1848,
        "FileHash-SHA1": 1783,
        "FileHash-SHA256": 7170,
        "domain": 1649,
        "hostname": 1191,
        "email": 9,
        "URL": 729,
        "CVE": 2,
        "SSLCertFingerprint": 2,
        "CIDR": 1
      },
      "indicator_count": 14384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 234,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d3c31230455f6d8da3a9f0",
      "name": "Locky: File Deletion targeting incriminating archived files II",
      "description": "",
      "modified": "2024-03-20T12:00:39.809000",
      "created": "2024-02-19T21:07:30.887000",
      "tags": [
        "it consultant",
        "uk collection",
        "dns intel",
        "ips collection",
        "suspicous ip",
        "whois file",
        "cname",
        "record type",
        "ttl value",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "whois lookup",
        "region create",
        "domain",
        "name server",
        "registrant name",
        "technical city",
        "region update",
        "united",
        "command decode",
        "mitre att",
        "suricata ipv4",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ck id",
        "cookie",
        "meta",
        "february",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "dns replication",
        "code",
        "namecheap",
        "registrar abuse",
        "namecheap inc",
        "privacy service",
        "withheld",
        "privacy",
        "dnssec",
        "email",
        "first",
        "bodis",
        "unknown",
        "creation date",
        "search",
        "emails",
        "as397240",
        "date",
        "next",
        "all octoseek",
        "threat roundup",
        "january",
        "june",
        "historical ssl",
        "referrer",
        "contacted",
        "group",
        "execution",
        "phishing",
        "malware",
        "core",
        "malicious",
        "dark power",
        "play ransomware",
        "pe32",
        "intel",
        "ms windows",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "icons library",
        "os2 executable",
        "pe32 linker",
        "gnu linker",
        "compiler",
        "info header",
        "name md5",
        "overlay",
        "passive dns",
        "entries",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "trojan",
        "location united",
        "query",
        "activity dns",
        "observed dns",
        "msie",
        "high",
        "copy",
        "write",
        "win32",
        "hashes",
        "host interaction",
        "sabey type",
        "hallrender",
        "brian sabey",
        "memory pattern",
        "http requests",
        "http method",
        "get response",
        "dns resolutions",
        "ip traffic",
        "domains",
        "mutex",
        "samplepath",
        "created",
        "shell commands",
        "r processes",
        "tree",
        "analyze",
        "hostnames",
        "url https",
        "samples",
        "hostname",
        "pattern urls",
        "memory",
        "pattern",
        "pattern domains",
        "roundup",
        "formbook",
        "mirai",
        "ben c",
        "injection",
        "server",
        "scan endpoints",
        "show",
        "august",
        "bq feb",
        "chrome",
        "precondition",
        "virtool",
        "downloadmr",
        "body",
        "status",
        "servers",
        "record value",
        "name servers",
        "showing",
        "mailrubar",
        "trojanclicker",
        "slcc2",
        "media center",
        "delete c",
        "malware beacon",
        "suspicious",
        "class",
        "internal",
        "local",
        "encrypt",
        "as15169 google",
        "gmt cache",
        "twitter",
        "rostpay",
        "date hash",
        "avast avg",
        "mtb may",
        "susp",
        "cryp",
        "win32upatre may",
        "mtb showing",
        "lowfi",
        "aaaa",
        "win32pcmega jan",
        "urlshortner dec",
        "urlshortner sep",
        "as133618",
        "nxdomain",
        "as133775 xiamen",
        "germany unknown",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "cobalt strike",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "resolutions",
        "critical risk",
        "apple phone",
        "unlocker",
        "shell code",
        "installer",
        "ursnif",
        "hacktool",
        "emotet",
        "tracker",
        "chaos",
        "ransomexx",
        "xor ddos",
        "xorddos",
        "mitre attack",
        "parent domain",
        "urls url",
        "siblings",
        "metro",
        "communicating",
        "collection",
        "dropped",
        "skynet",
        "youth",
        "com laude",
        "ltd dba",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "akamaias",
        "digitaloceanasn",
        "csc corporate",
        "pt mora",
        "univjos",
        "etisalat misr",
        "acurix networks",
        "pty ltd",
        "beijing baidu",
        "highly targeted",
        "http",
        "network hijacks",
        "redline stealer",
        "whois sslcert",
        "contacted urls",
        "whois whois",
        "september",
        "hidden cobra",
        "threats",
        "kimsuky",
        "service",
        "read c",
        "create c",
        "write c",
        "regsetvalueexa",
        "mozilla",
        "capture",
        "asnone",
        "domain http",
        "request",
        "malware dns",
        "lookup wannacry",
        "default",
        "ransom",
        "push",
        "playgame",
        "command",
        "email document",
        "exploit domain",
        "owner exploit",
        "kit exploit",
        "source file",
        "hacking tools",
        "hunting macro",
        "malware hosting",
        "memory scanning",
        "yara detections",
        "debug",
        "icmp traffic",
        "pdb path",
        "pe section",
        "low software",
        "packing t1045",
        "ransomware",
        "egregor",
        "find",
        "false",
        "psexec",
        "powershell",
        "qakbot",
        "qbot",
        "icedid"
      ],
      "references": [
        "redhatdelete.com",
        "Mutexes Opened {0C8E6D89-EA51-848A-7775-6C2CC072CA88}",
        "explorer.exe \u2022  Explorer.EXE \u2022\tupnaneat-xex.exe \u2022 akgibik.exe \u2022 wmiadap.exe \u2022 wmiprvse.exe \u2022 winlogon.exe \u2022 tmpo3rfa1vg.exe",
        "https://otx.alienvault.com/indicator/file/f58f360a1f6b5e3e28fa64dd88ec2c9893f2f1d290f4a8cf67ac49952e32cc60",
        "Trojan-Ransom.Win32.Blocker.jgb Checkin",
        "https://otx.alienvault.com/indicator/file/000ad3f22cedbd36e425ca046b2aa0c228754b6fd94d30105ad9343ad9742695"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Australia",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "display_name": "Trojan-Ransom.Win32.Blocker.jgb Checkin",
          "target": null
        },
        {
          "id": "Rostpay",
          "display_name": "Rostpay",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Mitre Attack",
          "display_name": "Mitre Attack",
          "target": null
        },
        {
          "id": "Chaos (ELF)",
          "display_name": "Chaos (ELF)",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/GameHack",
          "display_name": "TrojanDropper:Win32/GameHack",
          "target": "/malware/TrojanDropper:Win32/GameHack"
        },
        {
          "id": "Win.Ransomware.Locky-7766366-0",
          "display_name": "Win.Ransomware.Locky-7766366-0",
          "target": null
        },
        {
          "id": "Ransom:Win32/WannaCrypt.A!rsm",
          "display_name": "Ransom:Win32/WannaCrypt.A!rsm",
          "target": "/malware/Ransom:Win32/WannaCrypt.A!rsm"
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_pid",
          "display_name": "ALF:E5.SpikeAex.rhh_pid",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1107",
          "name": "File Deletion",
          "display_name": "T1107 - File Deletion"
        },
        {
          "id": "T1563",
          "name": "Remote Service Session Hijacking",
          "display_name": "T1563 - Remote Service Session Hijacking"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65d34c8a64436a7aee2e25a1",
      "export_count": 73,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Enqrypted",
        "id": "272105",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1848,
        "FileHash-SHA1": 1783,
        "FileHash-SHA256": 7170,
        "domain": 1649,
        "hostname": 1191,
        "email": 9,
        "URL": 729,
        "CVE": 2,
        "SSLCertFingerprint": 2,
        "CIDR": 1
      },
      "indicator_count": 14384,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 62,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "puvymul.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "puvymul.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780347442.6238186
}