{
  "type": "Domain",
  "indicator": "spmailtechn.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/spmailtechn.com",
    "alexa": "http://www.alexa.com/siteinfo/spmailtechn.com",
    "indicator": "spmailtechn.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3841754461,
      "indicator": "spmailtechn.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68a23eef53f1124e8dc273fc",
          "name": "Sign in to your account - Anorocuriv",
          "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
          "modified": "2025-09-16T20:00:00.565000",
          "created": "2025-08-17T20:43:27.502000",
          "tags": [
            "url http",
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "status",
            "msie",
            "chrome",
            "passive dns",
            "urls",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "body",
            "http",
            "hostname",
            "files domain",
            "present jan",
            "present dec",
            "united",
            "present aug",
            "present jun",
            "unknown aaaa",
            "present mar",
            "present may",
            "present feb",
            "present jul",
            "error",
            "a domains",
            "gmt content",
            "accept encoding",
            "config nocache",
            "hostname add",
            "pulse submit",
            "content type",
            "certificate",
            "ip address",
            "cookie",
            "mita",
            "next associated",
            "please",
            "x msedge",
            "ipv4 add",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "pattern match",
            "mitre att",
            "ascii text",
            "null",
            "click",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "meta",
            "onload",
            "span",
            "adversaries",
            "ssl certificate",
            "logo",
            "av detection",
            "default browser",
            "guest system",
            "professional",
            "falcon sandbox",
            "response risk",
            "ck techniques",
            "detection",
            "show process",
            "prefetch8",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "post collect",
            "microsoft edge",
            "nota",
            "brand",
            "class",
            "facebook",
            "ascii",
            "hex dump",
            "extraction",
            "failed",
            "data upload",
            "pul data",
            "enter",
            "s data",
            "type",
            "extr error",
            "href",
            "mask",
            "extra",
            "uta support",
            "include review",
            "exclude sugges",
            "find",
            "wow64",
            "show",
            "observed dns",
            "query",
            "unknown",
            "virtool",
            "copy",
            "write",
            "defender",
            "expiro",
            "malware",
            "next",
            "lowfi",
            "hookwowlow dec",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "trojan",
            "trojandropper",
            "http request",
            "delete",
            "yara detections",
            "pe exe",
            "dll windows",
            "minimal http",
            "february",
            "guard",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "detections http",
            "http executable",
            "retrieved",
            "location united",
            "america flag",
            "america asn",
            "urls show",
            "date checked",
            "url hostname",
            "server response"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 853,
            "hostname": 1835,
            "URL": 7127,
            "email": 3,
            "FileHash-SHA256": 1470,
            "FileHash-MD5": 293,
            "FileHash-SHA1": 284,
            "SSLCertFingerprint": 426,
            "CVE": 1
          },
          "indicator_count": 12292,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "215 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "669e42fea462f0c8f8db32a1",
          "name": "Worm:Win32/Ganelp.A - Malicious IP: 148.163.152.21",
          "description": "Malicious IP found in disastrous attack against a mid level media marketing firm that the healthcare, travel, corporate event industry. \nEmployee phones are 'zombies' some laptops likely impacted by the Crowd Strike issue, (blue screen). Excessive tracking, monitoring, active botnets, power outage, and more. Research of IP and other IoC's found. Unfortunately, many of the clients are also sucked into issue. It appears that the issue has persisted for several years. The outage just made us work every angle. The attack goes beyond  the CS 'update' outage, as the seemingly well cyber manged firm was under a very targeted, ongoing cyber attack that has kept company from rebounding. Red Team behavior seen.",
          "modified": "2024-08-21T11:03:59.106000",
          "created": "2024-07-22T11:31:10.391000",
          "tags": [
            "historical ssl",
            "referrer",
            "fancy bear",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "open",
            "status",
            "name servers",
            "creation date",
            "search",
            "proofpoint",
            "expiration date",
            "div div",
            "date",
            "accept",
            "next",
            "united",
            "cname",
            "asnone united",
            "a nxdomain",
            "domain",
            "united kingdom",
            "servers",
            "showing",
            "nxdomain",
            "dname",
            "whitelisted",
            "aaaa",
            "script urls",
            "costa rica",
            "script domains",
            "msie",
            "chrome",
            "unknown",
            "body",
            "gmt content",
            "all scoreblue",
            "pulse pulses",
            "entries",
            "as8987 amazon",
            "as20940",
            "hostname",
            "gartner",
            "crowdstrike",
            "business value",
            "magic quadrant",
            "customer",
            "realized",
            "assessment",
            "economic impact",
            "complete",
            "february",
            "utc na",
            "ver2",
            "msclkidn",
            "html info",
            "meta tags",
            "mobileoptimized",
            "adobe dynamic",
            "tag management",
            "utc bing",
            "cobalt strike",
            "communications",
            "android device",
            "neutral",
            "win32 exe",
            "pe32",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "sections",
            "rticon neutral",
            "ico rtgroupicon",
            "xml rtmanifest",
            "overlay",
            "threat roundup",
            "pandas",
            "attacks against",
            "southeast",
            "wannacry kill",
            "switch dns",
            "query",
            "high level",
            "hackers",
            "unknown win",
            "core",
            "ascii text",
            "sha256",
            "sha1",
            "size",
            "pattern match",
            "suricata stream",
            "command decode",
            "utf8 text",
            "mitre att",
            "path",
            "hybrid",
            "starfield",
            "meta",
            "general",
            "target",
            "local",
            "click",
            "strings",
            "trident",
            "legacy",
            "main",
            "contact",
            "flow t1574",
            "dll sideloading",
            "create",
            "modify system",
            "process t1543",
            "windows service",
            "t1055 system",
            "pe file",
            "t1497 query",
            "may sleep",
            "allocate rwx",
            "get file",
            "access",
            "windows event",
            "allocate",
            "link function",
            "windows link",
            "contains pdb",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls tcp",
            "hashes",
            "user",
            "file system",
            "written c",
            "samplepath",
            "files dropped",
            "userprofile",
            "registry keys",
            "registry",
            "set registrya",
            "conhost",
            "comspec",
            "created",
            "temp",
            "windows",
            "displayname",
            "process",
            "commands",
            "signals mutexes",
            "mutexes",
            "full name",
            "data",
            "v3 serial",
            "number",
            "cus cndigicert",
            "tls rsa",
            "ca1 odigicert",
            "inc validity",
            "subject public",
            "certificate",
            "whois lookup",
            "netrange",
            "nethandle",
            "net148",
            "net1480000",
            "as16509",
            "as22843",
            "as13916",
            "form",
            "server",
            "registrar abuse",
            "email",
            "request email",
            "verisign",
            "icann whois",
            "tech",
            "first",
            "project skynet",
            "cyber army",
            "dynamicloader",
            "high",
            "delete c",
            "show",
            "username",
            "medium",
            "default",
            "yara detections",
            "worm",
            "copy",
            "write",
            "duptwux",
            "malware",
            "x82xd4",
            "kx81xdbx0f",
            "x86xd3",
            "xa1xf1",
            "xe8xc2x14",
            "wx99xcdx11",
            "regsetvalueexa",
            "regbinary",
            "xe8xc6x13",
            "hx88x9ax1e",
            "stream",
            "win32",
            "persistence",
            "execution",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "ftp username",
            "contacted",
            "et tor",
            "known tor",
            "misc attack",
            "relayrouter",
            "exit",
            "node traffic",
            "severity",
            "null",
            "refresh",
            "span",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "robtex",
            "apple ios",
            "apple",
            "domains",
            "co number",
            "virtual mobile",
            "logistics",
            "cyber defense",
            "twitter",
            "read c",
            "artemis",
            "intel",
            "steals",
            "virustotal",
            "python",
            "panda",
            "falcon sandbox",
            "analysis",
            "hybrid analysis",
            "submission name",
            "av detection",
            "multi scan",
            "highest",
            "ability",
            "execute",
            "upgrade",
            "intelligence",
            "learn",
            "reports",
            "logo analysis",
            "size17kib type",
            "command",
            "found",
            "layer protocol",
            "osi application",
            "ip address",
            "t1105 ingress",
            "tool transfer",
            "problems",
            "threat network",
            "infrastructure",
            "domains part",
            "domain tracker",
            "roundup",
            "new problems",
            "startpage",
            "e1203 windows",
            "catalog tree",
            "analysis ob0001",
            "b0001 process",
            "b0003 delayed",
            "analysis ob0002",
            "evasion ob0006",
            "ob0007 system",
            "e1082 file",
            "e1083 impact",
            "data manipulation",
            "remote system",
            "discovery",
            "t1059 accept",
            "modules t1129",
            "enumerate",
            "as2914 ntt",
            "access denied",
            "as16625 akamai",
            "germany unknown",
            "csccorpdomains",
            "as31109",
            "invalid url",
            "mirai",
            "port",
            "destination",
            "bad login",
            "suspicious path",
            "nids",
            "tcp syn",
            "root account",
            "cve20185723",
            "as8068",
            "please",
            "x msedge",
            "embeddedwb",
            "windows nt",
            "tofsee",
            "push",
            "as54113",
            "as396982 google",
            "as31898 oracle",
            "moved",
            "encrypt"
          ],
          "references": [
            "148.163.152.21 AS 22843 (PROOFPOINT-ASN-US-EAST) US | www.robtex.com | www.spf-record.com |",
            "Crowdsourced Sigma Rules: Suspicious New Service Creation by Nasreddine Bencherchali (Nextron Systems)",
            "Crowdsourced Sigma Rules: Matches rule Suspicious Svchost Process by Florian Roth (Nextron Systems)",
            "Crowdsourced Sigma Rules: Matches rule Suspect Svchost Activity by David Burkett, @signalblur",
            "Crowdsourced Sigma Rules: Matches rule Suspicious Outbound SMTP Connections by frack113",
            "Crowdsourced Sigma Rules: Matches rule Creation of an Executable by an Executable by frack113",
            "https://www.virustotal.com/gui/file/dcd0812ed0b280cee38a3f8a68e5fde900f0a9f832ca53167d38d96f105eb9b9/detection",
            "Antivirus Detections Win.Trojan.Sality-1047 ,  Worm:Win32/Ganelp.A IDS Detections W32.Duptwux/Ganelp FTP Username - onthelinux Yara Detections InstallShield2000 Alerts persistence_autorun_tasks cape_detected_threat bypass_firewall suricata_alert dynamic_function_loading dropper injection_rwx IP\u2019s Contacted  209.202.252.54",
            "ELF:Mirai-GH\\ [Trj] 91b62309447ba8db2a456b546d02cee07f1fd1027a0dd23b0ad87bec18b5acee",
            "https://hybrid-analysis.com/sample/b31067b40534bc4a9d68ac2f13f6090956d171d23c3d3f7a8c92a8745aed4db3",
            "https://otx.alienvault.com/indicator/file/00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
            "trojan.shellrunner/emailworm: FileHash-SHA256 f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67",
            "https://www.virustotal.com/gui/file/f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67/detection",
            "Trojan.Agent.FRYX: http://email.bidayati.com/c/eJwkkc1ygjoYQJ8Gd3TClwTIwgUR0Aq12BbBbu5EfuQnioVQwKe_03v3Z-bMnJOvbUwtS6yKtWEZjNmMULyq1oAMYto2zZhd2IbIGb6UBdiYCqMoC",
            "Worm:Win32/Ganelp.A: FileHash-SHA256 00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
            "Worm:Win32/Ganelp.A: FileHash-SHA1 0eed684aef678aeffb43866bd2c975876e82eeab",
            "Worm:Win32/Ganelp.A: FileHash-MD5 b5e26ac3b7518b77631ab7bcefae10fe",
            "Trojan.Crypted-6 | infostealer_browser : https://otx.alienvault.com/indicator/file/29971e4a9ce229d79fae4cbdff1b32d2",
            "Falcon-FileVantage.exe | trojan.redcap/python: FileHash-SHA256 06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328",
            "https://www.virustotal.com/gui/file/06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328/detection",
            "apple-carry-relay.cloudflare.com | apple-dns.net | emails.redvue.com | https://arduboy.com/bad-apple-demo-is-good | 67.199.248.12",
            "https://tools.totaleconomicimpact.com/go/apple/TEI/docs/TEI-of-Mac-in-Enterprise.pdf | 79appleway.com | technoapple.com",
            "http://image.nationwide-service.co.uk/lib/fe9515737163077971/m/1/spacer_ApplePay.gif bum?id=326459173&s=143441 | mails.redvue.com",
            "http://www.rvrb.me/fan_reach/pt?eid=A429942_17490857_19605431_lnk1018&url=http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewAl",
            "Antivirus Detections ELF:Mirai-GH\\ [Trj]",
            "IDS Detections Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) Juniper ScreenOS telnet Backdoor Default Password Attempt SUSPICIOUS Path to BusyBox Possible Linux.Mirai Login Attempt (meinsm) Actiontec C1000A backdoor account M2",
            "IDS Detections Win32/Tofsee.AX google.com connectivity check External IP Lookup www.trackip.net Possible",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian - is this a must?",
            "http://images.contact.acams.org/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland"
          ],
          "malware_families": [
            {
              "id": "Trojan.Agent.FRYX",
              "display_name": "Trojan.Agent.FRYX",
              "target": null
            },
            {
              "id": "Win32:AceCrypter-B [Cryp]",
              "display_name": "Win32:AceCrypter-B [Cryp]",
              "target": null
            },
            {
              "id": "Mal_Tofsee",
              "display_name": "Mal_Tofsee",
              "target": null
            },
            {
              "id": "Ransom.StopcryptPMF.",
              "display_name": "Ransom.StopcryptPMF.",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Worm:Win32/Ganelp.A",
              "display_name": "Worm:Win32/Ganelp.A",
              "target": "/malware/Worm:Win32/Ganelp.A"
            },
            {
              "id": "trojan.shellrunner/emailworm",
              "display_name": "trojan.shellrunner/emailworm",
              "target": null
            },
            {
              "id": "trojan.redcap/python",
              "display_name": "trojan.redcap/python",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1569",
              "name": "System Services",
              "display_name": "T1569 - System Services"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1565",
              "name": "Data Manipulation",
              "display_name": "T1565 - Data Manipulation"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1202",
              "name": "Indirect Command Execution",
              "display_name": "T1202 - Indirect Command Execution"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            }
          ],
          "industries": [
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 890,
            "FileHash-SHA1": 853,
            "FileHash-SHA256": 7215,
            "domain": 2771,
            "hostname": 5544,
            "URL": 13393,
            "email": 12,
            "SSLCertFingerprint": 15,
            "CIDR": 1,
            "CVE": 3
          },
          "indicator_count": 30697,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 237,
          "modified_text": "606 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d167a8cf2e7966af16a671",
          "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified",
          "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus  government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.",
          "modified": "2024-03-18T21:03:15.841000",
          "created": "2024-02-18T02:12:56.143000",
          "tags": [
            "ssl certificate",
            "resolutions",
            "communicating",
            "historical ssl",
            "referrer",
            "united",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "win32",
            "body",
            "read c",
            "write c",
            "show",
            "delete",
            "msie",
            "windows nt",
            "search",
            "read",
            "write",
            "default",
            "malware",
            "copy",
            "contacted",
            "execution",
            "contacted urls",
            "whois sslcert",
            "emotet",
            "creation date",
            "meta",
            "cookie",
            "pragma",
            "mozilla",
            "ms windows",
            "intel",
            "regsetvalueexa",
            "nsisinetc",
            "pe32",
            "class",
            "persistence",
            "code",
            "explorer",
            "toolbar",
            "next",
            "self",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "httponly",
            "html info",
            "us citizenship",
            "meta tags",
            "citizenship",
            "immigration",
            "trackers new",
            "relic na",
            "utc google",
            "tag manager",
            "gtm5h8hdq3",
            "ids detections",
            "title",
            "date",
            "entries",
            "content type",
            "a domains",
            "gmt server",
            "apache x",
            "path",
            "win32dh",
            "as46606",
            "slcc2",
            "media center",
            "temple",
            "port",
            "destination",
            "as29873 newfold",
            "digital",
            "as15169 google",
            "otx telemetry",
            "trojandropper",
            "trojan",
            "backdoor",
            "wabot",
            "apanas",
            "south korea",
            "as9318 sk",
            "as3786 lg",
            "china as4134",
            "get hello",
            "as4766 korea",
            "dlink router",
            "dsl2750b rce",
            "exploit",
            "mirai",
            "as21928",
            "china as4837",
            "gafgyt",
            "strings",
            "high priority",
            "pulses",
            "related tags",
            "file type",
            "sysv",
            "external",
            "virustotal",
            "as39962 pretecs",
            "canada unknown",
            "moved",
            "present dec",
            "server",
            "lifeweb server",
            "lifeweb",
            "encrypt",
            "accept",
            "malware infection",
            "yara detections",
            "icmp traffic",
            "top source",
            "top destination",
            "source source",
            "policy http",
            "client body",
            "wordpress login",
            "brain sabey",
            "hall render",
            "government",
            "https://myaccount.uscis.gov/",
            "attempted brute forcing",
            "remote handler",
            "junk data stuffing",
            "cyber threat",
            "human rights threat",
            "basic human rights",
            "collision",
            "collusion",
            "cultureneutral",
            "et trojan",
            "known hostile",
            "etpro trojan",
            "possible virut",
            "error",
            "stream",
            "vitro",
            "delphi",
            "form",
            "canvas"
          ],
          "references": [
            "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
            "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
            "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
            "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
            "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
            "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
            "Yara Detections: GlassesCode"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ireland",
            "Cyprus",
            "Sweden",
            "Australia",
            "Canada",
            "Hong Kong",
            "India",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.6977536-1",
              "display_name": "Win.Trojan.6977536-1",
              "target": null
            },
            {
              "id": "Nebuler/Dialer.qn",
              "display_name": "Nebuler/Dialer.qn",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Win32/DH{gVIJAw?}",
              "display_name": "Win32/DH{gVIJAw?}",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            },
            {
              "id": "DDoS:Linux/Mirai",
              "display_name": "DDoS:Linux/Mirai",
              "target": "/malware/DDoS:Linux/Mirai"
            },
            {
              "id": "Trojan:Win32/Tinba!rfn",
              "display_name": "Trojan:Win32/Tinba!rfn",
              "target": "/malware/Trojan:Win32/Tinba!rfn"
            },
            {
              "id": "Win32:Emotet-AI\\ [Trj]",
              "display_name": "Win32:Emotet-AI\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-6333842-0",
              "display_name": "Win.Trojan.Generic-6333842-0",
              "target": null
            },
            {
              "id": "Win32/CMSBrute/Pifagor",
              "display_name": "Win32/CMSBrute/Pifagor",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32:Vitro",
              "display_name": "Win32:Vitro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7636,
            "URL": 4080,
            "domain": 3917,
            "hostname": 1617,
            "FileHash-MD5": 1284,
            "FileHash-SHA1": 1213,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 19751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 234,
          "modified_text": "762 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d167a9c59fe757dc56b395",
          "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified",
          "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus  government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.",
          "modified": "2024-03-18T21:03:15.841000",
          "created": "2024-02-18T02:12:57.917000",
          "tags": [
            "ssl certificate",
            "resolutions",
            "communicating",
            "historical ssl",
            "referrer",
            "united",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "win32",
            "body",
            "read c",
            "write c",
            "show",
            "delete",
            "msie",
            "windows nt",
            "search",
            "read",
            "write",
            "default",
            "malware",
            "copy",
            "contacted",
            "execution",
            "contacted urls",
            "whois sslcert",
            "emotet",
            "creation date",
            "meta",
            "cookie",
            "pragma",
            "mozilla",
            "ms windows",
            "intel",
            "regsetvalueexa",
            "nsisinetc",
            "pe32",
            "class",
            "persistence",
            "code",
            "explorer",
            "toolbar",
            "next",
            "self",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "httponly",
            "html info",
            "us citizenship",
            "meta tags",
            "citizenship",
            "immigration",
            "trackers new",
            "relic na",
            "utc google",
            "tag manager",
            "gtm5h8hdq3",
            "ids detections",
            "title",
            "date",
            "entries",
            "content type",
            "a domains",
            "gmt server",
            "apache x",
            "path",
            "win32dh",
            "as46606",
            "slcc2",
            "media center",
            "temple",
            "port",
            "destination",
            "as29873 newfold",
            "digital",
            "as15169 google",
            "otx telemetry",
            "trojandropper",
            "trojan",
            "backdoor",
            "wabot",
            "apanas",
            "south korea",
            "as9318 sk",
            "as3786 lg",
            "china as4134",
            "get hello",
            "as4766 korea",
            "dlink router",
            "dsl2750b rce",
            "exploit",
            "mirai",
            "as21928",
            "china as4837",
            "gafgyt",
            "strings",
            "high priority",
            "pulses",
            "related tags",
            "file type",
            "sysv",
            "external",
            "virustotal",
            "as39962 pretecs",
            "canada unknown",
            "moved",
            "present dec",
            "server",
            "lifeweb server",
            "lifeweb",
            "encrypt",
            "accept",
            "malware infection",
            "yara detections",
            "icmp traffic",
            "top source",
            "top destination",
            "source source",
            "policy http",
            "client body",
            "wordpress login",
            "brain sabey",
            "hall render",
            "government",
            "https://myaccount.uscis.gov/",
            "attempted brute forcing",
            "remote handler",
            "junk data stuffing",
            "cyber threat",
            "human rights threat",
            "basic human rights",
            "collision",
            "collusion",
            "cultureneutral",
            "et trojan",
            "known hostile",
            "etpro trojan",
            "possible virut",
            "error",
            "stream",
            "vitro",
            "delphi",
            "form",
            "canvas"
          ],
          "references": [
            "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
            "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
            "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
            "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
            "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
            "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
            "Yara Detections: GlassesCode"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ireland",
            "Cyprus",
            "Sweden",
            "Australia",
            "Canada",
            "Hong Kong",
            "India",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.6977536-1",
              "display_name": "Win.Trojan.6977536-1",
              "target": null
            },
            {
              "id": "Nebuler/Dialer.qn",
              "display_name": "Nebuler/Dialer.qn",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Win32/DH{gVIJAw?}",
              "display_name": "Win32/DH{gVIJAw?}",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            },
            {
              "id": "DDoS:Linux/Mirai",
              "display_name": "DDoS:Linux/Mirai",
              "target": "/malware/DDoS:Linux/Mirai"
            },
            {
              "id": "Trojan:Win32/Tinba!rfn",
              "display_name": "Trojan:Win32/Tinba!rfn",
              "target": "/malware/Trojan:Win32/Tinba!rfn"
            },
            {
              "id": "Win32:Emotet-AI\\ [Trj]",
              "display_name": "Win32:Emotet-AI\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-6333842-0",
              "display_name": "Win.Trojan.Generic-6333842-0",
              "target": null
            },
            {
              "id": "Win32/CMSBrute/Pifagor",
              "display_name": "Win32/CMSBrute/Pifagor",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32:Vitro",
              "display_name": "Win32:Vitro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7636,
            "URL": 4080,
            "domain": 3917,
            "hostname": 1617,
            "FileHash-MD5": 1284,
            "FileHash-SHA1": 1213,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 19751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 234,
          "modified_text": "762 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d3ae057e25854811cc1395",
          "name": "Mirai \u2022 Injection VT & AlienVault reports deleted & modified",
          "description": "",
          "modified": "2024-03-18T21:03:15.841000",
          "created": "2024-02-19T19:37:41.208000",
          "tags": [
            "ssl certificate",
            "resolutions",
            "communicating",
            "historical ssl",
            "referrer",
            "united",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "win32",
            "body",
            "read c",
            "write c",
            "show",
            "delete",
            "msie",
            "windows nt",
            "search",
            "read",
            "write",
            "default",
            "malware",
            "copy",
            "contacted",
            "execution",
            "contacted urls",
            "whois sslcert",
            "emotet",
            "creation date",
            "meta",
            "cookie",
            "pragma",
            "mozilla",
            "ms windows",
            "intel",
            "regsetvalueexa",
            "nsisinetc",
            "pe32",
            "class",
            "persistence",
            "code",
            "explorer",
            "toolbar",
            "next",
            "self",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "httponly",
            "html info",
            "us citizenship",
            "meta tags",
            "citizenship",
            "immigration",
            "trackers new",
            "relic na",
            "utc google",
            "tag manager",
            "gtm5h8hdq3",
            "ids detections",
            "title",
            "date",
            "entries",
            "content type",
            "a domains",
            "gmt server",
            "apache x",
            "path",
            "win32dh",
            "as46606",
            "slcc2",
            "media center",
            "temple",
            "port",
            "destination",
            "as29873 newfold",
            "digital",
            "as15169 google",
            "otx telemetry",
            "trojandropper",
            "trojan",
            "backdoor",
            "wabot",
            "apanas",
            "south korea",
            "as9318 sk",
            "as3786 lg",
            "china as4134",
            "get hello",
            "as4766 korea",
            "dlink router",
            "dsl2750b rce",
            "exploit",
            "mirai",
            "as21928",
            "china as4837",
            "gafgyt",
            "strings",
            "high priority",
            "pulses",
            "related tags",
            "file type",
            "sysv",
            "external",
            "virustotal",
            "as39962 pretecs",
            "canada unknown",
            "moved",
            "present dec",
            "server",
            "lifeweb server",
            "lifeweb",
            "encrypt",
            "accept",
            "malware infection",
            "yara detections",
            "icmp traffic",
            "top source",
            "top destination",
            "source source",
            "policy http",
            "client body",
            "wordpress login",
            "brain sabey",
            "hall render",
            "government",
            "https://myaccount.uscis.gov/",
            "attempted brute forcing",
            "remote handler",
            "junk data stuffing",
            "cyber threat",
            "human rights threat",
            "basic human rights",
            "collision",
            "collusion",
            "cultureneutral",
            "et trojan",
            "known hostile",
            "etpro trojan",
            "possible virut",
            "error",
            "stream",
            "vitro",
            "delphi",
            "form",
            "canvas"
          ],
          "references": [
            "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
            "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
            "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
            "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
            "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
            "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
            "Yara Detections: GlassesCode"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Ireland",
            "Cyprus",
            "Sweden",
            "Australia",
            "Canada",
            "Hong Kong",
            "India",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.6977536-1",
              "display_name": "Win.Trojan.6977536-1",
              "target": null
            },
            {
              "id": "Nebuler/Dialer.qn",
              "display_name": "Nebuler/Dialer.qn",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Win32/DH{gVIJAw?}",
              "display_name": "Win32/DH{gVIJAw?}",
              "target": null
            },
            {
              "id": "ELF:DDoS-Y\\ [Trj]",
              "display_name": "ELF:DDoS-Y\\ [Trj]",
              "target": null
            },
            {
              "id": "DDoS:Linux/Mirai",
              "display_name": "DDoS:Linux/Mirai",
              "target": "/malware/DDoS:Linux/Mirai"
            },
            {
              "id": "Trojan:Win32/Tinba!rfn",
              "display_name": "Trojan:Win32/Tinba!rfn",
              "target": "/malware/Trojan:Win32/Tinba!rfn"
            },
            {
              "id": "Win32:Emotet-AI\\ [Trj]",
              "display_name": "Win32:Emotet-AI\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-6333842-0",
              "display_name": "Win.Trojan.Generic-6333842-0",
              "target": null
            },
            {
              "id": "Win32/CMSBrute/Pifagor",
              "display_name": "Win32/CMSBrute/Pifagor",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Win32:Vitro",
              "display_name": "Win32:Vitro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65d167a9c59fe757dc56b395",
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 7636,
            "URL": 4080,
            "domain": 3917,
            "hostname": 1617,
            "FileHash-MD5": 1284,
            "FileHash-SHA1": 1213,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 19751,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "762 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
        "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
        "https://www.virustotal.com/gui/file/06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328/detection",
        "http://www.rvrb.me/fan_reach/pt?eid=A429942_17490857_19605431_lnk1018&url=http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewAl",
        "https://www.virustotal.com/gui/file/f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67/detection",
        "https://www.virustotal.com/gui/file/dcd0812ed0b280cee38a3f8a68e5fde900f0a9f832ca53167d38d96f105eb9b9/detection",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian - is this a must?",
        "trojan.shellrunner/emailworm: FileHash-SHA256 f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67",
        "https://hybrid-analysis.com/sample/b31067b40534bc4a9d68ac2f13f6090956d171d23c3d3f7a8c92a8745aed4db3",
        "Antivirus Detections ELF:Mirai-GH\\ [Trj]",
        "Crowdsourced Sigma Rules: Matches rule Creation of an Executable by an Executable by frack113",
        "Crowdsourced Sigma Rules: Matches rule Suspect Svchost Activity by David Burkett, @signalblur",
        "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
        "Yara Detections: GlassesCode",
        "http://images.contact.acams.org/",
        "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
        "Crowdsourced Sigma Rules: Matches rule Suspicious Svchost Process by Florian Roth (Nextron Systems)",
        "Worm:Win32/Ganelp.A: FileHash-SHA1 0eed684aef678aeffb43866bd2c975876e82eeab",
        "Antivirus Detections Win.Trojan.Sality-1047 ,  Worm:Win32/Ganelp.A IDS Detections W32.Duptwux/Ganelp FTP Username - onthelinux Yara Detections InstallShield2000 Alerts persistence_autorun_tasks cape_detected_threat bypass_firewall suricata_alert dynamic_function_loading dropper injection_rwx IP\u2019s Contacted  209.202.252.54",
        "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
        "Worm:Win32/Ganelp.A: FileHash-MD5 b5e26ac3b7518b77631ab7bcefae10fe",
        "Trojan.Agent.FRYX: http://email.bidayati.com/c/eJwkkc1ygjoYQJ8Gd3TClwTIwgUR0Aq12BbBbu5EfuQnioVQwKe_03v3Z-bMnJOvbUwtS6yKtWEZjNmMULyq1oAMYto2zZhd2IbIGb6UBdiYCqMoC",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check External IP Lookup www.trackip.net Possible",
        "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
        "https://otx.alienvault.com/indicator/file/00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
        "148.163.152.21 AS 22843 (PROOFPOINT-ASN-US-EAST) US | www.robtex.com | www.spf-record.com |",
        "Worm:Win32/Ganelp.A: FileHash-SHA256 00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
        "Trojan.Crypted-6 | infostealer_browser : https://otx.alienvault.com/indicator/file/29971e4a9ce229d79fae4cbdff1b32d2",
        "https://tools.totaleconomicimpact.com/go/apple/TEI/docs/TEI-of-Mac-in-Enterprise.pdf | 79appleway.com | technoapple.com",
        "ELF:Mirai-GH\\ [Trj] 91b62309447ba8db2a456b546d02cee07f1fd1027a0dd23b0ad87bec18b5acee",
        "Crowdsourced Sigma Rules: Matches rule Suspicious Outbound SMTP Connections by frack113",
        "IDS Detections Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) Juniper ScreenOS telnet Backdoor Default Password Attempt SUSPICIOUS Path to BusyBox Possible Linux.Mirai Login Attempt (meinsm) Actiontec C1000A backdoor account M2",
        "Crowdsourced Sigma Rules: Suspicious New Service Creation by Nasreddine Bencherchali (Nextron Systems)",
        "apple-carry-relay.cloudflare.com | apple-dns.net | emails.redvue.com | https://arduboy.com/bad-apple-demo-is-good | 67.199.248.12",
        "Falcon-FileVantage.exe | trojan.redcap/python: FileHash-SHA256 06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328",
        "http://image.nationwide-service.co.uk/lib/fe9515737163077971/m/1/spacer_ApplePay.gif bum?id=326459173&s=143441 | mails.redvue.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan.redcap/python",
            "Win32/cmsbrute/pifagor",
            "Nsis",
            "Win32/dh{gvijaw?}",
            "Trojan.shellrunner/emailworm",
            "Mirai",
            "Elf:ddos-y\\ [trj]",
            "Nids",
            "Backdoor:win32/tofsee.t",
            "Win32:emotet-ai\\ [trj]",
            "Mal_tofsee",
            "Win32:trojan-gen",
            "Trojan.agent.fryx",
            "Ransom.stopcryptpmf.",
            "Win.trojan.generic-6333842-0",
            "Win.trojan.6977536-1",
            "Nebuler/dialer.qn",
            "Ddos:linux/mirai",
            "Trojan:win32/tinba!rfn",
            "Et",
            "Win32:vitro",
            "Worm:win32/ganelp.a",
            "Win32:acecrypter-b [cryp]"
          ],
          "industries": [
            "Technology",
            "Civil society"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68a23eef53f1124e8dc273fc",
      "name": "Sign in to your account - Anorocuriv",
      "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
      "modified": "2025-09-16T20:00:00.565000",
      "created": "2025-08-17T20:43:27.502000",
      "tags": [
        "url http",
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "status",
        "msie",
        "chrome",
        "passive dns",
        "urls",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "body",
        "http",
        "hostname",
        "files domain",
        "present jan",
        "present dec",
        "united",
        "present aug",
        "present jun",
        "unknown aaaa",
        "present mar",
        "present may",
        "present feb",
        "present jul",
        "error",
        "a domains",
        "gmt content",
        "accept encoding",
        "config nocache",
        "hostname add",
        "pulse submit",
        "content type",
        "certificate",
        "ip address",
        "cookie",
        "mita",
        "next associated",
        "please",
        "x msedge",
        "ipv4 add",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "pattern match",
        "mitre att",
        "ascii text",
        "null",
        "click",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "meta",
        "onload",
        "span",
        "adversaries",
        "ssl certificate",
        "logo",
        "av detection",
        "default browser",
        "guest system",
        "professional",
        "falcon sandbox",
        "response risk",
        "ck techniques",
        "detection",
        "show process",
        "prefetch8",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "post collect",
        "microsoft edge",
        "nota",
        "brand",
        "class",
        "facebook",
        "ascii",
        "hex dump",
        "extraction",
        "failed",
        "data upload",
        "pul data",
        "enter",
        "s data",
        "type",
        "extr error",
        "href",
        "mask",
        "extra",
        "uta support",
        "include review",
        "exclude sugges",
        "find",
        "wow64",
        "show",
        "observed dns",
        "query",
        "unknown",
        "virtool",
        "copy",
        "write",
        "defender",
        "expiro",
        "malware",
        "next",
        "lowfi",
        "hookwowlow dec",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "trojan",
        "trojandropper",
        "http request",
        "delete",
        "yara detections",
        "pe exe",
        "dll windows",
        "minimal http",
        "february",
        "guard",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "detections http",
        "http executable",
        "retrieved",
        "location united",
        "america flag",
        "america asn",
        "urls show",
        "date checked",
        "url hostname",
        "server response"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 853,
        "hostname": 1835,
        "URL": 7127,
        "email": 3,
        "FileHash-SHA256": 1470,
        "FileHash-MD5": 293,
        "FileHash-SHA1": 284,
        "SSLCertFingerprint": 426,
        "CVE": 1
      },
      "indicator_count": 12292,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "215 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "669e42fea462f0c8f8db32a1",
      "name": "Worm:Win32/Ganelp.A - Malicious IP: 148.163.152.21",
      "description": "Malicious IP found in disastrous attack against a mid level media marketing firm that the healthcare, travel, corporate event industry. \nEmployee phones are 'zombies' some laptops likely impacted by the Crowd Strike issue, (blue screen). Excessive tracking, monitoring, active botnets, power outage, and more. Research of IP and other IoC's found. Unfortunately, many of the clients are also sucked into issue. It appears that the issue has persisted for several years. The outage just made us work every angle. The attack goes beyond  the CS 'update' outage, as the seemingly well cyber manged firm was under a very targeted, ongoing cyber attack that has kept company from rebounding. Red Team behavior seen.",
      "modified": "2024-08-21T11:03:59.106000",
      "created": "2024-07-22T11:31:10.391000",
      "tags": [
        "historical ssl",
        "referrer",
        "fancy bear",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "open",
        "status",
        "name servers",
        "creation date",
        "search",
        "proofpoint",
        "expiration date",
        "div div",
        "date",
        "accept",
        "next",
        "united",
        "cname",
        "asnone united",
        "a nxdomain",
        "domain",
        "united kingdom",
        "servers",
        "showing",
        "nxdomain",
        "dname",
        "whitelisted",
        "aaaa",
        "script urls",
        "costa rica",
        "script domains",
        "msie",
        "chrome",
        "unknown",
        "body",
        "gmt content",
        "all scoreblue",
        "pulse pulses",
        "entries",
        "as8987 amazon",
        "as20940",
        "hostname",
        "gartner",
        "crowdstrike",
        "business value",
        "magic quadrant",
        "customer",
        "realized",
        "assessment",
        "economic impact",
        "complete",
        "february",
        "utc na",
        "ver2",
        "msclkidn",
        "html info",
        "meta tags",
        "mobileoptimized",
        "adobe dynamic",
        "tag management",
        "utc bing",
        "cobalt strike",
        "communications",
        "android device",
        "neutral",
        "win32 exe",
        "pe32",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "sections",
        "rticon neutral",
        "ico rtgroupicon",
        "xml rtmanifest",
        "overlay",
        "threat roundup",
        "pandas",
        "attacks against",
        "southeast",
        "wannacry kill",
        "switch dns",
        "query",
        "high level",
        "hackers",
        "unknown win",
        "core",
        "ascii text",
        "sha256",
        "sha1",
        "size",
        "pattern match",
        "suricata stream",
        "command decode",
        "utf8 text",
        "mitre att",
        "path",
        "hybrid",
        "starfield",
        "meta",
        "general",
        "target",
        "local",
        "click",
        "strings",
        "trident",
        "legacy",
        "main",
        "contact",
        "flow t1574",
        "dll sideloading",
        "create",
        "modify system",
        "process t1543",
        "windows service",
        "t1055 system",
        "pe file",
        "t1497 query",
        "may sleep",
        "allocate rwx",
        "get file",
        "access",
        "windows event",
        "allocate",
        "link function",
        "windows link",
        "contains pdb",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls tcp",
        "hashes",
        "user",
        "file system",
        "written c",
        "samplepath",
        "files dropped",
        "userprofile",
        "registry keys",
        "registry",
        "set registrya",
        "conhost",
        "comspec",
        "created",
        "temp",
        "windows",
        "displayname",
        "process",
        "commands",
        "signals mutexes",
        "mutexes",
        "full name",
        "data",
        "v3 serial",
        "number",
        "cus cndigicert",
        "tls rsa",
        "ca1 odigicert",
        "inc validity",
        "subject public",
        "certificate",
        "whois lookup",
        "netrange",
        "nethandle",
        "net148",
        "net1480000",
        "as16509",
        "as22843",
        "as13916",
        "form",
        "server",
        "registrar abuse",
        "email",
        "request email",
        "verisign",
        "icann whois",
        "tech",
        "first",
        "project skynet",
        "cyber army",
        "dynamicloader",
        "high",
        "delete c",
        "show",
        "username",
        "medium",
        "default",
        "yara detections",
        "worm",
        "copy",
        "write",
        "duptwux",
        "malware",
        "x82xd4",
        "kx81xdbx0f",
        "x86xd3",
        "xa1xf1",
        "xe8xc2x14",
        "wx99xcdx11",
        "regsetvalueexa",
        "regbinary",
        "xe8xc6x13",
        "hx88x9ax1e",
        "stream",
        "win32",
        "persistence",
        "execution",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "ftp username",
        "contacted",
        "et tor",
        "known tor",
        "misc attack",
        "relayrouter",
        "exit",
        "node traffic",
        "severity",
        "null",
        "refresh",
        "span",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "robtex",
        "apple ios",
        "apple",
        "domains",
        "co number",
        "virtual mobile",
        "logistics",
        "cyber defense",
        "twitter",
        "read c",
        "artemis",
        "intel",
        "steals",
        "virustotal",
        "python",
        "panda",
        "falcon sandbox",
        "analysis",
        "hybrid analysis",
        "submission name",
        "av detection",
        "multi scan",
        "highest",
        "ability",
        "execute",
        "upgrade",
        "intelligence",
        "learn",
        "reports",
        "logo analysis",
        "size17kib type",
        "command",
        "found",
        "layer protocol",
        "osi application",
        "ip address",
        "t1105 ingress",
        "tool transfer",
        "problems",
        "threat network",
        "infrastructure",
        "domains part",
        "domain tracker",
        "roundup",
        "new problems",
        "startpage",
        "e1203 windows",
        "catalog tree",
        "analysis ob0001",
        "b0001 process",
        "b0003 delayed",
        "analysis ob0002",
        "evasion ob0006",
        "ob0007 system",
        "e1082 file",
        "e1083 impact",
        "data manipulation",
        "remote system",
        "discovery",
        "t1059 accept",
        "modules t1129",
        "enumerate",
        "as2914 ntt",
        "access denied",
        "as16625 akamai",
        "germany unknown",
        "csccorpdomains",
        "as31109",
        "invalid url",
        "mirai",
        "port",
        "destination",
        "bad login",
        "suspicious path",
        "nids",
        "tcp syn",
        "root account",
        "cve20185723",
        "as8068",
        "please",
        "x msedge",
        "embeddedwb",
        "windows nt",
        "tofsee",
        "push",
        "as54113",
        "as396982 google",
        "as31898 oracle",
        "moved",
        "encrypt"
      ],
      "references": [
        "148.163.152.21 AS 22843 (PROOFPOINT-ASN-US-EAST) US | www.robtex.com | www.spf-record.com |",
        "Crowdsourced Sigma Rules: Suspicious New Service Creation by Nasreddine Bencherchali (Nextron Systems)",
        "Crowdsourced Sigma Rules: Matches rule Suspicious Svchost Process by Florian Roth (Nextron Systems)",
        "Crowdsourced Sigma Rules: Matches rule Suspect Svchost Activity by David Burkett, @signalblur",
        "Crowdsourced Sigma Rules: Matches rule Suspicious Outbound SMTP Connections by frack113",
        "Crowdsourced Sigma Rules: Matches rule Creation of an Executable by an Executable by frack113",
        "https://www.virustotal.com/gui/file/dcd0812ed0b280cee38a3f8a68e5fde900f0a9f832ca53167d38d96f105eb9b9/detection",
        "Antivirus Detections Win.Trojan.Sality-1047 ,  Worm:Win32/Ganelp.A IDS Detections W32.Duptwux/Ganelp FTP Username - onthelinux Yara Detections InstallShield2000 Alerts persistence_autorun_tasks cape_detected_threat bypass_firewall suricata_alert dynamic_function_loading dropper injection_rwx IP\u2019s Contacted  209.202.252.54",
        "ELF:Mirai-GH\\ [Trj] 91b62309447ba8db2a456b546d02cee07f1fd1027a0dd23b0ad87bec18b5acee",
        "https://hybrid-analysis.com/sample/b31067b40534bc4a9d68ac2f13f6090956d171d23c3d3f7a8c92a8745aed4db3",
        "https://otx.alienvault.com/indicator/file/00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
        "trojan.shellrunner/emailworm: FileHash-SHA256 f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67",
        "https://www.virustotal.com/gui/file/f9527077fe3699a17a45276e3b15d65014b5c1d2d10c09f476a21b90fbd0bf67/detection",
        "Trojan.Agent.FRYX: http://email.bidayati.com/c/eJwkkc1ygjoYQJ8Gd3TClwTIwgUR0Aq12BbBbu5EfuQnioVQwKe_03v3Z-bMnJOvbUwtS6yKtWEZjNmMULyq1oAMYto2zZhd2IbIGb6UBdiYCqMoC",
        "Worm:Win32/Ganelp.A: FileHash-SHA256 00001054e41d89822267a38856e76eafc2c2e2f20c3f17a392e417f8b87e4ce1",
        "Worm:Win32/Ganelp.A: FileHash-SHA1 0eed684aef678aeffb43866bd2c975876e82eeab",
        "Worm:Win32/Ganelp.A: FileHash-MD5 b5e26ac3b7518b77631ab7bcefae10fe",
        "Trojan.Crypted-6 | infostealer_browser : https://otx.alienvault.com/indicator/file/29971e4a9ce229d79fae4cbdff1b32d2",
        "Falcon-FileVantage.exe | trojan.redcap/python: FileHash-SHA256 06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328",
        "https://www.virustotal.com/gui/file/06d4c16f64fc377b7dd5d8dff8bc6b11728d4cbbf3dcb42a9b819cc028afc328/detection",
        "apple-carry-relay.cloudflare.com | apple-dns.net | emails.redvue.com | https://arduboy.com/bad-apple-demo-is-good | 67.199.248.12",
        "https://tools.totaleconomicimpact.com/go/apple/TEI/docs/TEI-of-Mac-in-Enterprise.pdf | 79appleway.com | technoapple.com",
        "http://image.nationwide-service.co.uk/lib/fe9515737163077971/m/1/spacer_ApplePay.gif bum?id=326459173&s=143441 | mails.redvue.com",
        "http://www.rvrb.me/fan_reach/pt?eid=A429942_17490857_19605431_lnk1018&url=http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewAl",
        "Antivirus Detections ELF:Mirai-GH\\ [Trj]",
        "IDS Detections Master IP CAM 01 Hardcoded Password for Root Account (CVE-2018-5723) Juniper ScreenOS telnet Backdoor Default Password Attempt SUSPICIOUS Path to BusyBox Possible Linux.Mirai Login Attempt (meinsm) Actiontec C1000A backdoor account M2",
        "IDS Detections Win32/Tofsee.AX google.com connectivity check External IP Lookup www.trackip.net Possible",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian - is this a must?",
        "http://images.contact.acams.org/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland"
      ],
      "malware_families": [
        {
          "id": "Trojan.Agent.FRYX",
          "display_name": "Trojan.Agent.FRYX",
          "target": null
        },
        {
          "id": "Win32:AceCrypter-B [Cryp]",
          "display_name": "Win32:AceCrypter-B [Cryp]",
          "target": null
        },
        {
          "id": "Mal_Tofsee",
          "display_name": "Mal_Tofsee",
          "target": null
        },
        {
          "id": "Ransom.StopcryptPMF.",
          "display_name": "Ransom.StopcryptPMF.",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Worm:Win32/Ganelp.A",
          "display_name": "Worm:Win32/Ganelp.A",
          "target": "/malware/Worm:Win32/Ganelp.A"
        },
        {
          "id": "trojan.shellrunner/emailworm",
          "display_name": "trojan.shellrunner/emailworm",
          "target": null
        },
        {
          "id": "trojan.redcap/python",
          "display_name": "trojan.redcap/python",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1569",
          "name": "System Services",
          "display_name": "T1569 - System Services"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1565",
          "name": "Data Manipulation",
          "display_name": "T1565 - Data Manipulation"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1202",
          "name": "Indirect Command Execution",
          "display_name": "T1202 - Indirect Command Execution"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "T1583.002",
          "name": "DNS Server",
          "display_name": "T1583.002 - DNS Server"
        }
      ],
      "industries": [
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 890,
        "FileHash-SHA1": 853,
        "FileHash-SHA256": 7215,
        "domain": 2771,
        "hostname": 5544,
        "URL": 13393,
        "email": 12,
        "SSLCertFingerprint": 15,
        "CIDR": 1,
        "CVE": 3
      },
      "indicator_count": 30697,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 237,
      "modified_text": "606 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d167a8cf2e7966af16a671",
      "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified",
      "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus  government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.",
      "modified": "2024-03-18T21:03:15.841000",
      "created": "2024-02-18T02:12:56.143000",
      "tags": [
        "ssl certificate",
        "resolutions",
        "communicating",
        "historical ssl",
        "referrer",
        "united",
        "unknown",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "win32",
        "body",
        "read c",
        "write c",
        "show",
        "delete",
        "msie",
        "windows nt",
        "search",
        "read",
        "write",
        "default",
        "malware",
        "copy",
        "contacted",
        "execution",
        "contacted urls",
        "whois sslcert",
        "emotet",
        "creation date",
        "meta",
        "cookie",
        "pragma",
        "mozilla",
        "ms windows",
        "intel",
        "regsetvalueexa",
        "nsisinetc",
        "pe32",
        "class",
        "persistence",
        "code",
        "explorer",
        "toolbar",
        "next",
        "self",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "httponly",
        "html info",
        "us citizenship",
        "meta tags",
        "citizenship",
        "immigration",
        "trackers new",
        "relic na",
        "utc google",
        "tag manager",
        "gtm5h8hdq3",
        "ids detections",
        "title",
        "date",
        "entries",
        "content type",
        "a domains",
        "gmt server",
        "apache x",
        "path",
        "win32dh",
        "as46606",
        "slcc2",
        "media center",
        "temple",
        "port",
        "destination",
        "as29873 newfold",
        "digital",
        "as15169 google",
        "otx telemetry",
        "trojandropper",
        "trojan",
        "backdoor",
        "wabot",
        "apanas",
        "south korea",
        "as9318 sk",
        "as3786 lg",
        "china as4134",
        "get hello",
        "as4766 korea",
        "dlink router",
        "dsl2750b rce",
        "exploit",
        "mirai",
        "as21928",
        "china as4837",
        "gafgyt",
        "strings",
        "high priority",
        "pulses",
        "related tags",
        "file type",
        "sysv",
        "external",
        "virustotal",
        "as39962 pretecs",
        "canada unknown",
        "moved",
        "present dec",
        "server",
        "lifeweb server",
        "lifeweb",
        "encrypt",
        "accept",
        "malware infection",
        "yara detections",
        "icmp traffic",
        "top source",
        "top destination",
        "source source",
        "policy http",
        "client body",
        "wordpress login",
        "brain sabey",
        "hall render",
        "government",
        "https://myaccount.uscis.gov/",
        "attempted brute forcing",
        "remote handler",
        "junk data stuffing",
        "cyber threat",
        "human rights threat",
        "basic human rights",
        "collision",
        "collusion",
        "cultureneutral",
        "et trojan",
        "known hostile",
        "etpro trojan",
        "possible virut",
        "error",
        "stream",
        "vitro",
        "delphi",
        "form",
        "canvas"
      ],
      "references": [
        "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
        "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
        "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
        "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
        "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
        "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
        "Yara Detections: GlassesCode"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ireland",
        "Cyprus",
        "Sweden",
        "Australia",
        "Canada",
        "Hong Kong",
        "India",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.6977536-1",
          "display_name": "Win.Trojan.6977536-1",
          "target": null
        },
        {
          "id": "Nebuler/Dialer.qn",
          "display_name": "Nebuler/Dialer.qn",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Win32/DH{gVIJAw?}",
          "display_name": "Win32/DH{gVIJAw?}",
          "target": null
        },
        {
          "id": "ELF:DDoS-Y\\ [Trj]",
          "display_name": "ELF:DDoS-Y\\ [Trj]",
          "target": null
        },
        {
          "id": "DDoS:Linux/Mirai",
          "display_name": "DDoS:Linux/Mirai",
          "target": "/malware/DDoS:Linux/Mirai"
        },
        {
          "id": "Trojan:Win32/Tinba!rfn",
          "display_name": "Trojan:Win32/Tinba!rfn",
          "target": "/malware/Trojan:Win32/Tinba!rfn"
        },
        {
          "id": "Win32:Emotet-AI\\ [Trj]",
          "display_name": "Win32:Emotet-AI\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-6333842-0",
          "display_name": "Win.Trojan.Generic-6333842-0",
          "target": null
        },
        {
          "id": "Win32/CMSBrute/Pifagor",
          "display_name": "Win32/CMSBrute/Pifagor",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32:Vitro",
          "display_name": "Win32:Vitro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7636,
        "URL": 4080,
        "domain": 3917,
        "hostname": 1617,
        "FileHash-MD5": 1284,
        "FileHash-SHA1": 1213,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 19751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 234,
      "modified_text": "762 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d167a9c59fe757dc56b395",
      "name": "Mirai \u2022 Emotet \u2022 Injection VT & AlienVault reports deleted & modified",
      "description": "Remote actor uses injection, brute force and remote logins to delete incriminating pulse , virustotal and otx.alienvault pulses, nodes and/or graphs.\n\u2192https://myaccount.uscis.gov/- Immigration (DHS) Login. For years many tactics, social engineering and fraudulent activities persisted. Contact is made to American born citizens, to get in touch. A website is provided, homepage on affected devices is bogus, you have to call to address bogus  government concern. Target calls redirected to a call center where they're told they have reached immigration, to verify PII, next told it's a mistake as they are not in the system. At some point meritless notification of Patriot Act violation is received. Identity theft occurs. Credit, bank and other accounts are cancelled. Likely away to gain legal access to spy on targets.",
      "modified": "2024-03-18T21:03:15.841000",
      "created": "2024-02-18T02:12:57.917000",
      "tags": [
        "ssl certificate",
        "resolutions",
        "communicating",
        "historical ssl",
        "referrer",
        "united",
        "unknown",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "win32",
        "body",
        "read c",
        "write c",
        "show",
        "delete",
        "msie",
        "windows nt",
        "search",
        "read",
        "write",
        "default",
        "malware",
        "copy",
        "contacted",
        "execution",
        "contacted urls",
        "whois sslcert",
        "emotet",
        "creation date",
        "meta",
        "cookie",
        "pragma",
        "mozilla",
        "ms windows",
        "intel",
        "regsetvalueexa",
        "nsisinetc",
        "pe32",
        "class",
        "persistence",
        "code",
        "explorer",
        "toolbar",
        "next",
        "self",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "httponly",
        "html info",
        "us citizenship",
        "meta tags",
        "citizenship",
        "immigration",
        "trackers new",
        "relic na",
        "utc google",
        "tag manager",
        "gtm5h8hdq3",
        "ids detections",
        "title",
        "date",
        "entries",
        "content type",
        "a domains",
        "gmt server",
        "apache x",
        "path",
        "win32dh",
        "as46606",
        "slcc2",
        "media center",
        "temple",
        "port",
        "destination",
        "as29873 newfold",
        "digital",
        "as15169 google",
        "otx telemetry",
        "trojandropper",
        "trojan",
        "backdoor",
        "wabot",
        "apanas",
        "south korea",
        "as9318 sk",
        "as3786 lg",
        "china as4134",
        "get hello",
        "as4766 korea",
        "dlink router",
        "dsl2750b rce",
        "exploit",
        "mirai",
        "as21928",
        "china as4837",
        "gafgyt",
        "strings",
        "high priority",
        "pulses",
        "related tags",
        "file type",
        "sysv",
        "external",
        "virustotal",
        "as39962 pretecs",
        "canada unknown",
        "moved",
        "present dec",
        "server",
        "lifeweb server",
        "lifeweb",
        "encrypt",
        "accept",
        "malware infection",
        "yara detections",
        "icmp traffic",
        "top source",
        "top destination",
        "source source",
        "policy http",
        "client body",
        "wordpress login",
        "brain sabey",
        "hall render",
        "government",
        "https://myaccount.uscis.gov/",
        "attempted brute forcing",
        "remote handler",
        "junk data stuffing",
        "cyber threat",
        "human rights threat",
        "basic human rights",
        "collision",
        "collusion",
        "cultureneutral",
        "et trojan",
        "known hostile",
        "etpro trojan",
        "possible virut",
        "error",
        "stream",
        "vitro",
        "delphi",
        "form",
        "canvas"
      ],
      "references": [
        "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
        "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
        "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
        "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
        "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
        "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
        "Yara Detections: GlassesCode"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ireland",
        "Cyprus",
        "Sweden",
        "Australia",
        "Canada",
        "Hong Kong",
        "India",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.6977536-1",
          "display_name": "Win.Trojan.6977536-1",
          "target": null
        },
        {
          "id": "Nebuler/Dialer.qn",
          "display_name": "Nebuler/Dialer.qn",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Win32/DH{gVIJAw?}",
          "display_name": "Win32/DH{gVIJAw?}",
          "target": null
        },
        {
          "id": "ELF:DDoS-Y\\ [Trj]",
          "display_name": "ELF:DDoS-Y\\ [Trj]",
          "target": null
        },
        {
          "id": "DDoS:Linux/Mirai",
          "display_name": "DDoS:Linux/Mirai",
          "target": "/malware/DDoS:Linux/Mirai"
        },
        {
          "id": "Trojan:Win32/Tinba!rfn",
          "display_name": "Trojan:Win32/Tinba!rfn",
          "target": "/malware/Trojan:Win32/Tinba!rfn"
        },
        {
          "id": "Win32:Emotet-AI\\ [Trj]",
          "display_name": "Win32:Emotet-AI\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-6333842-0",
          "display_name": "Win.Trojan.Generic-6333842-0",
          "target": null
        },
        {
          "id": "Win32/CMSBrute/Pifagor",
          "display_name": "Win32/CMSBrute/Pifagor",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32:Vitro",
          "display_name": "Win32:Vitro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7636,
        "URL": 4080,
        "domain": 3917,
        "hostname": 1617,
        "FileHash-MD5": 1284,
        "FileHash-SHA1": 1213,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 19751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 234,
      "modified_text": "762 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d3ae057e25854811cc1395",
      "name": "Mirai \u2022 Injection VT & AlienVault reports deleted & modified",
      "description": "",
      "modified": "2024-03-18T21:03:15.841000",
      "created": "2024-02-19T19:37:41.208000",
      "tags": [
        "ssl certificate",
        "resolutions",
        "communicating",
        "historical ssl",
        "referrer",
        "united",
        "unknown",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "win32",
        "body",
        "read c",
        "write c",
        "show",
        "delete",
        "msie",
        "windows nt",
        "search",
        "read",
        "write",
        "default",
        "malware",
        "copy",
        "contacted",
        "execution",
        "contacted urls",
        "whois sslcert",
        "emotet",
        "creation date",
        "meta",
        "cookie",
        "pragma",
        "mozilla",
        "ms windows",
        "intel",
        "regsetvalueexa",
        "nsisinetc",
        "pe32",
        "class",
        "persistence",
        "code",
        "explorer",
        "toolbar",
        "next",
        "self",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "httponly",
        "html info",
        "us citizenship",
        "meta tags",
        "citizenship",
        "immigration",
        "trackers new",
        "relic na",
        "utc google",
        "tag manager",
        "gtm5h8hdq3",
        "ids detections",
        "title",
        "date",
        "entries",
        "content type",
        "a domains",
        "gmt server",
        "apache x",
        "path",
        "win32dh",
        "as46606",
        "slcc2",
        "media center",
        "temple",
        "port",
        "destination",
        "as29873 newfold",
        "digital",
        "as15169 google",
        "otx telemetry",
        "trojandropper",
        "trojan",
        "backdoor",
        "wabot",
        "apanas",
        "south korea",
        "as9318 sk",
        "as3786 lg",
        "china as4134",
        "get hello",
        "as4766 korea",
        "dlink router",
        "dsl2750b rce",
        "exploit",
        "mirai",
        "as21928",
        "china as4837",
        "gafgyt",
        "strings",
        "high priority",
        "pulses",
        "related tags",
        "file type",
        "sysv",
        "external",
        "virustotal",
        "as39962 pretecs",
        "canada unknown",
        "moved",
        "present dec",
        "server",
        "lifeweb server",
        "lifeweb",
        "encrypt",
        "accept",
        "malware infection",
        "yara detections",
        "icmp traffic",
        "top source",
        "top destination",
        "source source",
        "policy http",
        "client body",
        "wordpress login",
        "brain sabey",
        "hall render",
        "government",
        "https://myaccount.uscis.gov/",
        "attempted brute forcing",
        "remote handler",
        "junk data stuffing",
        "cyber threat",
        "human rights threat",
        "basic human rights",
        "collision",
        "collusion",
        "cultureneutral",
        "et trojan",
        "known hostile",
        "etpro trojan",
        "possible virut",
        "error",
        "stream",
        "vitro",
        "delphi",
        "form",
        "canvas"
      ],
      "references": [
        "https://myaccount.uscis.gov/ \u2022 Immigration (DHS) Login \u2022",
        "https://otx.alienvault.com/indicator/url/https://myaccount.uscis.gov/",
        "https://otx.alienvault.com/indicator/file/e1bac17d00f49b033b745ebede6561a5d4f5ef573831f9a941797b5ea8894331",
        "High Priority IP\u2019s Contacted \u2022 network_irc nolookup_communication \u2022 network_cnc_http \u2022 network_http p2p_cnc \u2022 MethCallEngine",
        "Huawei Remote Command Execution - Outbound (CVE-2017-17215) \u2022 dead_host \u2022 network_icmp \u2022 osquery_detection",
        "Mirai Variant Checkin Response \u2022 D-LINK Router DSL-2750B RCE M2 - Outbound (metasploit version) \u2022 Domains Contacted ntp.ubuntu.com",
        "Yara Detections: GlassesCode"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Ireland",
        "Cyprus",
        "Sweden",
        "Australia",
        "Canada",
        "Hong Kong",
        "India",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.6977536-1",
          "display_name": "Win.Trojan.6977536-1",
          "target": null
        },
        {
          "id": "Nebuler/Dialer.qn",
          "display_name": "Nebuler/Dialer.qn",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Win32/DH{gVIJAw?}",
          "display_name": "Win32/DH{gVIJAw?}",
          "target": null
        },
        {
          "id": "ELF:DDoS-Y\\ [Trj]",
          "display_name": "ELF:DDoS-Y\\ [Trj]",
          "target": null
        },
        {
          "id": "DDoS:Linux/Mirai",
          "display_name": "DDoS:Linux/Mirai",
          "target": "/malware/DDoS:Linux/Mirai"
        },
        {
          "id": "Trojan:Win32/Tinba!rfn",
          "display_name": "Trojan:Win32/Tinba!rfn",
          "target": "/malware/Trojan:Win32/Tinba!rfn"
        },
        {
          "id": "Win32:Emotet-AI\\ [Trj]",
          "display_name": "Win32:Emotet-AI\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-6333842-0",
          "display_name": "Win.Trojan.Generic-6333842-0",
          "target": null
        },
        {
          "id": "Win32/CMSBrute/Pifagor",
          "display_name": "Win32/CMSBrute/Pifagor",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Win32:Vitro",
          "display_name": "Win32:Vitro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65d167a9c59fe757dc56b395",
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 7636,
        "URL": 4080,
        "domain": 3917,
        "hostname": 1617,
        "FileHash-MD5": 1284,
        "FileHash-SHA1": 1213,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 19751,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "762 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "type": "Domain",
    "indicator": "spmailtechn.com",
    "stats": {
      "malicious": 0,
      "suspicious": 0,
      "harmless": 59,
      "undetected": 35,
      "total": 94,
      "verdict": "clean",
      "ratio": "0/94"
    },
    "verdict": "clean",
    "ratio": "0/94",
    "registrar": "MarkMonitor Inc.",
    "creation_date": 1461862211,
    "reputation": 0,
    "tags": [],
    "categories": {
      "alphaMountain.ai": "Ads/Analytics, Information Technology (alphaMountain.ai)",
      "Sophos": "information technology",
      "Forcepoint ThreatSeeker": "web and email marketing"
    },
    "top_detections": [],
    "last_analysis": 1776089510,
    "error": null
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "spmailtechn.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643377.8835073
}