{
  "type": "Domain",
  "indicator": "yearswatch.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/yearswatch.com",
    "alexa": "http://www.alexa.com/siteinfo/yearswatch.com",
    "indicator": "yearswatch.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3782536522,
      "indicator": "yearswatch.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "655f6d7ac217661e4bc37f4d",
          "name": "Qbot | Miscellaneous Attacks",
          "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:19:22.356000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "891 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655f6d89b33758a190399f39",
          "name": "Qbot | Miscellaneous Attacks",
          "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:19:37.838000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "891 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655f6edffd3910161c2ad1a2",
          "name": "D26A | DNSpionage| Qbot | Tulach Malaware | https://theanimallawfirm.com/ | FakeAlert",
          "description": "",
          "modified": "2023-12-23T07:03:55.171000",
          "created": "2023-11-23T15:25:19.843000",
          "tags": [
            "pattern match",
            "ascii text",
            "file",
            "jpeg image",
            "exif standard",
            "tiff image",
            "png image",
            "united",
            "baseline",
            "rgba",
            "date",
            "class",
            "unknown",
            "hybrid",
            "accept",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "error",
            "firehol",
            "detection list",
            "ip address",
            "blacklist",
            "botnet command",
            "control server",
            "noname057",
            "facebook",
            "phishtank",
            "blacklist http",
            "organization",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "n64xtx0vpihxzc",
            "whois whois",
            "qpyrn6pd http",
            "referrer",
            "execution",
            "communicating",
            "core",
            "discord",
            "hiddentear",
            "metro",
            "probe",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bleachgap",
            "formbook",
            "nanocore",
            "roblox",
            "heur",
            "cyber threat",
            "engineering",
            "malware",
            "phishing",
            "malicious site",
            "phishing site",
            "covid19",
            "team",
            "bank",
            "cobalt strike",
            "artemis",
            "download",
            "zbot",
            "suppobox",
            "service",
            "downloader",
            "virut",
            "malicious",
            "emotet",
            "stealer",
            "exploit",
            "generic",
            "dropper",
            "unruy",
            "agent",
            "unsafe",
            "ramnit",
            "redline stealer",
            "smsspy",
            "bradesco",
            "fakealert",
            "qakbot",
            "outbreak",
            "qbot",
            "bankerx",
            "riskware",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "crack",
            "win64",
            "squirrelwaffle",
            "pony",
            "binder",
            "virustotal",
            "azorult",
            "zeus",
            "nymaim",
            "matsnu",
            "simda",
            "runescape",
            "cutwail",
            "dnspionage",
            "redirector",
            "fusioncore",
            "iframe",
            "killav",
            "raccoon",
            "daum",
            "installcore",
            "ransomware",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "presenoker",
            "downldr",
            "alexa",
            "applicunwnt",
            "opencandy",
            "cleaner",
            "wacatac",
            "xrat",
            "xtrat",
            "dbatloader",
            "infy",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "keygen",
            "fareit",
            "secrisk",
            "phish",
            "deepscan",
            "trojanspy",
            "maltiverse",
            "qpyrn6pd",
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
            "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
            "*otc.greatcall.com    [Botnetwork]",
            "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
            "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
            "tulach.cc.     [Malevolent | Modified description]",
            "https://tulach.cc/ [phishing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
            "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
            "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
          ],
          "public": 1,
          "adversary": "Qbot",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "655f6d89b33758a190399f39",
          "export_count": 86,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 897,
            "FileHash-SHA1": 479,
            "URL": 9847,
            "domain": 2344,
            "hostname": 2398,
            "CVE": 22,
            "FileHash-SHA256": 4712
          },
          "indicator_count": 20699,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "891 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655e7e82c65d8e9106e6a227",
          "name": "https://theanimallawfirm.com/",
          "description": "",
          "modified": "2023-12-22T21:04:18.086000",
          "created": "2023-11-22T22:19:46.485000",
          "tags": [
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "n64xtx0vpihxzc",
            "qpyrn6pd",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "site top",
            "alexa top",
            "safe site",
            "heur",
            "html",
            "site safe",
            "million",
            "malware",
            "artemis",
            "win64",
            "downldr",
            "presenoker",
            "fakealert",
            "riskware",
            "qakbot",
            "applicunwnt",
            "opencandy",
            "fusioncore",
            "cleaner",
            "wacatac",
            "exploit",
            "iframe",
            "dbatloader",
            "raccoon",
            "service",
            "agent",
            "alexa",
            "xtrat",
            "team",
            "phish",
            "deepscan",
            "crack",
            "suspicious",
            "phishing",
            "xrat",
            "cve201711882",
            "d26a",
            "maltiverse",
            "trojanspy",
            "united",
            "cyber threat",
            "engineering",
            "malicious site",
            "bank",
            "phishing site",
            "covid19",
            "facebook",
            "download",
            "emotet",
            "stealer",
            "suppobox",
            "downloader",
            "unsafe",
            "malicious",
            "smsspy",
            "cobalt strike",
            "generic",
            "dropper",
            "formbook",
            "unruy",
            "virut",
            "azorult",
            "zbot",
            "matsnu",
            "cutwail",
            "bradesco",
            "outbreak",
            "qbot",
            "bankerx",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "squirrelwaffle",
            "pony",
            "binder",
            "ramnit",
            "virustotal",
            "zeus",
            "nymaim",
            "simda",
            "runescape",
            "dnspionage",
            "redirector",
            "killav",
            "dcrat",
            "alien",
            "astaroth",
            "filerepmalware",
            "control server",
            "asyncrat",
            "redline stealer",
            "daum",
            "name verdict"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "D26A",
              "display_name": "D26A",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 62,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 592,
            "FileHash-SHA1": 320,
            "FileHash-SHA256": 1159,
            "URL": 1257,
            "domain": 1219,
            "hostname": 403,
            "CVE": 15
          },
          "indicator_count": 4965,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655e7ed63ab06f2006c90b1c",
          "name": "DNSpionage, ",
          "description": "",
          "modified": "2023-12-22T21:04:18.086000",
          "created": "2023-11-22T22:21:10.853000",
          "tags": [
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "n64xtx0vpihxzc",
            "qpyrn6pd",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "site top",
            "alexa top",
            "safe site",
            "heur",
            "html",
            "site safe",
            "million",
            "malware",
            "artemis",
            "win64",
            "downldr",
            "presenoker",
            "fakealert",
            "riskware",
            "qakbot",
            "applicunwnt",
            "opencandy",
            "fusioncore",
            "cleaner",
            "wacatac",
            "exploit",
            "iframe",
            "dbatloader",
            "raccoon",
            "service",
            "agent",
            "alexa",
            "xtrat",
            "team",
            "phish",
            "deepscan",
            "crack",
            "suspicious",
            "phishing",
            "xrat",
            "cve201711882",
            "d26a",
            "maltiverse",
            "trojanspy",
            "united",
            "cyber threat",
            "engineering",
            "malicious site",
            "bank",
            "phishing site",
            "covid19",
            "facebook",
            "download",
            "emotet",
            "stealer",
            "suppobox",
            "downloader",
            "unsafe",
            "malicious",
            "smsspy",
            "cobalt strike",
            "generic",
            "dropper",
            "formbook",
            "unruy",
            "virut",
            "azorult",
            "zbot",
            "matsnu",
            "cutwail",
            "bradesco",
            "outbreak",
            "qbot",
            "bankerx",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "squirrelwaffle",
            "pony",
            "binder",
            "ramnit",
            "virustotal",
            "zeus",
            "nymaim",
            "simda",
            "runescape",
            "dnspionage",
            "redirector",
            "killav",
            "dcrat",
            "alien",
            "astaroth",
            "filerepmalware",
            "control server",
            "asyncrat",
            "redline stealer",
            "daum",
            "name verdict"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "D26A",
              "display_name": "D26A",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655e7e82c65d8e9106e6a227",
          "export_count": 64,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 592,
            "FileHash-SHA1": 320,
            "FileHash-SHA256": 1159,
            "URL": 1257,
            "domain": 1219,
            "hostname": 403,
            "CVE": 15
          },
          "indicator_count": 4965,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a9f3ad7db0aa9475e86d0",
          "name": "https://theanimallawfirm.com/",
          "description": "",
          "modified": "2023-12-22T21:04:18.086000",
          "created": "2023-12-02T03:06:34.870000",
          "tags": [
            "spyware",
            "injector",
            "jul jan",
            "tag count",
            "tue jan",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "n64xtx0vpihxzc",
            "qpyrn6pd",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "site top",
            "alexa top",
            "safe site",
            "heur",
            "html",
            "site safe",
            "million",
            "malware",
            "artemis",
            "win64",
            "downldr",
            "presenoker",
            "fakealert",
            "riskware",
            "qakbot",
            "applicunwnt",
            "opencandy",
            "fusioncore",
            "cleaner",
            "wacatac",
            "exploit",
            "iframe",
            "dbatloader",
            "raccoon",
            "service",
            "agent",
            "alexa",
            "xtrat",
            "team",
            "phish",
            "deepscan",
            "crack",
            "suspicious",
            "phishing",
            "xrat",
            "cve201711882",
            "d26a",
            "maltiverse",
            "trojanspy",
            "united",
            "cyber threat",
            "engineering",
            "malicious site",
            "bank",
            "phishing site",
            "covid19",
            "facebook",
            "download",
            "emotet",
            "stealer",
            "suppobox",
            "downloader",
            "unsafe",
            "malicious",
            "smsspy",
            "cobalt strike",
            "generic",
            "dropper",
            "formbook",
            "unruy",
            "virut",
            "azorult",
            "zbot",
            "matsnu",
            "cutwail",
            "bradesco",
            "outbreak",
            "qbot",
            "bankerx",
            "nimda",
            "swrort",
            "adwind",
            "trojanx",
            "squirrelwaffle",
            "pony",
            "binder",
            "ramnit",
            "virustotal",
            "zeus",
            "nymaim",
            "simda",
            "runescape",
            "dnspionage",
            "redirector",
            "killav",
            "dcrat",
            "alien",
            "astaroth",
            "filerepmalware",
            "control server",
            "asyncrat",
            "redline stealer",
            "daum",
            "name verdict"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "D26A",
              "display_name": "D26A",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655e7e82c65d8e9106e6a227",
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 592,
            "FileHash-SHA1": 320,
            "FileHash-SHA256": 1159,
            "URL": 1257,
            "domain": 1219,
            "hostname": 403,
            "CVE": 15
          },
          "indicator_count": 4965,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "892 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6558c481715409563073cb79",
          "name": "Fraud Services",
          "description": "http://kramtechnology.com/, fraud services, network, rat, trojan, phishing, malvertizing, malware hosting, scanning host, archives browser events.",
          "modified": "2023-12-18T05:05:36.760000",
          "created": "2023-11-18T14:04:48.923000",
          "tags": [
            "methodpost",
            "dropped",
            "contacted",
            "ssl certificate",
            "whois record",
            "zva8k4ghshhpcb5",
            "contacted urls",
            "q0gpyr1balpdgpo",
            "historical ssl",
            "page dow",
            "blacklist http",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "paypal",
            "team phishing",
            "malicious url",
            "alexa",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "malware",
            "united",
            "passive dns",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "reverse dns",
            "twitter",
            "log id",
            "gmtn",
            "sectigo rsa",
            "secure server",
            "tls web",
            "salford",
            "sectigo limited",
            "ocsp",
            "false",
            "california",
            "british virgin",
            "locality",
            "d3 a5",
            "url http"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14816,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 5158,
            "domain": 3758,
            "hostname": 2961,
            "email": 4,
            "SSLCertFingerprint": 3,
            "CVE": 3
          },
          "indicator_count": 26777,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6553b88c316cfb531b9c4c10",
          "name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go.com",
          "description": "spyware, 114.114.114.114, Tulach, C2, apple iOS, passwords, crack, unlock , click, att, hughesnet",
          "modified": "2023-12-14T15:03:30.417000",
          "created": "2023-11-14T18:12:28.459000",
          "tags": [
            "united",
            "blacklist",
            "malicious site",
            "mail spammer",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "malware",
            "phishing site",
            "heur",
            "malware site",
            "alexa top",
            "million",
            "unsafe",
            "artemis",
            "riskware",
            "conduit",
            "agent",
            "opencandy",
            "xtrat",
            "iframe",
            "cleaner",
            "team",
            "installpack",
            "xrat",
            "tiggre",
            "presenoker",
            "fusioncore",
            "wacatac",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "crack",
            "softcnapp",
            "trojanspy",
            "maltiverse",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "ascii text",
            "mitre att",
            "localappdata",
            "temp",
            "ck id",
            "date",
            "unknown",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "expiressun",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pt3uc1",
            "path",
            "movies",
            "watch",
            "html info",
            "meta tags",
            "suddenlink tv",
            "trackers amazon",
            "pt3rc1",
            "whois record",
            "whois whois",
            "ssl certificate",
            "historical",
            "historical ssl",
            "referrer",
            "communicating",
            "dropped",
            "contacted",
            "apple ios",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "attack",
            "awful",
            "brian sabey",
            "aig",
            "civicaIg",
            "tracking",
            "password crack",
            "tulach",
            "target tsara brashears",
            "tylerknott",
            "att",
            "monitoring",
            "spyware",
            "spying",
            "cybercrime",
            "tulach",
            "hughesnet",
            "ios",
            "toshiba",
            "attack",
            "malvertizing",
            "cyber stalking",
            "porn",
            "pornhub"
          ],
          "references": [
            "http://mobile.suddenlink2go.com/",
            "https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
            "https://applemusic-spotlight.myunidays.com/US/en-US?",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "myhughesnet.com",
            "dishmail.net",
            "home.toshiba.com",
            "ytq2rs56.haogfw.com",
            "pornhub.com",
            "http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
            "http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
            "monitor.cablelan.net",
            "https://monitor.rodgersmith.com",
            "https://www.everycloudtech.com/free-mail-flow-monitor"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 179,
            "FileHash-SHA256": 4528,
            "CVE": 7,
            "domain": 2024,
            "hostname": 3556,
            "URL": 10455
          },
          "indicator_count": 20893,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "900 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65568ab12429c394dc4b91ea",
          "name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go",
          "description": "",
          "modified": "2023-12-14T15:03:30.417000",
          "created": "2023-11-16T21:33:37.838000",
          "tags": [
            "united",
            "blacklist",
            "malicious site",
            "mail spammer",
            "detection list",
            "cisco umbrella",
            "site",
            "safe site",
            "malware",
            "phishing site",
            "heur",
            "malware site",
            "alexa top",
            "million",
            "unsafe",
            "artemis",
            "riskware",
            "conduit",
            "agent",
            "opencandy",
            "xtrat",
            "iframe",
            "cleaner",
            "team",
            "installpack",
            "xrat",
            "tiggre",
            "presenoker",
            "fusioncore",
            "wacatac",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "crack",
            "softcnapp",
            "trojanspy",
            "maltiverse",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "ascii text",
            "mitre att",
            "localappdata",
            "temp",
            "ck id",
            "date",
            "unknown",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "expiressun",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "pt3uc1",
            "path",
            "movies",
            "watch",
            "html info",
            "meta tags",
            "suddenlink tv",
            "trackers amazon",
            "pt3rc1",
            "whois record",
            "whois whois",
            "ssl certificate",
            "historical",
            "historical ssl",
            "referrer",
            "communicating",
            "dropped",
            "contacted",
            "apple ios",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "attack",
            "awful",
            "brian sabey",
            "aig",
            "civicaIg",
            "tracking",
            "password crack",
            "tulach",
            "target tsara brashears",
            "tylerknott",
            "att",
            "monitoring",
            "spyware",
            "spying",
            "cybercrime",
            "tulach",
            "hughesnet",
            "ios",
            "toshiba",
            "attack",
            "malvertizing",
            "cyber stalking",
            "porn",
            "pornhub"
          ],
          "references": [
            "http://mobile.suddenlink2go.com/",
            "https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
            "https://applemusic-spotlight.myunidays.com/US/en-US?",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "myhughesnet.com",
            "dishmail.net",
            "home.toshiba.com",
            "ytq2rs56.haogfw.com",
            "pornhub.com",
            "http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
            "http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
            "monitor.cablelan.net",
            "https://monitor.rodgersmith.com",
            "https://www.everycloudtech.com/free-mail-flow-monitor"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6553b88c316cfb531b9c4c10",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 179,
            "FileHash-SHA256": 4528,
            "CVE": 7,
            "domain": 2024,
            "hostname": 3556,
            "URL": 10455
          },
          "indicator_count": 20893,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "900 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65536bc6301b7cdf7d04e095",
          "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20",
          "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...",
          "modified": "2023-12-14T12:03:15.957000",
          "created": "2023-11-14T12:44:54.422000",
          "tags": [
            "passive dns",
            "urls",
            "t1604023287",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "ssl certificate",
            "whois record",
            "resolutions",
            "referrer",
            "historical ssl",
            "communicating",
            "threat roundup",
            "whois whois",
            "apple",
            "stopransomware",
            "core",
            "discord",
            "metro",
            "blister",
            "cobalt strike",
            "hacktool",
            "june",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "misc attack",
            "link",
            "woff2",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "date",
            "click",
            "unknown",
            "meta",
            "hybrid",
            "general",
            "local",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "execution",
            "malware",
            "network",
            "roblox",
            "united",
            "as13335",
            "a domains",
            "status",
            "aaaa",
            "search",
            "script urls",
            "creation date",
            "showing",
            "pixel",
            "win32",
            "download",
            "t1507537243"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11333,
            "FileHash-MD5": 81,
            "FileHash-SHA1": 74,
            "FileHash-SHA256": 3269,
            "domain": 2748,
            "hostname": 3475,
            "email": 2,
            "CVE": 2
          },
          "indicator_count": 20984,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "900 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65536bdc3676a40633a619be",
          "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20",
          "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...",
          "modified": "2023-12-14T12:03:15.957000",
          "created": "2023-11-14T12:45:16.667000",
          "tags": [
            "passive dns",
            "urls",
            "t1604023287",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "ssl certificate",
            "whois record",
            "resolutions",
            "referrer",
            "historical ssl",
            "communicating",
            "threat roundup",
            "whois whois",
            "apple",
            "stopransomware",
            "core",
            "discord",
            "metro",
            "blister",
            "cobalt strike",
            "hacktool",
            "june",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "misc attack",
            "link",
            "woff2",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "date",
            "click",
            "unknown",
            "meta",
            "hybrid",
            "general",
            "local",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "execution",
            "malware",
            "network",
            "roblox",
            "united",
            "as13335",
            "a domains",
            "status",
            "aaaa",
            "search",
            "script urls",
            "creation date",
            "showing",
            "pixel",
            "win32",
            "download",
            "t1507537243"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11333,
            "FileHash-MD5": 81,
            "FileHash-SHA1": 74,
            "FileHash-SHA256": 3269,
            "domain": 2748,
            "hostname": 3475,
            "email": 2,
            "CVE": 2
          },
          "indicator_count": 20984,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "900 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65568d67bd96e06ab44b9b95",
          "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20",
          "description": "",
          "modified": "2023-12-14T12:03:15.957000",
          "created": "2023-11-16T21:45:11.721000",
          "tags": [
            "passive dns",
            "urls",
            "t1604023287",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "ssl certificate",
            "whois record",
            "resolutions",
            "referrer",
            "historical ssl",
            "communicating",
            "threat roundup",
            "whois whois",
            "apple",
            "stopransomware",
            "core",
            "discord",
            "metro",
            "blister",
            "cobalt strike",
            "hacktool",
            "june",
            "name verdict",
            "pattern match",
            "et tor",
            "known tor",
            "misc attack",
            "link",
            "woff2",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "date",
            "click",
            "unknown",
            "meta",
            "hybrid",
            "general",
            "local",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "execution",
            "malware",
            "network",
            "roblox",
            "united",
            "as13335",
            "a domains",
            "status",
            "aaaa",
            "search",
            "script urls",
            "creation date",
            "showing",
            "pixel",
            "win32",
            "download",
            "t1507537243"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Roblox",
              "display_name": "Roblox",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65536bdc3676a40633a619be",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 11333,
            "FileHash-MD5": 81,
            "FileHash-SHA1": 74,
            "FileHash-SHA256": 3269,
            "domain": 2748,
            "hostname": 3475,
            "email": 2,
            "CVE": 2
          },
          "indicator_count": 20984,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "900 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://tulach.cc/ [phishing]",
        "https://applemusic-spotlight.myunidays.com/US/en-US?",
        "https://www.everycloudtech.com/free-mail-flow-monitor",
        "tulach.cc.     [Malevolent | Modified description]",
        "dishmail.net",
        "myhughesnet.com",
        "http://mobile.suddenlink2go.com/",
        "*otc.greatcall.com    [Botnetwork]",
        "http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
        "monitor.cablelan.net",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
        "ytq2rs56.haogfw.com",
        "https://monitor.rodgersmith.com",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]",
        "home.toshiba.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
        "pornhub.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Qbot"
          ],
          "malware_families": [
            "Roblox",
            "Maltiverse",
            "Trojanspy",
            "Tulach malware",
            "D26a"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "655f6d7ac217661e4bc37f4d",
      "name": "Qbot | Miscellaneous Attacks",
      "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:19:22.356000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "891 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655f6d89b33758a190399f39",
      "name": "Qbot | Miscellaneous Attacks",
      "description": "The following is a full list of links between malware and cyber-attackers, following a series of alerts from Phishtank, the UK-based cyber security firm, and the US government.",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:19:37.838000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 84,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "891 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655f6edffd3910161c2ad1a2",
      "name": "D26A | DNSpionage| Qbot | Tulach Malaware | https://theanimallawfirm.com/ | FakeAlert",
      "description": "",
      "modified": "2023-12-23T07:03:55.171000",
      "created": "2023-11-23T15:25:19.843000",
      "tags": [
        "pattern match",
        "ascii text",
        "file",
        "jpeg image",
        "exif standard",
        "tiff image",
        "png image",
        "united",
        "baseline",
        "rgba",
        "date",
        "class",
        "unknown",
        "hybrid",
        "accept",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "error",
        "firehol",
        "detection list",
        "ip address",
        "blacklist",
        "botnet command",
        "control server",
        "noname057",
        "facebook",
        "phishtank",
        "blacklist http",
        "organization",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "n64xtx0vpihxzc",
        "whois whois",
        "qpyrn6pd http",
        "referrer",
        "execution",
        "communicating",
        "core",
        "discord",
        "hiddentear",
        "metro",
        "probe",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bleachgap",
        "formbook",
        "nanocore",
        "roblox",
        "heur",
        "cyber threat",
        "engineering",
        "malware",
        "phishing",
        "malicious site",
        "phishing site",
        "covid19",
        "team",
        "bank",
        "cobalt strike",
        "artemis",
        "download",
        "zbot",
        "suppobox",
        "service",
        "downloader",
        "virut",
        "malicious",
        "emotet",
        "stealer",
        "exploit",
        "generic",
        "dropper",
        "unruy",
        "agent",
        "unsafe",
        "ramnit",
        "redline stealer",
        "smsspy",
        "bradesco",
        "fakealert",
        "qakbot",
        "outbreak",
        "qbot",
        "bankerx",
        "riskware",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "crack",
        "win64",
        "squirrelwaffle",
        "pony",
        "binder",
        "virustotal",
        "azorult",
        "zeus",
        "nymaim",
        "matsnu",
        "simda",
        "runescape",
        "cutwail",
        "dnspionage",
        "redirector",
        "fusioncore",
        "iframe",
        "killav",
        "raccoon",
        "daum",
        "installcore",
        "ransomware",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "presenoker",
        "downldr",
        "alexa",
        "applicunwnt",
        "opencandy",
        "cleaner",
        "wacatac",
        "xrat",
        "xtrat",
        "dbatloader",
        "infy",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "keygen",
        "fareit",
        "secrisk",
        "phish",
        "deepscan",
        "trojanspy",
        "maltiverse",
        "qpyrn6pd",
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/d4e0619008da0bf555fd1d9af2797eaed02c89512239cbdaf64c08e795bb9658",
        "http://www.jamesbgriffinlaw.com/wp-content/plugins/formcraft/file-upload/server/content/files/16132c66b562a3---dewubomojagorekijufuruni [ Malicious Plugins]",
        "*otc.greatcall.com    [Botnetwork]",
        "https://www.norad.mil/ [ Modified by others| Parking Crew - is a Tracker]",
        "https://otx.alienvault.com/indicator/url/http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [ Malware Server | iTunes path hacktool]",
        "tulach.cc.     [Malevolent | Modified description]",
        "https://tulach.cc/ [phishing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ ELF - Descriptions modified by others]",
        "https://www.pornhub.com/video/search?search=tsara+brashears [NORAD.mil phone tracking. Description modified]",
        "s3.amazonaws.com   [Virut Tsara Brashears Botnetwork | Modified description]"
      ],
      "public": 1,
      "adversary": "Qbot",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "655f6d89b33758a190399f39",
      "export_count": 86,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 897,
        "FileHash-SHA1": 479,
        "URL": 9847,
        "domain": 2344,
        "hostname": 2398,
        "CVE": 22,
        "FileHash-SHA256": 4712
      },
      "indicator_count": 20699,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "891 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655e7e82c65d8e9106e6a227",
      "name": "https://theanimallawfirm.com/",
      "description": "",
      "modified": "2023-12-22T21:04:18.086000",
      "created": "2023-11-22T22:19:46.485000",
      "tags": [
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "n64xtx0vpihxzc",
        "qpyrn6pd",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "site top",
        "alexa top",
        "safe site",
        "heur",
        "html",
        "site safe",
        "million",
        "malware",
        "artemis",
        "win64",
        "downldr",
        "presenoker",
        "fakealert",
        "riskware",
        "qakbot",
        "applicunwnt",
        "opencandy",
        "fusioncore",
        "cleaner",
        "wacatac",
        "exploit",
        "iframe",
        "dbatloader",
        "raccoon",
        "service",
        "agent",
        "alexa",
        "xtrat",
        "team",
        "phish",
        "deepscan",
        "crack",
        "suspicious",
        "phishing",
        "xrat",
        "cve201711882",
        "d26a",
        "maltiverse",
        "trojanspy",
        "united",
        "cyber threat",
        "engineering",
        "malicious site",
        "bank",
        "phishing site",
        "covid19",
        "facebook",
        "download",
        "emotet",
        "stealer",
        "suppobox",
        "downloader",
        "unsafe",
        "malicious",
        "smsspy",
        "cobalt strike",
        "generic",
        "dropper",
        "formbook",
        "unruy",
        "virut",
        "azorult",
        "zbot",
        "matsnu",
        "cutwail",
        "bradesco",
        "outbreak",
        "qbot",
        "bankerx",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "squirrelwaffle",
        "pony",
        "binder",
        "ramnit",
        "virustotal",
        "zeus",
        "nymaim",
        "simda",
        "runescape",
        "dnspionage",
        "redirector",
        "killav",
        "dcrat",
        "alien",
        "astaroth",
        "filerepmalware",
        "control server",
        "asyncrat",
        "redline stealer",
        "daum",
        "name verdict"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "D26A",
          "display_name": "D26A",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 62,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 592,
        "FileHash-SHA1": 320,
        "FileHash-SHA256": 1159,
        "URL": 1257,
        "domain": 1219,
        "hostname": 403,
        "CVE": 15
      },
      "indicator_count": 4965,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655e7ed63ab06f2006c90b1c",
      "name": "DNSpionage, ",
      "description": "",
      "modified": "2023-12-22T21:04:18.086000",
      "created": "2023-11-22T22:21:10.853000",
      "tags": [
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "n64xtx0vpihxzc",
        "qpyrn6pd",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "site top",
        "alexa top",
        "safe site",
        "heur",
        "html",
        "site safe",
        "million",
        "malware",
        "artemis",
        "win64",
        "downldr",
        "presenoker",
        "fakealert",
        "riskware",
        "qakbot",
        "applicunwnt",
        "opencandy",
        "fusioncore",
        "cleaner",
        "wacatac",
        "exploit",
        "iframe",
        "dbatloader",
        "raccoon",
        "service",
        "agent",
        "alexa",
        "xtrat",
        "team",
        "phish",
        "deepscan",
        "crack",
        "suspicious",
        "phishing",
        "xrat",
        "cve201711882",
        "d26a",
        "maltiverse",
        "trojanspy",
        "united",
        "cyber threat",
        "engineering",
        "malicious site",
        "bank",
        "phishing site",
        "covid19",
        "facebook",
        "download",
        "emotet",
        "stealer",
        "suppobox",
        "downloader",
        "unsafe",
        "malicious",
        "smsspy",
        "cobalt strike",
        "generic",
        "dropper",
        "formbook",
        "unruy",
        "virut",
        "azorult",
        "zbot",
        "matsnu",
        "cutwail",
        "bradesco",
        "outbreak",
        "qbot",
        "bankerx",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "squirrelwaffle",
        "pony",
        "binder",
        "ramnit",
        "virustotal",
        "zeus",
        "nymaim",
        "simda",
        "runescape",
        "dnspionage",
        "redirector",
        "killav",
        "dcrat",
        "alien",
        "astaroth",
        "filerepmalware",
        "control server",
        "asyncrat",
        "redline stealer",
        "daum",
        "name verdict"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "D26A",
          "display_name": "D26A",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655e7e82c65d8e9106e6a227",
      "export_count": 64,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 592,
        "FileHash-SHA1": 320,
        "FileHash-SHA256": 1159,
        "URL": 1257,
        "domain": 1219,
        "hostname": 403,
        "CVE": 15
      },
      "indicator_count": 4965,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "656a9f3ad7db0aa9475e86d0",
      "name": "https://theanimallawfirm.com/",
      "description": "",
      "modified": "2023-12-22T21:04:18.086000",
      "created": "2023-12-02T03:06:34.870000",
      "tags": [
        "spyware",
        "injector",
        "jul jan",
        "tag count",
        "tue jan",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "n64xtx0vpihxzc",
        "qpyrn6pd",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "site top",
        "alexa top",
        "safe site",
        "heur",
        "html",
        "site safe",
        "million",
        "malware",
        "artemis",
        "win64",
        "downldr",
        "presenoker",
        "fakealert",
        "riskware",
        "qakbot",
        "applicunwnt",
        "opencandy",
        "fusioncore",
        "cleaner",
        "wacatac",
        "exploit",
        "iframe",
        "dbatloader",
        "raccoon",
        "service",
        "agent",
        "alexa",
        "xtrat",
        "team",
        "phish",
        "deepscan",
        "crack",
        "suspicious",
        "phishing",
        "xrat",
        "cve201711882",
        "d26a",
        "maltiverse",
        "trojanspy",
        "united",
        "cyber threat",
        "engineering",
        "malicious site",
        "bank",
        "phishing site",
        "covid19",
        "facebook",
        "download",
        "emotet",
        "stealer",
        "suppobox",
        "downloader",
        "unsafe",
        "malicious",
        "smsspy",
        "cobalt strike",
        "generic",
        "dropper",
        "formbook",
        "unruy",
        "virut",
        "azorult",
        "zbot",
        "matsnu",
        "cutwail",
        "bradesco",
        "outbreak",
        "qbot",
        "bankerx",
        "nimda",
        "swrort",
        "adwind",
        "trojanx",
        "squirrelwaffle",
        "pony",
        "binder",
        "ramnit",
        "virustotal",
        "zeus",
        "nymaim",
        "simda",
        "runescape",
        "dnspionage",
        "redirector",
        "killav",
        "dcrat",
        "alien",
        "astaroth",
        "filerepmalware",
        "control server",
        "asyncrat",
        "redline stealer",
        "daum",
        "name verdict"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "D26A",
          "display_name": "D26A",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655e7e82c65d8e9106e6a227",
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 592,
        "FileHash-SHA1": 320,
        "FileHash-SHA256": 1159,
        "URL": 1257,
        "domain": 1219,
        "hostname": 403,
        "CVE": 15
      },
      "indicator_count": 4965,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "892 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6558c481715409563073cb79",
      "name": "Fraud Services",
      "description": "http://kramtechnology.com/, fraud services, network, rat, trojan, phishing, malvertizing, malware hosting, scanning host, archives browser events.",
      "modified": "2023-12-18T05:05:36.760000",
      "created": "2023-11-18T14:04:48.923000",
      "tags": [
        "methodpost",
        "dropped",
        "contacted",
        "ssl certificate",
        "whois record",
        "zva8k4ghshhpcb5",
        "contacted urls",
        "q0gpyr1balpdgpo",
        "historical ssl",
        "page dow",
        "blacklist http",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "paypal",
        "team phishing",
        "malicious url",
        "alexa",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "malware",
        "united",
        "passive dns",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "reverse dns",
        "twitter",
        "log id",
        "gmtn",
        "sectigo rsa",
        "secure server",
        "tls web",
        "salford",
        "sectigo limited",
        "ocsp",
        "false",
        "california",
        "british virgin",
        "locality",
        "d3 a5",
        "url http"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14816,
        "FileHash-MD5": 41,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 5158,
        "domain": 3758,
        "hostname": 2961,
        "email": 4,
        "SSLCertFingerprint": 3,
        "CVE": 3
      },
      "indicator_count": 26777,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6553b88c316cfb531b9c4c10",
      "name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go.com",
      "description": "spyware, 114.114.114.114, Tulach, C2, apple iOS, passwords, crack, unlock , click, att, hughesnet",
      "modified": "2023-12-14T15:03:30.417000",
      "created": "2023-11-14T18:12:28.459000",
      "tags": [
        "united",
        "blacklist",
        "malicious site",
        "mail spammer",
        "detection list",
        "cisco umbrella",
        "site",
        "safe site",
        "malware",
        "phishing site",
        "heur",
        "malware site",
        "alexa top",
        "million",
        "unsafe",
        "artemis",
        "riskware",
        "conduit",
        "agent",
        "opencandy",
        "xtrat",
        "iframe",
        "cleaner",
        "team",
        "installpack",
        "xrat",
        "tiggre",
        "presenoker",
        "fusioncore",
        "wacatac",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "crack",
        "softcnapp",
        "trojanspy",
        "maltiverse",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "ascii text",
        "mitre att",
        "localappdata",
        "temp",
        "ck id",
        "date",
        "unknown",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "expiressun",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "pt3uc1",
        "path",
        "movies",
        "watch",
        "html info",
        "meta tags",
        "suddenlink tv",
        "trackers amazon",
        "pt3rc1",
        "whois record",
        "whois whois",
        "ssl certificate",
        "historical",
        "historical ssl",
        "referrer",
        "communicating",
        "dropped",
        "contacted",
        "apple ios",
        "hacktool",
        "metro",
        "malicious",
        "crypto",
        "installer",
        "attack",
        "awful",
        "brian sabey",
        "aig",
        "civicaIg",
        "tracking",
        "password crack",
        "tulach",
        "target tsara brashears",
        "tylerknott",
        "att",
        "monitoring",
        "spyware",
        "spying",
        "cybercrime",
        "tulach",
        "hughesnet",
        "ios",
        "toshiba",
        "attack",
        "malvertizing",
        "cyber stalking",
        "porn",
        "pornhub"
      ],
      "references": [
        "http://mobile.suddenlink2go.com/",
        "https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
        "https://applemusic-spotlight.myunidays.com/US/en-US?",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "myhughesnet.com",
        "dishmail.net",
        "home.toshiba.com",
        "ytq2rs56.haogfw.com",
        "pornhub.com",
        "http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
        "http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
        "monitor.cablelan.net",
        "https://monitor.rodgersmith.com",
        "https://www.everycloudtech.com/free-mail-flow-monitor"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 179,
        "FileHash-SHA256": 4528,
        "CVE": 7,
        "domain": 2024,
        "hostname": 3556,
        "URL": 10455
      },
      "indicator_count": 20893,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "900 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65568ab12429c394dc4b91ea",
      "name": "iOS Unlocker| Apple | ATT | Monitoring| http://mobile.suddenlink2go",
      "description": "",
      "modified": "2023-12-14T15:03:30.417000",
      "created": "2023-11-16T21:33:37.838000",
      "tags": [
        "united",
        "blacklist",
        "malicious site",
        "mail spammer",
        "detection list",
        "cisco umbrella",
        "site",
        "safe site",
        "malware",
        "phishing site",
        "heur",
        "malware site",
        "alexa top",
        "million",
        "unsafe",
        "artemis",
        "riskware",
        "conduit",
        "agent",
        "opencandy",
        "xtrat",
        "iframe",
        "cleaner",
        "team",
        "installpack",
        "xrat",
        "tiggre",
        "presenoker",
        "fusioncore",
        "wacatac",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "crack",
        "softcnapp",
        "trojanspy",
        "maltiverse",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "ascii text",
        "mitre att",
        "localappdata",
        "temp",
        "ck id",
        "date",
        "unknown",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "expiressun",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "pt3uc1",
        "path",
        "movies",
        "watch",
        "html info",
        "meta tags",
        "suddenlink tv",
        "trackers amazon",
        "pt3rc1",
        "whois record",
        "whois whois",
        "ssl certificate",
        "historical",
        "historical ssl",
        "referrer",
        "communicating",
        "dropped",
        "contacted",
        "apple ios",
        "hacktool",
        "metro",
        "malicious",
        "crypto",
        "installer",
        "attack",
        "awful",
        "brian sabey",
        "aig",
        "civicaIg",
        "tracking",
        "password crack",
        "tulach",
        "target tsara brashears",
        "tylerknott",
        "att",
        "monitoring",
        "spyware",
        "spying",
        "cybercrime",
        "tulach",
        "hughesnet",
        "ios",
        "toshiba",
        "attack",
        "malvertizing",
        "cyber stalking",
        "porn",
        "pornhub"
      ],
      "references": [
        "http://mobile.suddenlink2go.com/",
        "https://hybrid-analysis.com/sample/889790f55a8a29ee75463bbcf014c3ed6cc76e6cd0278e491ec9fa1ed14862c4/655374e9921d5d73860b7db3",
        "https://applemusic-spotlight.myunidays.com/US/en-US?",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "myhughesnet.com",
        "dishmail.net",
        "home.toshiba.com",
        "ytq2rs56.haogfw.com",
        "pornhub.com",
        "http://trk.brother-root-rich-of.xyz/campaign?id=4f1426e9-22f8-4e7a-9c32-1b2d42867559&var1=&extcid=w9A2DTCOAL56FRAK125KMLAI",
        "http://trk.reverseparameter.site/gg/izuyv?to=https://mine-top-gratis-application.pw/e29481e9-a792-46a8-bbf0-188ed2a816ae/f10439e6-e61a-4420-ba88-29e9d1c5d2ea?brand=Lenovo&btd=dHJrLm1vYmlsZXRvcDIwMTh0ZWNoaWUueHl6&exptoken=MTU1NzUxMjgzMjgyMw==&lang=ar&model=K6+Note&td=dHJrLnJldmVyc2VwYXJhbWV0ZXIuc2l0ZS9wcmNlZWQ",
        "monitor.cablelan.net",
        "https://monitor.rodgersmith.com",
        "https://www.everycloudtech.com/free-mail-flow-monitor"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6553b88c316cfb531b9c4c10",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 179,
        "FileHash-SHA256": 4528,
        "CVE": 7,
        "domain": 2024,
        "hostname": 3556,
        "URL": 10455
      },
      "indicator_count": 20893,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "900 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65536bc6301b7cdf7d04e095",
      "name": "TrojanDownloader:Win32/Cutwail.BS/Win.Trojan.Pushdo-20",
      "description": "backdoor,trojan downloaders, networm, phishing, tracking, spyware, device commands...",
      "modified": "2023-12-14T12:03:15.957000",
      "created": "2023-11-14T12:44:54.422000",
      "tags": [
        "passive dns",
        "urls",
        "t1604023287",
        "scan endpoints",
        "all search",
        "otx octoseek",
        "url http",
        "pulse pulses",
        "http",
        "ip address",
        "ssl certificate",
        "whois record",
        "resolutions",
        "referrer",
        "historical ssl",
        "communicating",
        "threat roundup",
        "whois whois",
        "apple",
        "stopransomware",
        "core",
        "discord",
        "metro",
        "blister",
        "cobalt strike",
        "hacktool",
        "june",
        "name verdict",
        "pattern match",
        "et tor",
        "known tor",
        "misc attack",
        "link",
        "woff2",
        "relayrouter",
        "exit",
        "node traffic",
        "ascii text",
        "date",
        "click",
        "unknown",
        "meta",
        "hybrid",
        "general",
        "local",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "execution",
        "malware",
        "network",
        "roblox",
        "united",
        "as13335",
        "a domains",
        "status",
        "aaaa",
        "search",
        "script urls",
        "creation date",
        "showing",
        "pixel",
        "win32",
        "download",
        "t1507537243"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Roblox",
          "display_name": "Roblox",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 11333,
        "FileHash-MD5": 81,
        "FileHash-SHA1": 74,
        "FileHash-SHA256": 3269,
        "domain": 2748,
        "hostname": 3475,
        "email": 2,
        "CVE": 2
      },
      "indicator_count": 20984,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "900 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "yearswatch.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "yearswatch.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780363544.0186436
}