{
  "type": "Domain",
  "indicator": "zephyrproject.org",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/zephyrproject.org",
    "alexa": "http://www.alexa.com/siteinfo/zephyrproject.org",
    "indicator": "zephyrproject.org",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2899060849,
      "indicator": "zephyrproject.org",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68fbc84609098d17c316f23c",
          "name": "NSO - Multiple crimes",
          "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-24T18:41:10.936000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "148 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68fc18514965ccd3b55c216d",
          "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
          "description": "",
          "modified": "2025-11-23T17:00:58.297000",
          "created": "2025-10-25T00:22:41.686000",
          "tags": [
            "type indicator",
            "added active",
            "related pulses",
            "script urls",
            "united",
            "unknown ns",
            "a domains",
            "ip address",
            "meta",
            "asn as13335",
            "msie",
            "chrome",
            "ransom",
            "trojan",
            "passive dns",
            "backdoor",
            "http request",
            "twitter",
            "win32/crix.c check-in",
            "gmt content",
            "ipv4",
            "urls",
            "files",
            "data upload",
            "extraction",
            "domain add",
            "e emeseieee",
            "dynamicloader",
            "e eue",
            "eweienedeoewese",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "edeeefeaeuelete",
            "unknown",
            "write",
            "bits",
            "malware",
            "xserver",
            "encrypt",
            "unknown aaaa",
            "moved",
            "cloudfront x",
            "hio52 p1",
            "name servers",
            "accept encoding",
            "emails",
            "servers",
            "extr",
            "u a640",
            "a69f u",
            "fe2e fe2f",
            "u a720",
            "a7ff",
            "u feff",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "pattern match",
            "mitre att",
            "null",
            "body",
            "pizza",
            "friday",
            "hybrid",
            "general",
            "local",
            "path",
            "starfield",
            "iframe",
            "click",
            "strings",
            "core",
            "bet",
            "gambling",
            "record value",
            "date",
            "present sep",
            "present apr",
            "colombia",
            "present jun",
            "present nov",
            "cookie",
            "present oct",
            "entries",
            "next associated",
            "error",
            "attack",
            "government",
            "scotland",
            "news",
            "covid19",
            "subscribe",
            "october",
            "crown copyright",
            "nhs scotland",
            "parliament",
            "coronavirus",
            "redacted for",
            "domain status",
            "server",
            "privacy tech",
            "privacy admin",
            "email",
            "country",
            "postal code",
            "stateprovince",
            "code",
            "host name",
            "rdap database",
            "handle",
            "iana registrar",
            "entity roles",
            "links",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "medium",
            "write c",
            "search",
            "pe file",
            "high",
            "checks",
            "http",
            "delete",
            "copy",
            "guard",
            "mozilla",
            "next",
            "godaddy",
            "creation date",
            "hostname",
            "pulse submit",
            "url analysis",
            "domain",
            "files ip",
            "trojandropper",
            "mtb oct",
            "mtb may",
            "refloadapihash",
            "foundry",
            "fastly",
            "value a",
            "com laude",
            "ltd dba",
            "nomiq",
            "limited dba",
            "pulse",
            "location united",
            "asn asnone",
            "nameservers"
          ],
          "references": [
            "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
            "fazendabetb.live \u2022 bowiesports.com Check first???",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
            "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
            "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
            "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
            "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
            "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
            "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
            "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
            "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
            "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
            "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
            "The Scottish Government www.gov.scot The NHS Scotland support",
            "http://129.2.4.2/32 Lencr",
            "qlw020.managed-sprint.dynalabs.io (Check)",
            "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
            "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
            "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
            "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
            "ExternalHosts: US",
            "Starfield again - HoneyPot / Dod- DoW",
            "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
            "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
            "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
          ],
          "public": 1,
          "adversary": "NSO",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Bulgaria",
            "Singapore",
            "Denmark",
            "Australia",
            "Jersey",
            "Japan",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Autoit",
              "display_name": "Autoit",
              "target": null
            },
            {
              "id": "Ransom:Win32/Crowti",
              "display_name": "Ransom:Win32/Crowti",
              "target": "/malware/Ransom:Win32/Crowti"
            },
            {
              "id": "Backdoor:Win32/Tofsee.",
              "display_name": "Backdoor:Win32/Tofsee.",
              "target": "/malware/Backdoor:Win32/Tofsee."
            },
            {
              "id": "#Lowfi:SIGATTR:DownloadAndExecute",
              "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
              "target": null
            },
            {
              "id": "Win.Dropper.Vbclone",
              "display_name": "Win.Dropper.Vbclone",
              "target": null
            },
            {
              "id": "Win.Packer",
              "display_name": "Win.Packer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68fbc84609098d17c316f23c",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6261,
            "domain": 1806,
            "hostname": 2427,
            "FileHash-MD5": 384,
            "FileHash-SHA1": 381,
            "email": 13,
            "FileHash-SHA256": 1418,
            "SSLCertFingerprint": 14
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "148 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6877cca17fd9f682f402f0cd",
          "name": "Spyware-Published \u2022 Streamed Targets |. viostream.com",
          "description": "Spyware-Published \u2022 Streamed Targets |. viostream.com\nMercenary attacks on targets and associated stressed through a dark medium.\n\nOTX refreshed page so many times in bit sure if what I collected is in pulse.\n\nBlack screen. Refreshed x 5.",
          "modified": "2025-08-15T00:03:09.871000",
          "created": "2025-07-16T16:00:33.962000",
          "tags": [
            "united",
            "date",
            "passive dns",
            "urls",
            "creation date",
            "search",
            "showing",
            "title error",
            "hostname add",
            "pulse pulses",
            "body",
            "entries",
            "present jul",
            "present feb",
            "moved",
            "ip address",
            "record value",
            "encrypt",
            "pul data",
            "extraction",
            "pdf report",
            "pcap",
            "stix",
            "openloc",
            "enter",
            "data upload",
            "failed",
            "enter sc",
            "type",
            "extra",
            "include review",
            "exclude sugges",
            "enter s",
            "extra data",
            "included iocs",
            "se extra",
            "include",
            "review exclude",
            "suggested ous",
            "stop show",
            "typ hos",
            "damnin data",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "present showing",
            "extre",
            "sc data",
            "extr data",
            "includeracs",
            "review",
            "sugges data"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1462,
            "FileHash-SHA256": 540,
            "domain": 1201,
            "URL": 4095,
            "FileHash-MD5": 1,
            "email": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 7301,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "687439c2109c2b61e7afc717",
          "name": "OTX.AlienVault (2024) in Ebury Botnet-19/5/2024",
          "description": "",
          "modified": "2025-07-13T22:57:06.213000",
          "created": "2025-07-13T22:57:06.213000",
          "tags": [
            "march",
            "camaro dragon",
            "cve202322518",
            "confluence",
            "impacting azure",
            "proofpoint",
            "domains",
            "excel",
            "macros",
            "faile",
            "hiddentear",
            "maze",
            "united",
            "heur",
            "html",
            "malware",
            "malicious site",
            "phishing",
            "mail spammer",
            "phishing site",
            "anonymizer",
            "phishingb64",
            "exploit",
            "generic",
            "phish",
            "win64",
            "bashlite",
            "ransomware",
            "miner",
            "blacklist http",
            "generic malware",
            "tag count",
            "malware generic",
            "wed jun",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "first",
            "maltiverse qrat",
            "office open",
            "xml spreadsheet",
            "xlsx microsoft",
            "excel microsoft",
            "xml format",
            "open packaging",
            "urls",
            "com laude",
            "csc corporate",
            "cloudflare",
            "gmbh",
            "contacted",
            "markmonitor",
            "markmonitor inc",
            "ip detections",
            "country",
            "cache entry",
            "gzip chrome",
            "text chrome",
            "files",
            "file type",
            "windows",
            "web open",
            "font format",
            "kb xml",
            "contenttypes",
            "b xml",
            "cve20200601",
            "cve20160189",
            "referrer",
            "copy",
            "switch dns",
            "query",
            "amazonaws",
            "typosquatting",
            "registrar",
            "speakez securus",
            "metro",
            "asnone united",
            "n hayden",
            "rd suite",
            "purpose p1",
            "country united",
            "code us",
            "name domain",
            "nexus category",
            "phone number",
            "date",
            "cf2a",
            "xaax04x00",
            "high",
            "createsuspended",
            "yara detections",
            "trojan",
            "ip address",
            "malware traffic",
            "nids",
            "dorkbot",
            "april",
            "win32",
            "unknown",
            "a poster",
            "forbidden small",
            "aaaa",
            "a h2",
            "as24940 hetzner",
            "search",
            "a nxdomain",
            "accept",
            "meta",
            "install",
            "config",
            "next",
            "calls-wmi",
            "number",
            "ja3s",
            "subject",
            "secure server",
            "memory pattern",
            "azure tls",
            "issuing ca",
            "cus subject",
            "cnamazon rsa",
            "m03 oamazon",
            "hashes",
            "woff chrome",
            "text",
            "xml ebury",
            "cab chrome",
            "gzip",
            "user",
            "data",
            "datacrashpad",
            "k dcomlaunch",
            "embedding",
            "shell",
            "programfiles",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "tree",
            "null",
            "mutexes",
            "modules",
            "runtime modules",
            "algorithm",
            "suspicious_process",
            "allocates_rwx",
            "network_http",
            "nids_alert",
            "dumped_buffer",
            "injection_resumethread",
            "injection_ntsetcontextthread",
            "modifies_proxy_wpad",
            "dead_host",
            "nids_malware_alert",
            "injection_runpe",
            "dumped_buffer2",
            "network_irc",
            "injection_write_memory_exe",
            "nolookup_communication",
            "injection_modifies_memory",
            "injection_write_memory",
            "allocates_execute_remote_process",
            "persistence_autorun",
            "injection_createremotethread",
            "apple",
            "amazon",
            "as29791",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "ip lookup",
            "service ip",
            "address",
            "france unknown",
            "as16276",
            "germany unknown",
            "as12876 online",
            "creation date",
            "entries",
            "japan unknown",
            "body",
            "domain",
            "files ip",
            "location united",
            "asn as15169",
            "as15169 google",
            "as14061",
            "status",
            "united kingdom",
            "name servers",
            "microsoft",
            "att"
          ],
          "references": [
            "Ebury Botnet-19-5-2024.xlsx: FileHash-SHA256 9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e",
            "https://www.al-dawaa.com/arabic/xefo-injection-8-mg-powder-1-v.html",
            "api.wipmania.com - Verdict :External IP Lookup Service IP Address: 127.0.0.1",
            "Ransomware: ransomed.vc, http://www.ransomed.vc, https://www.ransomed.vc",
            "Apple: emails.redvue.com, apple-dns.net, nr-data.net",
            "IDS Detections: External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)",
            "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin | Dorkbot GeoIP Lookup to wipmania | Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin",
            "DNS Resolutions: When executing the file being studied, it performed the following domain name resolutions. accounts.google.com 172.253.125.84",
            "DNS Resolutions: otx.alienvault.com 108.138.167.23 108.138.167.17 108.138.167.55 108.138.167.82",
            "Highlighted actions: Calls Highlighted RtlWow64GetCurrentMachine RtlWow64IsWowGuestMachineSupported",
            "Crowdsourced IDS: rules Matches rule (http_inspect) HTTP Content-Length message body was truncated",
            "Malware Behavior: Command and Control OB0004 C2 Communication B0030",
            "Malware Behavior: Communication OC0006 HTTP Communication C0002 WinINet C0005 InternetConnect C0005.001",
            "https://members.a-poster.info/- Members anonymously bully, post porn, someone's name with malicious titles.",
            "Ebury Botnet: UnknownStealerRecovered.exe, 20240224105334.pm, rdpwrap.dll ,emails.redvue.com, alt8.gstatic.com. asaawww.gstatic.com",
            "Ebury Botnet: alt14.gstatic.com,\talt5.gstatic.com, ccd-testing-v4.gstatic.com, checkin.gstatic.com, chromeos-ca.gstatic.com, drive.gstatic.com\tcofr.jquery.com",
            "Ebury Botnet: eee.gstatic.com, encrypted-tbn0x.gstatic.com, apex.jquery.com,araclar.jquery.com, assets.jquery.com,assetsp.jquery.com",
            "Ebury Botnet: content.jquery.com,  Amvima.com, attachments.jquery.com\t, brand.jquery.com, brandon.jquery.com, calendar.jquery.com",
            "Ebury Botnet: cdn.jquery.com, code1.jquery.com, code123.jquery.com, code2.jquery.com, codeorigin2.jquery.com, codes.jquery.com",
            "Ebury Botnet: www.gstatic.com, cdn-cybersecurity.att.com, cdn.amplitude.com,  cdn.bizible.com,  www.google-analytics.com, www.google.it\t\t encrypted-tbn3.gstatic.com, jquery.com\t\t www.code.jquery.com,\tapi.jquery.com\t,blog.jquery.com, bugs.jquery.com\t,codeorigin.jquery.com\t\t  Malware site - Hybrid-Analysis apple-dns.net, www.metrobyt-mobile.com\t\t www.trellian.com, d2tobj9dlmyzd8.cloudfront.net\t\t alt001.www.gstatic.com\t\terror.www.gstatic.com, a.www.gstatic.com\t\t\t sddoodlepups.com\t\t ransomed.vc\tnot found\t\t Data",
            "Ebury Botnet: CVE-2020-0601, CVE-2018-8174, CVE-2017-8570, CVE-2016-0189,  CVE-2023-22518, CVE-2023-4966",
            "Ebury Botnet: https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "Ebury Botnet: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "trojan.boilod.sm, trojan.script.ls, http://trojan.script.ls/, a-poster.info",
            "https://otx.alienvault.com/indicator/file/f0b09b88d6a4f7ffa7ea912e255537dead276e813d64171a1d8b1e99982ddbd2",
            "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/summary",
            "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/behavior",
            "I really have no idea what's going on or how safe this platform is."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/DorkBot.DU",
              "display_name": "Trojan:Win32/DorkBot.DU",
              "target": "/malware/Trojan:Win32/DorkBot.DU"
            },
            {
              "id": "Win32:GenMalicious-KAG\\ [Trj]",
              "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1286703",
              "display_name": "Win.Trojan.Agent-1286703",
              "target": null
            },
            {
              "id": "Win32:Renos-CK",
              "display_name": "Win32:Renos-CK",
              "target": null
            },
            {
              "id": "Win32:Delf-IWG\\ [Trj]",
              "display_name": "Win32:Delf-IWG\\ [Trj]",
              "target": null
            },
            {
              "id": "Win32:Dh-A\\ [Heur]",
              "display_name": "Win32:Dh-A\\ [Heur]",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Downloader.32972-1",
              "display_name": "Win.Downloader.32972-1",
              "target": null
            },
            {
              "id": "Trojan:Win32/Delflob.A.dll",
              "display_name": "Trojan:Win32/Delflob.A.dll",
              "target": "/malware/Trojan:Win32/Delflob.A.dll"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "666eeab2d7cd73b992756b36",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 7,
            "FileHash-MD5": 636,
            "FileHash-SHA1": 391,
            "FileHash-SHA256": 1387,
            "domain": 1018,
            "hostname": 574,
            "URL": 1026,
            "email": 7
          },
          "indicator_count": 5046,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "280 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "666eeab2d7cd73b992756b36",
          "name": "OTX.AlienVault.com/LevelBlue in Ebury Botnet-19-5-2024.xlsx",
          "description": "Ebury Botnet-19-5-2024.xlsx. is affected by and impacting OTX.AlienVault.com-LevelBlue/Labs users. Based on limited information found online, Ebury is an OpenSSH backdoor and credential stealer. It is used to deploy additional malware. Based on online reports; in mid -May 2024 in was found that Ebury targeted/infected ISP's and up to 400,000  Linux, FreeBSD, and OpenBSD servers. Gains remote access, steals cryptocurrency wallets, credentials, and credit card details and much more I don't know about.",
          "modified": "2024-07-16T11:02:32.735000",
          "created": "2024-06-16T13:37:54.283000",
          "tags": [
            "march",
            "camaro dragon",
            "cve202322518",
            "confluence",
            "impacting azure",
            "proofpoint",
            "domains",
            "excel",
            "macros",
            "faile",
            "hiddentear",
            "maze",
            "united",
            "heur",
            "html",
            "malware",
            "malicious site",
            "phishing",
            "mail spammer",
            "phishing site",
            "anonymizer",
            "phishingb64",
            "exploit",
            "generic",
            "phish",
            "win64",
            "bashlite",
            "ransomware",
            "miner",
            "blacklist http",
            "generic malware",
            "tag count",
            "malware generic",
            "wed jun",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "first",
            "maltiverse qrat",
            "office open",
            "xml spreadsheet",
            "xlsx microsoft",
            "excel microsoft",
            "xml format",
            "open packaging",
            "urls",
            "com laude",
            "csc corporate",
            "cloudflare",
            "gmbh",
            "contacted",
            "markmonitor",
            "markmonitor inc",
            "ip detections",
            "country",
            "cache entry",
            "gzip chrome",
            "text chrome",
            "files",
            "file type",
            "windows",
            "web open",
            "font format",
            "kb xml",
            "contenttypes",
            "b xml",
            "cve20200601",
            "cve20160189",
            "referrer",
            "copy",
            "switch dns",
            "query",
            "amazonaws",
            "typosquatting",
            "registrar",
            "speakez securus",
            "metro",
            "asnone united",
            "n hayden",
            "rd suite",
            "purpose p1",
            "country united",
            "code us",
            "name domain",
            "nexus category",
            "phone number",
            "date",
            "cf2a",
            "xaax04x00",
            "high",
            "createsuspended",
            "yara detections",
            "trojan",
            "ip address",
            "malware traffic",
            "nids",
            "dorkbot",
            "april",
            "win32",
            "unknown",
            "a poster",
            "forbidden small",
            "aaaa",
            "a h2",
            "as24940 hetzner",
            "search",
            "a nxdomain",
            "accept",
            "meta",
            "install",
            "config",
            "next",
            "calls-wmi",
            "number",
            "ja3s",
            "subject",
            "secure server",
            "memory pattern",
            "azure tls",
            "issuing ca",
            "cus subject",
            "cnamazon rsa",
            "m03 oamazon",
            "hashes",
            "woff chrome",
            "text",
            "xml ebury",
            "cab chrome",
            "gzip",
            "user",
            "data",
            "datacrashpad",
            "k dcomlaunch",
            "embedding",
            "shell",
            "programfiles",
            "samplepath",
            "process",
            "created",
            "shell commands",
            "tree",
            "null",
            "mutexes",
            "modules",
            "runtime modules",
            "algorithm",
            "suspicious_process",
            "allocates_rwx",
            "network_http",
            "nids_alert",
            "dumped_buffer",
            "injection_resumethread",
            "injection_ntsetcontextthread",
            "modifies_proxy_wpad",
            "dead_host",
            "nids_malware_alert",
            "injection_runpe",
            "dumped_buffer2",
            "network_irc",
            "injection_write_memory_exe",
            "nolookup_communication",
            "injection_modifies_memory",
            "injection_write_memory",
            "allocates_execute_remote_process",
            "persistence_autorun",
            "injection_createremotethread",
            "apple",
            "amazon",
            "as29791",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "ip lookup",
            "service ip",
            "address",
            "france unknown",
            "as16276",
            "germany unknown",
            "as12876 online",
            "creation date",
            "entries",
            "japan unknown",
            "body",
            "domain",
            "files ip",
            "location united",
            "asn as15169",
            "as15169 google",
            "as14061",
            "status",
            "united kingdom",
            "name servers",
            "microsoft",
            "att"
          ],
          "references": [
            "Ebury Botnet-19-5-2024.xlsx: FileHash-SHA256 9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e",
            "https://www.al-dawaa.com/arabic/xefo-injection-8-mg-powder-1-v.html",
            "api.wipmania.com - Verdict :External IP Lookup Service IP Address: 127.0.0.1",
            "Ransomware: ransomed.vc, http://www.ransomed.vc, https://www.ransomed.vc",
            "Apple: emails.redvue.com, apple-dns.net, nr-data.net",
            "IDS Detections: External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)",
            "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin | Dorkbot GeoIP Lookup to wipmania | Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin",
            "DNS Resolutions: When executing the file being studied, it performed the following domain name resolutions. accounts.google.com 172.253.125.84",
            "DNS Resolutions: otx.alienvault.com 108.138.167.23 108.138.167.17 108.138.167.55 108.138.167.82",
            "Highlighted actions: Calls Highlighted RtlWow64GetCurrentMachine RtlWow64IsWowGuestMachineSupported",
            "Crowdsourced IDS: rules Matches rule (http_inspect) HTTP Content-Length message body was truncated",
            "Malware Behavior: Command and Control OB0004 C2 Communication B0030",
            "Malware Behavior: Communication OC0006 HTTP Communication C0002 WinINet C0005 InternetConnect C0005.001",
            "https://members.a-poster.info/- Members anonymously bully, post porn, someone's name with malicious titles.",
            "Ebury Botnet: UnknownStealerRecovered.exe, 20240224105334.pm, rdpwrap.dll ,emails.redvue.com, alt8.gstatic.com. asaawww.gstatic.com",
            "Ebury Botnet: alt14.gstatic.com,\talt5.gstatic.com, ccd-testing-v4.gstatic.com, checkin.gstatic.com, chromeos-ca.gstatic.com, drive.gstatic.com\tcofr.jquery.com",
            "Ebury Botnet: eee.gstatic.com, encrypted-tbn0x.gstatic.com, apex.jquery.com,araclar.jquery.com, assets.jquery.com,assetsp.jquery.com",
            "Ebury Botnet: content.jquery.com,  Amvima.com, attachments.jquery.com\t, brand.jquery.com, brandon.jquery.com, calendar.jquery.com",
            "Ebury Botnet: cdn.jquery.com, code1.jquery.com, code123.jquery.com, code2.jquery.com, codeorigin2.jquery.com, codes.jquery.com",
            "Ebury Botnet: www.gstatic.com, cdn-cybersecurity.att.com, cdn.amplitude.com,  cdn.bizible.com,  www.google-analytics.com, www.google.it\t\t encrypted-tbn3.gstatic.com, jquery.com\t\t www.code.jquery.com,\tapi.jquery.com\t,blog.jquery.com, bugs.jquery.com\t,codeorigin.jquery.com\t\t  Malware site - Hybrid-Analysis apple-dns.net, www.metrobyt-mobile.com\t\t www.trellian.com, d2tobj9dlmyzd8.cloudfront.net\t\t alt001.www.gstatic.com\t\terror.www.gstatic.com, a.www.gstatic.com\t\t\t sddoodlepups.com\t\t ransomed.vc\tnot found\t\t Data",
            "Ebury Botnet: CVE-2020-0601, CVE-2018-8174, CVE-2017-8570, CVE-2016-0189,  CVE-2023-22518, CVE-2023-4966",
            "Ebury Botnet: https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "Ebury Botnet: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "trojan.boilod.sm, trojan.script.ls, http://trojan.script.ls/, a-poster.info",
            "https://otx.alienvault.com/indicator/file/f0b09b88d6a4f7ffa7ea912e255537dead276e813d64171a1d8b1e99982ddbd2",
            "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/summary",
            "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/behavior",
            "I really have no idea what's going on or how safe this platform is."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/DorkBot.DU",
              "display_name": "Trojan:Win32/DorkBot.DU",
              "target": "/malware/Trojan:Win32/DorkBot.DU"
            },
            {
              "id": "Win32:GenMalicious-KAG\\ [Trj]",
              "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1286703",
              "display_name": "Win.Trojan.Agent-1286703",
              "target": null
            },
            {
              "id": "Win32:Renos-CK",
              "display_name": "Win32:Renos-CK",
              "target": null
            },
            {
              "id": "Win32:Delf-IWG\\ [Trj]",
              "display_name": "Win32:Delf-IWG\\ [Trj]",
              "target": null
            },
            {
              "id": "Win32:Dh-A\\ [Heur]",
              "display_name": "Win32:Dh-A\\ [Heur]",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Downloader.32972-1",
              "display_name": "Win.Downloader.32972-1",
              "target": null
            },
            {
              "id": "Trojan:Win32/Delflob.A.dll",
              "display_name": "Trojan:Win32/Delflob.A.dll",
              "target": "/malware/Trojan:Win32/Delflob.A.dll"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1495",
              "name": "Firmware Corruption",
              "display_name": "T1495 - Firmware Corruption"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 7,
            "FileHash-MD5": 636,
            "FileHash-SHA1": 391,
            "FileHash-SHA256": 1387,
            "domain": 1018,
            "hostname": 574,
            "URL": 1026,
            "email": 7
          },
          "indicator_count": 5046,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "643 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "Ebury Botnet: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/behavior",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "Ebury Botnet-19-5-2024.xlsx: FileHash-SHA256 9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e",
        "https://www.al-dawaa.com/arabic/xefo-injection-8-mg-powder-1-v.html",
        "DNS Resolutions: When executing the file being studied, it performed the following domain name resolutions. accounts.google.com 172.253.125.84",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "I really have no idea what's going on or how safe this platform is.",
        "Ebury Botnet: eee.gstatic.com, encrypted-tbn0x.gstatic.com, apex.jquery.com,araclar.jquery.com, assets.jquery.com,assetsp.jquery.com",
        "Ebury Botnet: content.jquery.com,  Amvima.com, attachments.jquery.com\t, brand.jquery.com, brandon.jquery.com, calendar.jquery.com",
        "Apple: emails.redvue.com, apple-dns.net, nr-data.net",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "DNS Resolutions: otx.alienvault.com 108.138.167.23 108.138.167.17 108.138.167.55 108.138.167.82",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "Malware Behavior: Communication OC0006 HTTP Communication C0002 WinINet C0005 InternetConnect C0005.001",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Crowdsourced IDS: rules Matches rule (http_inspect) HTTP Content-Length message body was truncated",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "Ransomware: ransomed.vc, http://www.ransomed.vc, https://www.ransomed.vc",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/summary",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin | Dorkbot GeoIP Lookup to wipmania | Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin",
        "Starfield again - HoneyPot / Dod- DoW",
        "http://129.2.4.2/32 Lencr",
        "https://members.a-poster.info/- Members anonymously bully, post porn, someone's name with malicious titles.",
        "Ebury Botnet: UnknownStealerRecovered.exe, 20240224105334.pm, rdpwrap.dll ,emails.redvue.com, alt8.gstatic.com. asaawww.gstatic.com",
        "IDS Detections: External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)",
        "Ebury Botnet: https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "trojan.boilod.sm, trojan.script.ls, http://trojan.script.ls/, a-poster.info",
        "Ebury Botnet: alt14.gstatic.com,\talt5.gstatic.com, ccd-testing-v4.gstatic.com, checkin.gstatic.com, chromeos-ca.gstatic.com, drive.gstatic.com\tcofr.jquery.com",
        "api.wipmania.com - Verdict :External IP Lookup Service IP Address: 127.0.0.1",
        "ExternalHosts: US",
        "https://otx.alienvault.com/indicator/file/f0b09b88d6a4f7ffa7ea912e255537dead276e813d64171a1d8b1e99982ddbd2",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "Highlighted actions: Calls Highlighted RtlWow64GetCurrentMachine RtlWow64IsWowGuestMachineSupported",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "Malware Behavior: Command and Control OB0004 C2 Communication B0030",
        "Ebury Botnet: www.gstatic.com, cdn-cybersecurity.att.com, cdn.amplitude.com,  cdn.bizible.com,  www.google-analytics.com, www.google.it\t\t encrypted-tbn3.gstatic.com, jquery.com\t\t www.code.jquery.com,\tapi.jquery.com\t,blog.jquery.com, bugs.jquery.com\t,codeorigin.jquery.com\t\t  Malware site - Hybrid-Analysis apple-dns.net, www.metrobyt-mobile.com\t\t www.trellian.com, d2tobj9dlmyzd8.cloudfront.net\t\t alt001.www.gstatic.com\t\terror.www.gstatic.com, a.www.gstatic.com\t\t\t sddoodlepups.com\t\t ransomed.vc\tnot found\t\t Data",
        "Ebury Botnet: cdn.jquery.com, code1.jquery.com, code123.jquery.com, code2.jquery.com, codeorigin2.jquery.com, codes.jquery.com",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "Ebury Botnet: CVE-2020-0601, CVE-2018-8174, CVE-2017-8570, CVE-2016-0189,  CVE-2023-22518, CVE-2023-4966"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO"
          ],
          "malware_families": [
            "#lowfi:sigattr:downloadandexecute",
            "Backdoor:win32/tofsee.",
            "Autoit",
            "Win.packer",
            "Trojan:win32/dorkbot.du",
            "Win32:malware-gen",
            "Win32:dh-a\\ [heur]",
            "Win32:delf-iwg\\ [trj]",
            "Trojan:win32/delflob.a.dll",
            "Win.downloader.32972-1",
            "Win.trojan.agent-1286703",
            "Win32:genmalicious-kag\\ [trj]",
            "Win32:renos-ck",
            "Ransom:win32/crowti",
            "Win.dropper.vbclone",
            "Upatre"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68fbc84609098d17c316f23c",
      "name": "NSO - Multiple crimes",
      "description": "Multiple crimes including illegal gambling, loan sharking, cybercrimes , content reputation , instructions. Starfield seen again. Team 8 has seen Starfield in more than 300 pulses. Now it\u2019s gone. Check your devices for innocent looking searches you\u2019ve never searched. Browser extensions found on 3 targeted devices with an adversary with full CnC armed with a deletion and disk wipe service. Local - Denver. \n\nAlso, very concerning is specific Airline to be attacked revealed. It cant be researched without bringing down a flight or messing up air command & control. DJT has already made travel a risky feat by being influenced to fire the (NOAA) & (DOT). Its manipulation. PP Mafia bros. \n\nDoes anyone have any power? Contact someone. We did have a mystery plane incident in Denver after I first reported. Just space junk , ya know the usual. I am serious about preventing crime. I need some help!",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-24T18:41:10.936000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "148 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68fc18514965ccd3b55c216d",
      "name": "Dorv \u2022 Obfuscator - Affecting DropBox",
      "description": "",
      "modified": "2025-11-23T17:00:58.297000",
      "created": "2025-10-25T00:22:41.686000",
      "tags": [
        "type indicator",
        "added active",
        "related pulses",
        "script urls",
        "united",
        "unknown ns",
        "a domains",
        "ip address",
        "meta",
        "asn as13335",
        "msie",
        "chrome",
        "ransom",
        "trojan",
        "passive dns",
        "backdoor",
        "http request",
        "twitter",
        "win32/crix.c check-in",
        "gmt content",
        "ipv4",
        "urls",
        "files",
        "data upload",
        "extraction",
        "domain add",
        "e emeseieee",
        "dynamicloader",
        "e eue",
        "eweienedeoewese",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "edeeefeaeuelete",
        "unknown",
        "write",
        "bits",
        "malware",
        "xserver",
        "encrypt",
        "unknown aaaa",
        "moved",
        "cloudfront x",
        "hio52 p1",
        "name servers",
        "accept encoding",
        "emails",
        "servers",
        "extr",
        "u a640",
        "a69f u",
        "fe2e fe2f",
        "u a720",
        "a7ff",
        "u feff",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "pattern match",
        "mitre att",
        "null",
        "body",
        "pizza",
        "friday",
        "hybrid",
        "general",
        "local",
        "path",
        "starfield",
        "iframe",
        "click",
        "strings",
        "core",
        "bet",
        "gambling",
        "record value",
        "date",
        "present sep",
        "present apr",
        "colombia",
        "present jun",
        "present nov",
        "cookie",
        "present oct",
        "entries",
        "next associated",
        "error",
        "attack",
        "government",
        "scotland",
        "news",
        "covid19",
        "subscribe",
        "october",
        "crown copyright",
        "nhs scotland",
        "parliament",
        "coronavirus",
        "redacted for",
        "domain status",
        "server",
        "privacy tech",
        "privacy admin",
        "email",
        "country",
        "postal code",
        "stateprovince",
        "code",
        "host name",
        "rdap database",
        "handle",
        "iana registrar",
        "entity roles",
        "links",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "medium",
        "write c",
        "search",
        "pe file",
        "high",
        "checks",
        "http",
        "delete",
        "copy",
        "guard",
        "mozilla",
        "next",
        "godaddy",
        "creation date",
        "hostname",
        "pulse submit",
        "url analysis",
        "domain",
        "files ip",
        "trojandropper",
        "mtb oct",
        "mtb may",
        "refloadapihash",
        "foundry",
        "fastly",
        "value a",
        "com laude",
        "ltd dba",
        "nomiq",
        "limited dba",
        "pulse",
        "location united",
        "asn asnone",
        "nameservers"
      ],
      "references": [
        "giovannisnypizza.net \u2022  http://www.giovannisnypizza.net \u2022",
        "fazendabetb.live \u2022 bowiesports.com Check first???",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino",
        "www.cricx1bet99.com \u2022 cricx1bet99.com \u2022 bulgariabet.bg \u2022",
        "05bet99.bet \u2022  app.05bet99.bet \u2022  betterlifeschool.kr  \u2022  bbrbet.today",
        "coinbasecnext.com \u2022 e-coinpayments.com \u2022 e-coinpayments.com",
        "cashloanboat.com \u2022 mx-loans-5o.today\u2022  nodoccommercialloan",
        "cashloanboat.com \u2022 https://dym168.org/cashoutwithclonedcards",
        "http://kittelsoncarpo.com/business-registration/online-gaming-betting-casino/",
        "m.casinometropol225.com \u2022 casinometropol285.com  \u2022 http://bonus.casinometropol285.com \u2022",
        "https://bonus.casinometropol285.com \u2022  www.aksescasinobet77.icu bonus.casinometropol285.com \u2022",
        "Interesting: app.master.legalaid-vic-gov-au.sdp4.sdp.vic.gov.au",
        "Bogota: anla.gov.co | ( gov.scot? Government/Legal (alphaMountain.ai))",
        "The Scottish Government www.gov.scot The NHS Scotland support",
        "http://129.2.4.2/32 Lencr",
        "qlw020.managed-sprint.dynalabs.io (Check)",
        "brave-ohttp-relay-dev.fastly-edge.com (Palantir)",
        "ims.foundryfabrication.co.uk \u2022  timelog.foundryfabrication.co.uk \u2022  ims.foundryfabrication.co",
        "151.101.195.19 In CDN range: provider=fastly \u2022 https://docs.fastly.com/en/guides/common \u2022 fastly.com",
        "vb.cu \u2022  vb \u2022 vb.il  \u2022 vb.cu \u2022  vb.il \u2022 docs.fastly.com  \u2022 docs.fastly.com",
        "ExternalHosts: US",
        "Starfield again - HoneyPot / Dod- DoW",
        "\u2018Starfield\u2019 Seen in a \u2018DoD\u2019 related wheelchair malfunction",
        "Red Team Abuse? Starfield ? DoD related (Palantir) https://] bethesda[.]net - Spyware",
        "https://otx.alienvault.com/pulse/68e2db3a16fcfd7d323f105b"
      ],
      "public": 1,
      "adversary": "NSO",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Bulgaria",
        "Singapore",
        "Denmark",
        "Australia",
        "Jersey",
        "Japan",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Autoit",
          "display_name": "Autoit",
          "target": null
        },
        {
          "id": "Ransom:Win32/Crowti",
          "display_name": "Ransom:Win32/Crowti",
          "target": "/malware/Ransom:Win32/Crowti"
        },
        {
          "id": "Backdoor:Win32/Tofsee.",
          "display_name": "Backdoor:Win32/Tofsee.",
          "target": "/malware/Backdoor:Win32/Tofsee."
        },
        {
          "id": "#Lowfi:SIGATTR:DownloadAndExecute",
          "display_name": "#Lowfi:SIGATTR:DownloadAndExecute",
          "target": null
        },
        {
          "id": "Win.Dropper.Vbclone",
          "display_name": "Win.Dropper.Vbclone",
          "target": null
        },
        {
          "id": "Win.Packer",
          "display_name": "Win.Packer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68fbc84609098d17c316f23c",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6261,
        "domain": 1806,
        "hostname": 2427,
        "FileHash-MD5": 384,
        "FileHash-SHA1": 381,
        "email": 13,
        "FileHash-SHA256": 1418,
        "SSLCertFingerprint": 14
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "148 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6877cca17fd9f682f402f0cd",
      "name": "Spyware-Published \u2022 Streamed Targets |. viostream.com",
      "description": "Spyware-Published \u2022 Streamed Targets |. viostream.com\nMercenary attacks on targets and associated stressed through a dark medium.\n\nOTX refreshed page so many times in bit sure if what I collected is in pulse.\n\nBlack screen. Refreshed x 5.",
      "modified": "2025-08-15T00:03:09.871000",
      "created": "2025-07-16T16:00:33.962000",
      "tags": [
        "united",
        "date",
        "passive dns",
        "urls",
        "creation date",
        "search",
        "showing",
        "title error",
        "hostname add",
        "pulse pulses",
        "body",
        "entries",
        "present jul",
        "present feb",
        "moved",
        "ip address",
        "record value",
        "encrypt",
        "pul data",
        "extraction",
        "pdf report",
        "pcap",
        "stix",
        "openloc",
        "enter",
        "data upload",
        "failed",
        "enter sc",
        "type",
        "extra",
        "include review",
        "exclude sugges",
        "enter s",
        "extra data",
        "included iocs",
        "se extra",
        "include",
        "review exclude",
        "suggested ous",
        "stop show",
        "typ hos",
        "damnin data",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "present showing",
        "extre",
        "sc data",
        "extr data",
        "includeracs",
        "review",
        "sugges data"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1462,
        "FileHash-SHA256": 540,
        "domain": 1201,
        "URL": 4095,
        "FileHash-MD5": 1,
        "email": 1,
        "FileHash-SHA1": 1
      },
      "indicator_count": 7301,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "687439c2109c2b61e7afc717",
      "name": "OTX.AlienVault (2024) in Ebury Botnet-19/5/2024",
      "description": "",
      "modified": "2025-07-13T22:57:06.213000",
      "created": "2025-07-13T22:57:06.213000",
      "tags": [
        "march",
        "camaro dragon",
        "cve202322518",
        "confluence",
        "impacting azure",
        "proofpoint",
        "domains",
        "excel",
        "macros",
        "faile",
        "hiddentear",
        "maze",
        "united",
        "heur",
        "html",
        "malware",
        "malicious site",
        "phishing",
        "mail spammer",
        "phishing site",
        "anonymizer",
        "phishingb64",
        "exploit",
        "generic",
        "phish",
        "win64",
        "bashlite",
        "ransomware",
        "miner",
        "blacklist http",
        "generic malware",
        "tag count",
        "malware generic",
        "wed jun",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "first",
        "maltiverse qrat",
        "office open",
        "xml spreadsheet",
        "xlsx microsoft",
        "excel microsoft",
        "xml format",
        "open packaging",
        "urls",
        "com laude",
        "csc corporate",
        "cloudflare",
        "gmbh",
        "contacted",
        "markmonitor",
        "markmonitor inc",
        "ip detections",
        "country",
        "cache entry",
        "gzip chrome",
        "text chrome",
        "files",
        "file type",
        "windows",
        "web open",
        "font format",
        "kb xml",
        "contenttypes",
        "b xml",
        "cve20200601",
        "cve20160189",
        "referrer",
        "copy",
        "switch dns",
        "query",
        "amazonaws",
        "typosquatting",
        "registrar",
        "speakez securus",
        "metro",
        "asnone united",
        "n hayden",
        "rd suite",
        "purpose p1",
        "country united",
        "code us",
        "name domain",
        "nexus category",
        "phone number",
        "date",
        "cf2a",
        "xaax04x00",
        "high",
        "createsuspended",
        "yara detections",
        "trojan",
        "ip address",
        "malware traffic",
        "nids",
        "dorkbot",
        "april",
        "win32",
        "unknown",
        "a poster",
        "forbidden small",
        "aaaa",
        "a h2",
        "as24940 hetzner",
        "search",
        "a nxdomain",
        "accept",
        "meta",
        "install",
        "config",
        "next",
        "calls-wmi",
        "number",
        "ja3s",
        "subject",
        "secure server",
        "memory pattern",
        "azure tls",
        "issuing ca",
        "cus subject",
        "cnamazon rsa",
        "m03 oamazon",
        "hashes",
        "woff chrome",
        "text",
        "xml ebury",
        "cab chrome",
        "gzip",
        "user",
        "data",
        "datacrashpad",
        "k dcomlaunch",
        "embedding",
        "shell",
        "programfiles",
        "samplepath",
        "process",
        "created",
        "shell commands",
        "tree",
        "null",
        "mutexes",
        "modules",
        "runtime modules",
        "algorithm",
        "suspicious_process",
        "allocates_rwx",
        "network_http",
        "nids_alert",
        "dumped_buffer",
        "injection_resumethread",
        "injection_ntsetcontextthread",
        "modifies_proxy_wpad",
        "dead_host",
        "nids_malware_alert",
        "injection_runpe",
        "dumped_buffer2",
        "network_irc",
        "injection_write_memory_exe",
        "nolookup_communication",
        "injection_modifies_memory",
        "injection_write_memory",
        "allocates_execute_remote_process",
        "persistence_autorun",
        "injection_createremotethread",
        "apple",
        "amazon",
        "as29791",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "ip lookup",
        "service ip",
        "address",
        "france unknown",
        "as16276",
        "germany unknown",
        "as12876 online",
        "creation date",
        "entries",
        "japan unknown",
        "body",
        "domain",
        "files ip",
        "location united",
        "asn as15169",
        "as15169 google",
        "as14061",
        "status",
        "united kingdom",
        "name servers",
        "microsoft",
        "att"
      ],
      "references": [
        "Ebury Botnet-19-5-2024.xlsx: FileHash-SHA256 9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e",
        "https://www.al-dawaa.com/arabic/xefo-injection-8-mg-powder-1-v.html",
        "api.wipmania.com - Verdict :External IP Lookup Service IP Address: 127.0.0.1",
        "Ransomware: ransomed.vc, http://www.ransomed.vc, https://www.ransomed.vc",
        "Apple: emails.redvue.com, apple-dns.net, nr-data.net",
        "IDS Detections: External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin | Dorkbot GeoIP Lookup to wipmania | Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin",
        "DNS Resolutions: When executing the file being studied, it performed the following domain name resolutions. accounts.google.com 172.253.125.84",
        "DNS Resolutions: otx.alienvault.com 108.138.167.23 108.138.167.17 108.138.167.55 108.138.167.82",
        "Highlighted actions: Calls Highlighted RtlWow64GetCurrentMachine RtlWow64IsWowGuestMachineSupported",
        "Crowdsourced IDS: rules Matches rule (http_inspect) HTTP Content-Length message body was truncated",
        "Malware Behavior: Command and Control OB0004 C2 Communication B0030",
        "Malware Behavior: Communication OC0006 HTTP Communication C0002 WinINet C0005 InternetConnect C0005.001",
        "https://members.a-poster.info/- Members anonymously bully, post porn, someone's name with malicious titles.",
        "Ebury Botnet: UnknownStealerRecovered.exe, 20240224105334.pm, rdpwrap.dll ,emails.redvue.com, alt8.gstatic.com. asaawww.gstatic.com",
        "Ebury Botnet: alt14.gstatic.com,\talt5.gstatic.com, ccd-testing-v4.gstatic.com, checkin.gstatic.com, chromeos-ca.gstatic.com, drive.gstatic.com\tcofr.jquery.com",
        "Ebury Botnet: eee.gstatic.com, encrypted-tbn0x.gstatic.com, apex.jquery.com,araclar.jquery.com, assets.jquery.com,assetsp.jquery.com",
        "Ebury Botnet: content.jquery.com,  Amvima.com, attachments.jquery.com\t, brand.jquery.com, brandon.jquery.com, calendar.jquery.com",
        "Ebury Botnet: cdn.jquery.com, code1.jquery.com, code123.jquery.com, code2.jquery.com, codeorigin2.jquery.com, codes.jquery.com",
        "Ebury Botnet: www.gstatic.com, cdn-cybersecurity.att.com, cdn.amplitude.com,  cdn.bizible.com,  www.google-analytics.com, www.google.it\t\t encrypted-tbn3.gstatic.com, jquery.com\t\t www.code.jquery.com,\tapi.jquery.com\t,blog.jquery.com, bugs.jquery.com\t,codeorigin.jquery.com\t\t  Malware site - Hybrid-Analysis apple-dns.net, www.metrobyt-mobile.com\t\t www.trellian.com, d2tobj9dlmyzd8.cloudfront.net\t\t alt001.www.gstatic.com\t\terror.www.gstatic.com, a.www.gstatic.com\t\t\t sddoodlepups.com\t\t ransomed.vc\tnot found\t\t Data",
        "Ebury Botnet: CVE-2020-0601, CVE-2018-8174, CVE-2017-8570, CVE-2016-0189,  CVE-2023-22518, CVE-2023-4966",
        "Ebury Botnet: https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Ebury Botnet: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "trojan.boilod.sm, trojan.script.ls, http://trojan.script.ls/, a-poster.info",
        "https://otx.alienvault.com/indicator/file/f0b09b88d6a4f7ffa7ea912e255537dead276e813d64171a1d8b1e99982ddbd2",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/summary",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/behavior",
        "I really have no idea what's going on or how safe this platform is."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/DorkBot.DU",
          "display_name": "Trojan:Win32/DorkBot.DU",
          "target": "/malware/Trojan:Win32/DorkBot.DU"
        },
        {
          "id": "Win32:GenMalicious-KAG\\ [Trj]",
          "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1286703",
          "display_name": "Win.Trojan.Agent-1286703",
          "target": null
        },
        {
          "id": "Win32:Renos-CK",
          "display_name": "Win32:Renos-CK",
          "target": null
        },
        {
          "id": "Win32:Delf-IWG\\ [Trj]",
          "display_name": "Win32:Delf-IWG\\ [Trj]",
          "target": null
        },
        {
          "id": "Win32:Dh-A\\ [Heur]",
          "display_name": "Win32:Dh-A\\ [Heur]",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Downloader.32972-1",
          "display_name": "Win.Downloader.32972-1",
          "target": null
        },
        {
          "id": "Trojan:Win32/Delflob.A.dll",
          "display_name": "Trojan:Win32/Delflob.A.dll",
          "target": "/malware/Trojan:Win32/Delflob.A.dll"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "666eeab2d7cd73b992756b36",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 7,
        "FileHash-MD5": 636,
        "FileHash-SHA1": 391,
        "FileHash-SHA256": 1387,
        "domain": 1018,
        "hostname": 574,
        "URL": 1026,
        "email": 7
      },
      "indicator_count": 5046,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "280 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "666eeab2d7cd73b992756b36",
      "name": "OTX.AlienVault.com/LevelBlue in Ebury Botnet-19-5-2024.xlsx",
      "description": "Ebury Botnet-19-5-2024.xlsx. is affected by and impacting OTX.AlienVault.com-LevelBlue/Labs users. Based on limited information found online, Ebury is an OpenSSH backdoor and credential stealer. It is used to deploy additional malware. Based on online reports; in mid -May 2024 in was found that Ebury targeted/infected ISP's and up to 400,000  Linux, FreeBSD, and OpenBSD servers. Gains remote access, steals cryptocurrency wallets, credentials, and credit card details and much more I don't know about.",
      "modified": "2024-07-16T11:02:32.735000",
      "created": "2024-06-16T13:37:54.283000",
      "tags": [
        "march",
        "camaro dragon",
        "cve202322518",
        "confluence",
        "impacting azure",
        "proofpoint",
        "domains",
        "excel",
        "macros",
        "faile",
        "hiddentear",
        "maze",
        "united",
        "heur",
        "html",
        "malware",
        "malicious site",
        "phishing",
        "mail spammer",
        "phishing site",
        "anonymizer",
        "phishingb64",
        "exploit",
        "generic",
        "phish",
        "win64",
        "bashlite",
        "ransomware",
        "miner",
        "blacklist http",
        "generic malware",
        "tag count",
        "malware generic",
        "wed jun",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "first",
        "maltiverse qrat",
        "office open",
        "xml spreadsheet",
        "xlsx microsoft",
        "excel microsoft",
        "xml format",
        "open packaging",
        "urls",
        "com laude",
        "csc corporate",
        "cloudflare",
        "gmbh",
        "contacted",
        "markmonitor",
        "markmonitor inc",
        "ip detections",
        "country",
        "cache entry",
        "gzip chrome",
        "text chrome",
        "files",
        "file type",
        "windows",
        "web open",
        "font format",
        "kb xml",
        "contenttypes",
        "b xml",
        "cve20200601",
        "cve20160189",
        "referrer",
        "copy",
        "switch dns",
        "query",
        "amazonaws",
        "typosquatting",
        "registrar",
        "speakez securus",
        "metro",
        "asnone united",
        "n hayden",
        "rd suite",
        "purpose p1",
        "country united",
        "code us",
        "name domain",
        "nexus category",
        "phone number",
        "date",
        "cf2a",
        "xaax04x00",
        "high",
        "createsuspended",
        "yara detections",
        "trojan",
        "ip address",
        "malware traffic",
        "nids",
        "dorkbot",
        "april",
        "win32",
        "unknown",
        "a poster",
        "forbidden small",
        "aaaa",
        "a h2",
        "as24940 hetzner",
        "search",
        "a nxdomain",
        "accept",
        "meta",
        "install",
        "config",
        "next",
        "calls-wmi",
        "number",
        "ja3s",
        "subject",
        "secure server",
        "memory pattern",
        "azure tls",
        "issuing ca",
        "cus subject",
        "cnamazon rsa",
        "m03 oamazon",
        "hashes",
        "woff chrome",
        "text",
        "xml ebury",
        "cab chrome",
        "gzip",
        "user",
        "data",
        "datacrashpad",
        "k dcomlaunch",
        "embedding",
        "shell",
        "programfiles",
        "samplepath",
        "process",
        "created",
        "shell commands",
        "tree",
        "null",
        "mutexes",
        "modules",
        "runtime modules",
        "algorithm",
        "suspicious_process",
        "allocates_rwx",
        "network_http",
        "nids_alert",
        "dumped_buffer",
        "injection_resumethread",
        "injection_ntsetcontextthread",
        "modifies_proxy_wpad",
        "dead_host",
        "nids_malware_alert",
        "injection_runpe",
        "dumped_buffer2",
        "network_irc",
        "injection_write_memory_exe",
        "nolookup_communication",
        "injection_modifies_memory",
        "injection_write_memory",
        "allocates_execute_remote_process",
        "persistence_autorun",
        "injection_createremotethread",
        "apple",
        "amazon",
        "as29791",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "ip lookup",
        "service ip",
        "address",
        "france unknown",
        "as16276",
        "germany unknown",
        "as12876 online",
        "creation date",
        "entries",
        "japan unknown",
        "body",
        "domain",
        "files ip",
        "location united",
        "asn as15169",
        "as15169 google",
        "as14061",
        "status",
        "united kingdom",
        "name servers",
        "microsoft",
        "att"
      ],
      "references": [
        "Ebury Botnet-19-5-2024.xlsx: FileHash-SHA256 9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e",
        "https://www.al-dawaa.com/arabic/xefo-injection-8-mg-powder-1-v.html",
        "api.wipmania.com - Verdict :External IP Lookup Service IP Address: 127.0.0.1",
        "Ransomware: ransomed.vc, http://www.ransomed.vc, https://www.ransomed.vc",
        "Apple: emails.redvue.com, apple-dns.net, nr-data.net",
        "IDS Detections: External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin | Dorkbot GeoIP Lookup to wipmania | Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin",
        "DNS Resolutions: When executing the file being studied, it performed the following domain name resolutions. accounts.google.com 172.253.125.84",
        "DNS Resolutions: otx.alienvault.com 108.138.167.23 108.138.167.17 108.138.167.55 108.138.167.82",
        "Highlighted actions: Calls Highlighted RtlWow64GetCurrentMachine RtlWow64IsWowGuestMachineSupported",
        "Crowdsourced IDS: rules Matches rule (http_inspect) HTTP Content-Length message body was truncated",
        "Malware Behavior: Command and Control OB0004 C2 Communication B0030",
        "Malware Behavior: Communication OC0006 HTTP Communication C0002 WinINet C0005 InternetConnect C0005.001",
        "https://members.a-poster.info/- Members anonymously bully, post porn, someone's name with malicious titles.",
        "Ebury Botnet: UnknownStealerRecovered.exe, 20240224105334.pm, rdpwrap.dll ,emails.redvue.com, alt8.gstatic.com. asaawww.gstatic.com",
        "Ebury Botnet: alt14.gstatic.com,\talt5.gstatic.com, ccd-testing-v4.gstatic.com, checkin.gstatic.com, chromeos-ca.gstatic.com, drive.gstatic.com\tcofr.jquery.com",
        "Ebury Botnet: eee.gstatic.com, encrypted-tbn0x.gstatic.com, apex.jquery.com,araclar.jquery.com, assets.jquery.com,assetsp.jquery.com",
        "Ebury Botnet: content.jquery.com,  Amvima.com, attachments.jquery.com\t, brand.jquery.com, brandon.jquery.com, calendar.jquery.com",
        "Ebury Botnet: cdn.jquery.com, code1.jquery.com, code123.jquery.com, code2.jquery.com, codeorigin2.jquery.com, codes.jquery.com",
        "Ebury Botnet: www.gstatic.com, cdn-cybersecurity.att.com, cdn.amplitude.com,  cdn.bizible.com,  www.google-analytics.com, www.google.it\t\t encrypted-tbn3.gstatic.com, jquery.com\t\t www.code.jquery.com,\tapi.jquery.com\t,blog.jquery.com, bugs.jquery.com\t,codeorigin.jquery.com\t\t  Malware site - Hybrid-Analysis apple-dns.net, www.metrobyt-mobile.com\t\t www.trellian.com, d2tobj9dlmyzd8.cloudfront.net\t\t alt001.www.gstatic.com\t\terror.www.gstatic.com, a.www.gstatic.com\t\t\t sddoodlepups.com\t\t ransomed.vc\tnot found\t\t Data",
        "Ebury Botnet: CVE-2020-0601, CVE-2018-8174, CVE-2017-8570, CVE-2016-0189,  CVE-2023-22518, CVE-2023-4966",
        "Ebury Botnet: https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Ebury Botnet: https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "trojan.boilod.sm, trojan.script.ls, http://trojan.script.ls/, a-poster.info",
        "https://otx.alienvault.com/indicator/file/f0b09b88d6a4f7ffa7ea912e255537dead276e813d64171a1d8b1e99982ddbd2",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/summary",
        "Ebury Botnet: https://www.virustotal.com/gui/file/9a4babdab4a93b274cc547150398fd0790d820eb01d85c7dbf5cf44b8b0be73e/behavior",
        "I really have no idea what's going on or how safe this platform is."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/DorkBot.DU",
          "display_name": "Trojan:Win32/DorkBot.DU",
          "target": "/malware/Trojan:Win32/DorkBot.DU"
        },
        {
          "id": "Win32:GenMalicious-KAG\\ [Trj]",
          "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1286703",
          "display_name": "Win.Trojan.Agent-1286703",
          "target": null
        },
        {
          "id": "Win32:Renos-CK",
          "display_name": "Win32:Renos-CK",
          "target": null
        },
        {
          "id": "Win32:Delf-IWG\\ [Trj]",
          "display_name": "Win32:Delf-IWG\\ [Trj]",
          "target": null
        },
        {
          "id": "Win32:Dh-A\\ [Heur]",
          "display_name": "Win32:Dh-A\\ [Heur]",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Downloader.32972-1",
          "display_name": "Win.Downloader.32972-1",
          "target": null
        },
        {
          "id": "Trojan:Win32/Delflob.A.dll",
          "display_name": "Trojan:Win32/Delflob.A.dll",
          "target": "/malware/Trojan:Win32/Delflob.A.dll"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1495",
          "name": "Firmware Corruption",
          "display_name": "T1495 - Firmware Corruption"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 7,
        "FileHash-MD5": 636,
        "FileHash-SHA1": 391,
        "FileHash-SHA256": 1387,
        "domain": 1018,
        "hostname": 574,
        "URL": 1026,
        "email": 7
      },
      "indicator_count": 5046,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "643 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "zephyrproject.org",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "zephyrproject.org",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776718281.8445625
}