{ "type": "Domain", "indicator": "una.ca", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/una.ca", "alexa": "http://www.alexa.com/siteinfo/una.ca", "indicator": "una.ca", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4092089538, "indicator": "una.ca", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69e72d44bb57858cd46b3c8e", "name": "04.21.26 - AHS/Covenant Health/United Nurses/Alberta Doctors", "description": "Analyses of a few samples of problems that continue to spread around as a direct result of inaction by AHS/Covenant Health/Gov. Alberta/UAlberta.\nPII/PHI - Alberta Doctors & United Nurses // NathanIP Jodi Notified", "modified": "2026-05-21T09:40:07.961000", "created": "2026-04-21T07:54:44.662000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "AMA", "UNA", "AHS", "Covenant Health", "Connect Care", "AlbertaNDP" ], "references": [ "http://hybrid-analysis.com/file-collection/69c88e067efe5c20ff0e14da", "http://hybrid-analysis.com/file-collection/69c88ddb7a828cc98a0b5d0a", "http://hybrid-analysis.com/file-collection/69897cf33ec0874455036fdc", "http://hybrid-analysis.com/sample/0783c904e06bd678d9a060e2792a66a51d16e175ffb26f351cd5af17f61d5475", "http://hybrid-analysis.com/sample/5cbc6aba25c2151d71a2deb58f07a86097fafb4c375458f841c1e337cafc01c7/69203be81fa431c05d0e157f", "http://hybrid-analysis.com/sample/81e7491b17d5bf7a75c4fe9d24eb269d0a85bf8f8ac5c1be6b909e627287b8f4/68445d370bb5610af304f98c", "307fabc3ec54d141b7e9a8ae27258c4edd3801aaed9febb8c8e166c93eeaa466 4661ff6c9cece9774f34be180106d42b1d7dc770e7ef19a909e11b5899f8407a 9c4b06c1e8d0bdd6c16ca5efe547bdb067b372aaee54b5e2973c99f9d7f0641f 3132f97617635455e66f7f53282b4c7023f3939ce481ec13b4fbb39da0134140 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b 97cd8014827953e8d4c1b4797d03c47ed04e55c6957164439380bf3b7c962dad 6b3d6e268dcb76e175a7db3d9e031349ab2c32654c7e57581a851e64dd6214ab 7d592c61d98abf019ad7c47fb074f9c25a58149ceaf536005306d9d9e", "http://hybrid-analysis.com/file-collection/69dbfef2c548c576f7040936", "http://hybrid-analysis.com/sample/ca3ad00eb0c08e6cf6f4d0aec3fa82fc3bb715aba6d0365af89165560e569cff/6840e93d07e1fb99850dc5fb", "", "http://hybrid-analysis.com/sample/c3bebbff9e57e640178494d9d73eae1bf5859fe6edad062dea89dd6262d2a910/67f0335dd833bf8f7a06b644" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Education", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 471, "FileHash-MD5": 315, "FileHash-SHA1": 245, "SSLCertFingerprint": 74, "URL": 652, "domain": 123, "hostname": 183, "email": 28 }, "indicator_count": 2091, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6875cbb7f546e86006afa0ea", "name": "Ransomware attack ConnectCare Alberta - 07.12.25", "description": "On 07.12.25 ConnectCare Alberta experienced what was initially thought to be an outtage or downtime. Further analysis of data captured in realtime reveals this to not be the case. Healthcare Provider and patient services were disrupted across multiple zone in the Province of Alberta. Other organizations impacted include: The Government of Alberta, The Alberta NDP, The Alberta UCP, The University of Alberta, both Alberta Health Services & Covenant Health, Telus Communications, United Nurses of Alberta, Alberta Physicians Association, Treaty 8 FNA & Confederacy of Treaty Six, in addition to the City of Edmonton.\nGraph:", "modified": "2025-08-14T03:03:45.057000", "created": "2025-07-15T03:32:07.251000", "tags": [ "entity", "Alberta", "Alberta Health Services", "Covenent Health", "Alberta NDP", "Treaty 6", "Treaty 7", "Treaty 8", "UAlberta", "Connect Care", "Telus", "Rogers", "City of Edmonton", "Edmonton Police Services", "United Nurses of Alberta", "Alberta Medical Association", "EduRoam", "DGA", "Alberta Doctors", "University of Calgary", "Alberta UCP", "Ministry of Advanced Education", "Ministry of Health", "Ministry of Tech & Innovation", "Ransomware", "Botnet" ], "references": [ "https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs", "https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 122, "FileHash-SHA1": 123, "FileHash-SHA256": 931, "URL": 60, "domain": 58, "email": 2, "hostname": 812 }, "indicator_count": 2108, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "291 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68768fee832e9d7358e7ec77", "name": "IT4US Ransom clone", "description": "", "modified": "2025-08-14T03:03:45.057000", "created": "2025-07-15T17:29:18.363000", "tags": [ "entity", "Alberta", "Alberta Health Services", "Covenent Health", "Alberta NDP", "Treaty 6", "Treaty 7", "Treaty 8", "UAlberta", "Connect Care", "Telus", "Rogers", "City of Edmonton", "Edmonton Police Services", "United Nurses of Alberta", "Alberta Medical Association", "EduRoam", "DGA", "Alberta Doctors", "University of Calgary", "Alberta UCP", "Ministry of Advanced Education", "Ministry of Health", "Ministry of Tech & Innovation", "Ransomware", "Botnet" ], "references": [ "https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs", "https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education" ], "TLP": "white", "cloned_from": "6875cbb7f546e86006afa0ea", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Dougline", "id": "350513", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 122, "FileHash-SHA1": 123, "FileHash-SHA256": 931, "URL": 60, "domain": 58, "email": 2, "hostname": 812 }, "indicator_count": 2108, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "291 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "http://hybrid-analysis.com/file-collection/69c88ddb7a828cc98a0b5d0a", "http://hybrid-analysis.com/sample/5cbc6aba25c2151d71a2deb58f07a86097fafb4c375458f841c1e337cafc01c7/69203be81fa431c05d0e157f", "http://hybrid-analysis.com/sample/c3bebbff9e57e640178494d9d73eae1bf5859fe6edad062dea89dd6262d2a910/67f0335dd833bf8f7a06b644", "http://hybrid-analysis.com/file-collection/69897cf33ec0874455036fdc", "http://hybrid-analysis.com/sample/0783c904e06bd678d9a060e2792a66a51d16e175ffb26f351cd5af17f61d5475", "http://hybrid-analysis.com/sample/81e7491b17d5bf7a75c4fe9d24eb269d0a85bf8f8ac5c1be6b909e627287b8f4/68445d370bb5610af304f98c", "https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649", "http://hybrid-analysis.com/sample/ca3ad00eb0c08e6cf6f4d0aec3fa82fc3bb715aba6d0365af89165560e569cff/6840e93d07e1fb99850dc5fb", "307fabc3ec54d141b7e9a8ae27258c4edd3801aaed9febb8c8e166c93eeaa466 4661ff6c9cece9774f34be180106d42b1d7dc770e7ef19a909e11b5899f8407a 9c4b06c1e8d0bdd6c16ca5efe547bdb067b372aaee54b5e2973c99f9d7f0641f 3132f97617635455e66f7f53282b4c7023f3939ce481ec13b4fbb39da0134140 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b 97cd8014827953e8d4c1b4797d03c47ed04e55c6957164439380bf3b7c962dad 6b3d6e268dcb76e175a7db3d9e031349ab2c32654c7e57581a851e64dd6214ab 7d592c61d98abf019ad7c47fb074f9c25a58149ceaf536005306d9d9e", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs", "https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark", "http://hybrid-analysis.com/file-collection/69c88e067efe5c20ff0e14da", "http://hybrid-analysis.com/file-collection/69dbfef2c548c576f7040936", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [ "Education", "Government", "Healthcare" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "69e72d44bb57858cd46b3c8e", "name": "04.21.26 - AHS/Covenant Health/United Nurses/Alberta Doctors", "description": "Analyses of a few samples of problems that continue to spread around as a direct result of inaction by AHS/Covenant Health/Gov. Alberta/UAlberta.\nPII/PHI - Alberta Doctors & United Nurses // NathanIP Jodi Notified", "modified": "2026-05-21T09:40:07.961000", "created": "2026-04-21T07:54:44.662000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "AMA", "UNA", "AHS", "Covenant Health", "Connect Care", "AlbertaNDP" ], "references": [ "http://hybrid-analysis.com/file-collection/69c88e067efe5c20ff0e14da", "http://hybrid-analysis.com/file-collection/69c88ddb7a828cc98a0b5d0a", "http://hybrid-analysis.com/file-collection/69897cf33ec0874455036fdc", "http://hybrid-analysis.com/sample/0783c904e06bd678d9a060e2792a66a51d16e175ffb26f351cd5af17f61d5475", "http://hybrid-analysis.com/sample/5cbc6aba25c2151d71a2deb58f07a86097fafb4c375458f841c1e337cafc01c7/69203be81fa431c05d0e157f", "http://hybrid-analysis.com/sample/81e7491b17d5bf7a75c4fe9d24eb269d0a85bf8f8ac5c1be6b909e627287b8f4/68445d370bb5610af304f98c", "307fabc3ec54d141b7e9a8ae27258c4edd3801aaed9febb8c8e166c93eeaa466 4661ff6c9cece9774f34be180106d42b1d7dc770e7ef19a909e11b5899f8407a 9c4b06c1e8d0bdd6c16ca5efe547bdb067b372aaee54b5e2973c99f9d7f0641f 3132f97617635455e66f7f53282b4c7023f3939ce481ec13b4fbb39da0134140 6f533ccc79227e38f18bfc63bfc961ef4d3ee0e2bf33dd097ccf3548a12b743b 97cd8014827953e8d4c1b4797d03c47ed04e55c6957164439380bf3b7c962dad 6b3d6e268dcb76e175a7db3d9e031349ab2c32654c7e57581a851e64dd6214ab 7d592c61d98abf019ad7c47fb074f9c25a58149ceaf536005306d9d9e", "http://hybrid-analysis.com/file-collection/69dbfef2c548c576f7040936", "http://hybrid-analysis.com/sample/ca3ad00eb0c08e6cf6f4d0aec3fa82fc3bb715aba6d0365af89165560e569cff/6840e93d07e1fb99850dc5fb", "", "http://hybrid-analysis.com/sample/c3bebbff9e57e640178494d9d73eae1bf5859fe6edad062dea89dd6262d2a910/67f0335dd833bf8f7a06b644" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Education", "Government" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 471, "FileHash-MD5": 315, "FileHash-SHA1": 245, "SSLCertFingerprint": 74, "URL": 652, "domain": 123, "hostname": 183, "email": 28 }, "indicator_count": 2091, "is_author": false, "is_subscribing": null, "subscriber_count": 132, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6875cbb7f546e86006afa0ea", "name": "Ransomware attack ConnectCare Alberta - 07.12.25", "description": "On 07.12.25 ConnectCare Alberta experienced what was initially thought to be an outtage or downtime. Further analysis of data captured in realtime reveals this to not be the case. Healthcare Provider and patient services were disrupted across multiple zone in the Province of Alberta. Other organizations impacted include: The Government of Alberta, The Alberta NDP, The Alberta UCP, The University of Alberta, both Alberta Health Services & Covenant Health, Telus Communications, United Nurses of Alberta, Alberta Physicians Association, Treaty 8 FNA & Confederacy of Treaty Six, in addition to the City of Edmonton.\nGraph:", "modified": "2025-08-14T03:03:45.057000", "created": "2025-07-15T03:32:07.251000", "tags": [ "entity", "Alberta", "Alberta Health Services", "Covenent Health", "Alberta NDP", "Treaty 6", "Treaty 7", "Treaty 8", "UAlberta", "Connect Care", "Telus", "Rogers", "City of Edmonton", "Edmonton Police Services", "United Nurses of Alberta", "Alberta Medical Association", "EduRoam", "DGA", "Alberta Doctors", "University of Calgary", "Alberta UCP", "Ministry of Advanced Education", "Ministry of Health", "Ministry of Tech & Innovation", "Ransomware", "Botnet" ], "references": [ "https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs", "https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education" ], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 122, "FileHash-SHA1": 123, "FileHash-SHA256": 931, "URL": 60, "domain": 58, "email": 2, "hostname": 812 }, "indicator_count": 2108, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "291 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68768fee832e9d7358e7ec77", "name": "IT4US Ransom clone", "description": "", "modified": "2025-08-14T03:03:45.057000", "created": "2025-07-15T17:29:18.363000", "tags": [ "entity", "Alberta", "Alberta Health Services", "Covenent Health", "Alberta NDP", "Treaty 6", "Treaty 7", "Treaty 8", "UAlberta", "Connect Care", "Telus", "Rogers", "City of Edmonton", "Edmonton Police Services", "United Nurses of Alberta", "Alberta Medical Association", "EduRoam", "DGA", "Alberta Doctors", "University of Calgary", "Alberta UCP", "Ministry of Advanced Education", "Ministry of Health", "Ministry of Tech & Innovation", "Ransomware", "Botnet" ], "references": [ "https://www.virustotal.com/graph/embed/gdef52451e74740eaabbbcc6db2209b722e6a17129ba94f4eb92fa176bcea66f7?theme=dark", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb", "https://www.virustotal.com/gui/collection/525d014c83ee92554cb6a88685ba822e147f30dbc797a18b6071081a109b7dcb/iocs", "https://viz.greynoise.io/analysis/16d9bc15-d3ed-4e71-9631-16742e511649" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Healthcare", "Government", "Education" ], "TLP": "white", "cloned_from": "6875cbb7f546e86006afa0ea", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Dougline", "id": "350513", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 122, "FileHash-SHA1": 123, "FileHash-SHA256": 931, "URL": 60, "domain": 58, "email": 2, "hostname": 812 }, "indicator_count": 2108, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "291 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "una.ca", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "una.ca", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780347324.7190957 }