{
  "type": "Domain",
  "indicator": "springtech-apps.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/springtech-apps.com",
    "alexa": "http://www.alexa.com/siteinfo/springtech-apps.com",
    "indicator": "springtech-apps.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3218649435,
      "indicator": "springtech-apps.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "65f55ed2015e05ffbc2b72a8",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-16T08:56:50.387000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65f980471600645142bcd924",
          "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
          "description": "",
          "modified": "2024-04-15T08:03:32.381000",
          "created": "2024-03-19T12:08:39.100000",
          "tags": [
            "hostname",
            "sort",
            "domain",
            "type",
            "hostname c",
            "all octoseek",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "for privacy",
            "unknown",
            "united",
            "link",
            "search",
            "servers",
            "strapi app",
            "passive dns",
            "urls",
            "date",
            "body",
            "meta",
            "span",
            "next",
            "octoseek",
            "url https",
            "url http",
            "role title",
            "added active",
            "execution",
            "ssl certificate",
            "whois record",
            "contacted",
            "pe resource",
            "bundled",
            "historical ssl",
            "referrer",
            "communicating",
            "collections",
            "status",
            "emails",
            "creation date",
            "record value",
            "expiration date",
            "showing",
            "threat analyzer",
            "threat",
            "iocs",
            "hostnames",
            "urls https",
            "samples",
            "firehol",
            "proxy",
            "detection list",
            "ip address",
            "blacklist",
            "malicious url",
            "anonymizer",
            "botnet command",
            "malware",
            "generic malware",
            "count blacklist",
            "no data",
            "tag count",
            "detection",
            "count",
            "generic",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "filerepmetagen",
            "filerepmalware",
            "artemis",
            "presenoker",
            "unsafe",
            "riskware",
            "crack",
            "opencandy",
            "downloader",
            "coinminer",
            "installpack",
            "agent",
            "fusioncore",
            "conduit",
            "wacatac",
            "zbot",
            "cl0p",
            "maltiverse",
            "trojanspy",
            "engb",
            "emotet",
            "cyberwar",
            "ursnif",
            "attack",
            "hacktool",
            "ransomexx",
            "startpage",
            "bitrat",
            "ryuk",
            "agent tesla",
            "stealer",
            "critical",
            "copy",
            "evilnum",
            "threat report",
            "back",
            "ip summary",
            "url summary",
            "summary",
            "download csv",
            "download",
            "json sample",
            "malicious site",
            "phishing site",
            "iframe",
            "domaiq",
            "alexa",
            "downldr",
            "phishing",
            "cyber threat",
            "control server",
            "team",
            "installcore",
            "mirai",
            "pony",
            "nanocore",
            "bradesco",
            "cobalt strike",
            "bank",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "traffic et",
            "policy windows",
            "update p2p",
            "activity",
            "windir",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "hybrid",
            "general",
            "path",
            "click",
            "strings",
            "contact",
            "paste",
            "win32",
            "gmt content",
            "scan endpoints",
            "ipv4",
            "pulse pulses",
            "files",
            "accept",
            "date hash",
            "avast avg",
            "entries",
            "as15169 google",
            "aaaa",
            "ireland unknown",
            "germany unknown",
            "as43350 nforce"
          ],
          "references": [
            "https://api.wavebrowserbase.com",
            "Ransom: message.htm.com",
            "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
            "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
            "Ryuk: http://kramtechnology.com/",
            "Ryuk: kramtechnology.com",
            "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
            "Botnet Server IP: 141.226.230.48",
            "newrelic.se"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Cl0p",
              "display_name": "Cl0p",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1584.004",
              "name": "Server",
              "display_name": "T1584.004 - Server"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            },
            {
              "id": "T1547.006",
              "name": "Kernel Modules and Extensions",
              "display_name": "T1547.006 - Kernel Modules and Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65f55ed2015e05ffbc2b72a8",
          "export_count": 186884,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9838,
            "domain": 2085,
            "hostname": 3006,
            "FileHash-SHA256": 3685,
            "FileHash-MD5": 965,
            "FileHash-SHA1": 532,
            "email": 6,
            "CVE": 7
          },
          "indicator_count": 20124,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "734 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d411018926d62065fe0487",
          "name": "RFC 1918 - Address Allocation for Private Internets",
          "description": "Strategy used to mask and weaponize compromised consumer routers and devices. Data collection, dns poisoning, monitoring, tracking, etc. \nhttp://remotewd.com/ is offline however DGA hostnames continue to change rapidly. New devices added daily.\n\nMay be able to: Modify files in Chrome extension folder\nchrome.exe (PID: 2428)\nINFO\nReads the hosts file\nchrome.exe\nApplication launched itself\nMay have a relationship with BGP Tools. I don't know enough to provide more indepth information. Mysterious to me.",
          "modified": "2024-03-21T01:00:09.761000",
          "created": "2024-02-20T02:40:01.552000",
          "tags": [
            "parent siblings",
            "internet",
            "practice",
            "rekhter",
            "february",
            "best current",
            "page",
            "ip connectivity",
            "ip address",
            "allocation",
            "tcpip",
            "formats",
            "execution",
            "contacted",
            "dropped",
            "contacted urls",
            "pe resource",
            "bundled",
            "whois whois",
            "whois domain",
            "malibot",
            "linkid252669",
            "ryuk",
            "malicious",
            "iana",
            "orgtechref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "pro platform",
            "route",
            "telecom group",
            "general info",
            "geo shanghai",
            "china",
            "as4812",
            "china telecom",
            "group",
            "cn note",
            "registrar apnic",
            "apple id phishing",
            "command decode",
            "suricata ipv4",
            "united",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "suricata udpv4",
            "windir",
            "name server",
            "date",
            "general",
            "click",
            "strings",
            "contact",
            "octoseek",
            "as51407 mada",
            "asnone india",
            "asnone ukraine",
            "search",
            "status",
            "united kingdom",
            "asnone",
            "domain",
            "entries",
            "germany unknown",
            "as3320 deutsche",
            "as3209 vodafone",
            "italy unknown",
            "united arab",
            "china unknown",
            "spain unknown",
            "canada unknown",
            "as22773 cox",
            "active",
            "dead host"
          ],
          "references": [
            "http://remotewd.com/ (Offline Hostname) Apple ID phishing | Downed malware",
            "192.168.122.29  | http://datatracker.ietf.org/doc/rfc1918 | Login Admin \u2022 Router Network",
            "192.168.122.29 | Private IP addresses in trace route",
            "Route \u2192116.233.0.0/16(Route of ASN)",
            "Related : https://otx.alienvault.com/indicator/domain/remotewd.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Chile",
            "Palestine",
            "Australia",
            "Hong Kong",
            "Qatar",
            "Belgium",
            "Germany",
            "Malaysia",
            "Israel"
          ],
          "malware_families": [
            {
              "id": "China Telecom",
              "display_name": "China Telecom",
              "target": null
            },
            {
              "id": "Ryuk",
              "display_name": "Ryuk",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1468",
              "name": "Remotely Track Device Without Authorization",
              "display_name": "T1468 - Remotely Track Device Without Authorization"
            },
            {
              "id": "T1443",
              "name": "Remotely Install Application",
              "display_name": "T1443 - Remotely Install Application"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 411,
            "hostname": 589,
            "email": 7,
            "FileHash-MD5": 57,
            "FileHash-SHA1": 55,
            "FileHash-SHA256": 496,
            "URL": 50,
            "CIDR": 1
          },
          "indicator_count": 1666,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "759 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d4241f2ddabc00bb3c2b6e",
          "name": "Trojan.WannaCryptor/WannaCry ",
          "description": "",
          "modified": "2024-03-21T01:00:09.761000",
          "created": "2024-02-20T04:01:35.467000",
          "tags": [
            "parent siblings",
            "internet",
            "practice",
            "rekhter",
            "february",
            "best current",
            "page",
            "ip connectivity",
            "ip address",
            "allocation",
            "tcpip",
            "formats",
            "execution",
            "contacted",
            "dropped",
            "contacted urls",
            "pe resource",
            "bundled",
            "whois whois",
            "whois domain",
            "malibot",
            "linkid252669",
            "ryuk",
            "malicious",
            "iana",
            "orgtechref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "pro platform",
            "route",
            "telecom group",
            "general info",
            "geo shanghai",
            "china",
            "as4812",
            "china telecom",
            "group",
            "cn note",
            "registrar apnic",
            "apple id phishing",
            "command decode",
            "suricata ipv4",
            "united",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "suricata udpv4",
            "windir",
            "name server",
            "date",
            "general",
            "click",
            "strings",
            "contact",
            "octoseek",
            "as51407 mada",
            "asnone india",
            "asnone ukraine",
            "search",
            "status",
            "united kingdom",
            "asnone",
            "domain",
            "entries",
            "germany unknown",
            "as3320 deutsche",
            "as3209 vodafone",
            "italy unknown",
            "united arab",
            "china unknown",
            "spain unknown",
            "canada unknown",
            "as22773 cox",
            "active",
            "dead host"
          ],
          "references": [
            "http://remotewd.com/ (Offline Hostname) Apple ID phishing | Downed malware",
            "192.168.122.29  | http://datatracker.ietf.org/doc/rfc1918 | Login Admin \u2022 Router Network",
            "192.168.122.29 | Private IP addresses in trace route",
            "Route \u2192116.233.0.0/16(Route of ASN)",
            "Related : https://otx.alienvault.com/indicator/domain/remotewd.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Chile",
            "Palestine",
            "Australia",
            "Hong Kong",
            "Qatar",
            "Belgium",
            "Germany",
            "Malaysia",
            "Israel"
          ],
          "malware_families": [
            {
              "id": "China Telecom",
              "display_name": "China Telecom",
              "target": null
            },
            {
              "id": "Ryuk",
              "display_name": "Ryuk",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1468",
              "name": "Remotely Track Device Without Authorization",
              "display_name": "T1468 - Remotely Track Device Without Authorization"
            },
            {
              "id": "T1443",
              "name": "Remotely Install Application",
              "display_name": "T1443 - Remotely Install Application"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65d411018926d62065fe0487",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 411,
            "hostname": 589,
            "email": 7,
            "FileHash-MD5": 57,
            "FileHash-SHA1": 55,
            "FileHash-SHA256": 496,
            "URL": 50,
            "CIDR": 1
          },
          "indicator_count": 1666,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "759 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b2909ffdc623904cbfd91d",
          "name": "PEXE - DOS executable (COM)",
          "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-25T16:47:26.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757a662a146889c60b6c",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:10.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757d6dd7dae344aed3f5",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:13.209000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85dca7d8bf0aea33abc3a",
          "name": "PEXE - DOS executable ",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-30T02:24:10.454000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b4757a662a146889c60b6c",
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: kramtechnology.com",
        "Ryuk: http://kramtechnology.com/",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "https://api.wavebrowserbase.com",
        "Related : https://otx.alienvault.com/indicator/domain/remotewd.com",
        "http://sexkompas.xyz",
        "Botnet Server IP: 141.226.230.48",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "192.168.122.29  | http://datatracker.ietf.org/doc/rfc1918 | Login Admin \u2022 Router Network",
        "192.168.122.29 | Private IP addresses in trace route",
        "Ransom: message.htm.com",
        "newrelic.se",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "tracking2youdu.com , cdn.livechatinc.com",
        "http://remotewd.com/ (Offline Hostname) Apple ID phishing | Downed malware",
        "Found in: https://jbplegal.com",
        "PEXE - DOS executable (COM)",
        "Route \u2192116.233.0.0/16(Route of ASN)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Maltiverse",
            "Win32:injector-cvf\\ [trj]\t\twin.mal",
            "Win.trojan.buzus-5453",
            "Trojan:win32/glupteba.mt!mtb",
            "Win32:pwsx-gen",
            "Win32:malware-gen",
            "Etpro",
            "Trojanspy",
            "Win.malware.vtflooder-6260355-1",
            "China telecom",
            "Generic",
            "Ryuk",
            "Cl0p"
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Healthcare",
            "Legal",
            "Civil society"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "65f55ed2015e05ffbc2b72a8",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-16T08:56:50.387000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65f980471600645142bcd924",
      "name": "Control Server | Browser Install| Kernel Modules and Extensions ",
      "description": "",
      "modified": "2024-04-15T08:03:32.381000",
      "created": "2024-03-19T12:08:39.100000",
      "tags": [
        "hostname",
        "sort",
        "domain",
        "type",
        "hostname c",
        "all octoseek",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "for privacy",
        "unknown",
        "united",
        "link",
        "search",
        "servers",
        "strapi app",
        "passive dns",
        "urls",
        "date",
        "body",
        "meta",
        "span",
        "next",
        "octoseek",
        "url https",
        "url http",
        "role title",
        "added active",
        "execution",
        "ssl certificate",
        "whois record",
        "contacted",
        "pe resource",
        "bundled",
        "historical ssl",
        "referrer",
        "communicating",
        "collections",
        "status",
        "emails",
        "creation date",
        "record value",
        "expiration date",
        "showing",
        "threat analyzer",
        "threat",
        "iocs",
        "hostnames",
        "urls https",
        "samples",
        "firehol",
        "proxy",
        "detection list",
        "ip address",
        "blacklist",
        "malicious url",
        "anonymizer",
        "botnet command",
        "malware",
        "generic malware",
        "count blacklist",
        "no data",
        "tag count",
        "detection",
        "count",
        "generic",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "filerepmetagen",
        "filerepmalware",
        "artemis",
        "presenoker",
        "unsafe",
        "riskware",
        "crack",
        "opencandy",
        "downloader",
        "coinminer",
        "installpack",
        "agent",
        "fusioncore",
        "conduit",
        "wacatac",
        "zbot",
        "cl0p",
        "maltiverse",
        "trojanspy",
        "engb",
        "emotet",
        "cyberwar",
        "ursnif",
        "attack",
        "hacktool",
        "ransomexx",
        "startpage",
        "bitrat",
        "ryuk",
        "agent tesla",
        "stealer",
        "critical",
        "copy",
        "evilnum",
        "threat report",
        "back",
        "ip summary",
        "url summary",
        "summary",
        "download csv",
        "download",
        "json sample",
        "malicious site",
        "phishing site",
        "iframe",
        "domaiq",
        "alexa",
        "downldr",
        "phishing",
        "cyber threat",
        "control server",
        "team",
        "installcore",
        "mirai",
        "pony",
        "nanocore",
        "bradesco",
        "cobalt strike",
        "bank",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "traffic et",
        "policy windows",
        "update p2p",
        "activity",
        "windir",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "hybrid",
        "general",
        "path",
        "click",
        "strings",
        "contact",
        "paste",
        "win32",
        "gmt content",
        "scan endpoints",
        "ipv4",
        "pulse pulses",
        "files",
        "accept",
        "date hash",
        "avast avg",
        "entries",
        "as15169 google",
        "aaaa",
        "ireland unknown",
        "germany unknown",
        "as43350 nforce"
      ],
      "references": [
        "https://api.wavebrowserbase.com",
        "Ransom: message.htm.com",
        "ZBot: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzl0WlhSaGJtOXBZV1pwYm1GdVkybGhiQzVqYjIxY0x6OTFkRzFmYzI5MWNtTmxQV1Z0WVdsc1gzTnBaMjVoZEhWeVpTWmhiWEE3ZFhSdFgyMWxaR2wxYlQxbGJXRnBiQ1poYlhBN2RYUnRYMk5oYlhCaGFXZHVQWEJ5YjIxdmRHbHZiaUlzSW1oaGMyZ2lPaUkwTjFGWlUzZFlTMkYxVDA1dVIxb2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2lhbWx0YlhrdWQyRnNhMlZ5UUdGc2JITjBZWFJsTG1OdmJTSjk9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOXRaWFJoYm05cFlX",
        "Ryuk: https://brain.snappykraken.com/api/v1/events-recorder/clicked?clicked=eyJxdWVyeV9zdHJpbmciOiJkako3SW5WeWJDSTZJbWgwZEhCek9sd3ZYQzkzZDNjdWEybHdiR2x1WjJWeUxtTnZiVnd2WldOdmJtOXRhV010Wm05eVpXTmhjM1J6WEM5cGJuUmxjbVZ6ZEMxeVlYUmxjeUlzSW1oaGMyZ2lPaUpzYmtJMWFUSjJkbmRvU21GQ1RuZ2lMQ0pqYjI1MFlXTjBYMlZ0WVdsc0lqb2liV052ZUVCdGIzSnlhWE56WlhsbGJtZHBibVZsY21sdVp5NWpiMjBpZlE9IiwicmVxdWVzdF9kYXRhIjp7ImRqSjdJblZ5YkNJNkltaDBkSEJ6T2x3dlhDOTNkM2N1YTJsd2JHbHVaMlZ5TG1OdmJWd3ZaV052Ym05dGFXTXRabTl5WldOaGMzUnpYQzlwYm5SbGNtVnpkQzF5",
        "Ryuk: http://kramtechnology.com/",
        "Ryuk: kramtechnology.com",
        "Pony: https://allspice.ordavida.com/api/mailings/opened/PMRGSZBCHIYTMNZQGYWCE33SM4RDUIRZGQZDONDBGIZC2MBXMM2S2NBYMM2S2YTEHE3C2MJZGI4DSOBYHAYTGNRZEIWCE5TFOJZWS33OEI5CENBCFQRHG2LHEI5CEYSPONYXS4RRGFBUIY3DKRIHSSRRK44WSY3FNM4ESVTJKZMHOWRTJBLXIYLIHFRWS3DUKU6SE7I=.gif",
        "Botnet Server IP: 141.226.230.48",
        "newrelic.se"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Cl0p",
          "display_name": "Cl0p",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1584.004",
          "name": "Server",
          "display_name": "T1584.004 - Server"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        },
        {
          "id": "T1547.006",
          "name": "Kernel Modules and Extensions",
          "display_name": "T1547.006 - Kernel Modules and Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65f55ed2015e05ffbc2b72a8",
      "export_count": 186884,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9838,
        "domain": 2085,
        "hostname": 3006,
        "FileHash-SHA256": 3685,
        "FileHash-MD5": 965,
        "FileHash-SHA1": 532,
        "email": 6,
        "CVE": 7
      },
      "indicator_count": 20124,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "734 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d411018926d62065fe0487",
      "name": "RFC 1918 - Address Allocation for Private Internets",
      "description": "Strategy used to mask and weaponize compromised consumer routers and devices. Data collection, dns poisoning, monitoring, tracking, etc. \nhttp://remotewd.com/ is offline however DGA hostnames continue to change rapidly. New devices added daily.\n\nMay be able to: Modify files in Chrome extension folder\nchrome.exe (PID: 2428)\nINFO\nReads the hosts file\nchrome.exe\nApplication launched itself\nMay have a relationship with BGP Tools. I don't know enough to provide more indepth information. Mysterious to me.",
      "modified": "2024-03-21T01:00:09.761000",
      "created": "2024-02-20T02:40:01.552000",
      "tags": [
        "parent siblings",
        "internet",
        "practice",
        "rekhter",
        "february",
        "best current",
        "page",
        "ip connectivity",
        "ip address",
        "allocation",
        "tcpip",
        "formats",
        "execution",
        "contacted",
        "dropped",
        "contacted urls",
        "pe resource",
        "bundled",
        "whois whois",
        "whois domain",
        "malibot",
        "linkid252669",
        "ryuk",
        "malicious",
        "iana",
        "orgtechref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "pro platform",
        "route",
        "telecom group",
        "general info",
        "geo shanghai",
        "china",
        "as4812",
        "china telecom",
        "group",
        "cn note",
        "registrar apnic",
        "apple id phishing",
        "command decode",
        "suricata ipv4",
        "united",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "suricata udpv4",
        "windir",
        "name server",
        "date",
        "general",
        "click",
        "strings",
        "contact",
        "octoseek",
        "as51407 mada",
        "asnone india",
        "asnone ukraine",
        "search",
        "status",
        "united kingdom",
        "asnone",
        "domain",
        "entries",
        "germany unknown",
        "as3320 deutsche",
        "as3209 vodafone",
        "italy unknown",
        "united arab",
        "china unknown",
        "spain unknown",
        "canada unknown",
        "as22773 cox",
        "active",
        "dead host"
      ],
      "references": [
        "http://remotewd.com/ (Offline Hostname) Apple ID phishing | Downed malware",
        "192.168.122.29  | http://datatracker.ietf.org/doc/rfc1918 | Login Admin \u2022 Router Network",
        "192.168.122.29 | Private IP addresses in trace route",
        "Route \u2192116.233.0.0/16(Route of ASN)",
        "Related : https://otx.alienvault.com/indicator/domain/remotewd.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Chile",
        "Palestine",
        "Australia",
        "Hong Kong",
        "Qatar",
        "Belgium",
        "Germany",
        "Malaysia",
        "Israel"
      ],
      "malware_families": [
        {
          "id": "China Telecom",
          "display_name": "China Telecom",
          "target": null
        },
        {
          "id": "Ryuk",
          "display_name": "Ryuk",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1468",
          "name": "Remotely Track Device Without Authorization",
          "display_name": "T1468 - Remotely Track Device Without Authorization"
        },
        {
          "id": "T1443",
          "name": "Remotely Install Application",
          "display_name": "T1443 - Remotely Install Application"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 411,
        "hostname": 589,
        "email": 7,
        "FileHash-MD5": 57,
        "FileHash-SHA1": 55,
        "FileHash-SHA256": 496,
        "URL": 50,
        "CIDR": 1
      },
      "indicator_count": 1666,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "759 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d4241f2ddabc00bb3c2b6e",
      "name": "Trojan.WannaCryptor/WannaCry ",
      "description": "",
      "modified": "2024-03-21T01:00:09.761000",
      "created": "2024-02-20T04:01:35.467000",
      "tags": [
        "parent siblings",
        "internet",
        "practice",
        "rekhter",
        "february",
        "best current",
        "page",
        "ip connectivity",
        "ip address",
        "allocation",
        "tcpip",
        "formats",
        "execution",
        "contacted",
        "dropped",
        "contacted urls",
        "pe resource",
        "bundled",
        "whois whois",
        "whois domain",
        "malibot",
        "linkid252669",
        "ryuk",
        "malicious",
        "iana",
        "orgtechref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "pro platform",
        "route",
        "telecom group",
        "general info",
        "geo shanghai",
        "china",
        "as4812",
        "china telecom",
        "group",
        "cn note",
        "registrar apnic",
        "apple id phishing",
        "command decode",
        "suricata ipv4",
        "united",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "suricata udpv4",
        "windir",
        "name server",
        "date",
        "general",
        "click",
        "strings",
        "contact",
        "octoseek",
        "as51407 mada",
        "asnone india",
        "asnone ukraine",
        "search",
        "status",
        "united kingdom",
        "asnone",
        "domain",
        "entries",
        "germany unknown",
        "as3320 deutsche",
        "as3209 vodafone",
        "italy unknown",
        "united arab",
        "china unknown",
        "spain unknown",
        "canada unknown",
        "as22773 cox",
        "active",
        "dead host"
      ],
      "references": [
        "http://remotewd.com/ (Offline Hostname) Apple ID phishing | Downed malware",
        "192.168.122.29  | http://datatracker.ietf.org/doc/rfc1918 | Login Admin \u2022 Router Network",
        "192.168.122.29 | Private IP addresses in trace route",
        "Route \u2192116.233.0.0/16(Route of ASN)",
        "Related : https://otx.alienvault.com/indicator/domain/remotewd.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Chile",
        "Palestine",
        "Australia",
        "Hong Kong",
        "Qatar",
        "Belgium",
        "Germany",
        "Malaysia",
        "Israel"
      ],
      "malware_families": [
        {
          "id": "China Telecom",
          "display_name": "China Telecom",
          "target": null
        },
        {
          "id": "Ryuk",
          "display_name": "Ryuk",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1468",
          "name": "Remotely Track Device Without Authorization",
          "display_name": "T1468 - Remotely Track Device Without Authorization"
        },
        {
          "id": "T1443",
          "name": "Remotely Install Application",
          "display_name": "T1443 - Remotely Install Application"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65d411018926d62065fe0487",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 411,
        "hostname": 589,
        "email": 7,
        "FileHash-MD5": 57,
        "FileHash-SHA1": 55,
        "FileHash-SHA256": 496,
        "URL": 50,
        "CIDR": 1
      },
      "indicator_count": 1666,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "759 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b2909ffdc623904cbfd91d",
      "name": "PEXE - DOS executable (COM)",
      "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-25T16:47:26.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757a662a146889c60b6c",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:10.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757d6dd7dae344aed3f5",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:13.209000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85dca7d8bf0aea33abc3a",
      "name": "PEXE - DOS executable ",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-30T02:24:10.454000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b4757a662a146889c60b6c",
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "springtech-apps.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "springtech-apps.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776611453.3477979
}