{
  "type": "Domain",
  "indicator": "zxcss.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/zxcss.com",
    "alexa": "http://www.alexa.com/siteinfo/zxcss.com",
    "indicator": "zxcss.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2298108877,
      "indicator": "zxcss.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6580d422fb57aab8e21c1f39",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password",
          "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-18T23:22:10.482000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6581d83bfd115be1f92d75a9",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
          "description": "",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-19T17:51:55.338000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6580d422fb57aab8e21c1f39",
          "export_count": 36,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6581d83e20634ac0d58ceca9",
          "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
          "description": "",
          "modified": "2024-01-17T23:03:40.729000",
          "created": "2023-12-19T17:51:58.995000",
          "tags": [
            "contacted",
            "ssl certificate",
            "group",
            "toolset",
            "attacks",
            "governments",
            "middle east",
            "dalbit",
            "march",
            "witchetty",
            "blueshell",
            "execution",
            "lockbit",
            "malware",
            "backdoor",
            "tsara brashears",
            "octoseek",
            "steganographic technique",
            "proxylogon",
            "lookback",
            "lookingfrog",
            "anonfiles",
            "publishing",
            "music",
            "torrent",
            "critical",
            "hallrender",
            "ttp",
            "uae",
            "protection",
            "macmalware",
            "linux malware",
            "apple",
            "proxyshell",
            "x4",
            "zero trust",
            "youtube",
            "safebae",
            "rallypoint",
            "poemhunter",
            "eazy client",
            "africa",
            "united states",
            "ta410",
            "second stage",
            "Capture Wi-Fi password",
            "password stealer",
            "whois whois",
            "agent tesla",
            "love",
            "mirai",
            "satacom",
            "miner",
            "dtrack",
            "nebula",
            "cobalt strike",
            "nanocore",
            "core",
            "hacktool"
          ],
          "references": [
            "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
            "discord.com",
            "api.anonfiles.com",
            "checkip.dyndns.org",
            "checkip.dyndns.com",
            "DNS Query for Anonfiles.com Domain",
            "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
            "INDICATOR SUSPICIOUS_EXE_CC_Regex",
            "DNS Query for Anonfiles.com Domain",
            "Traffic 13.107.4.52:80 (TCP)",
            "MALWARE_Win_StormKitty",
            "qbittorrent.exe",
            "EaZy Client.exe",
            "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
          ],
          "public": 1,
          "adversary": "Witchetty APT Group",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Witchetty",
              "display_name": "Witchetty",
              "target": null
            },
            {
              "id": "BlueShell",
              "display_name": "BlueShell",
              "target": null
            },
            {
              "id": "Lokbit",
              "display_name": "Lokbit",
              "target": null
            },
            {
              "id": "Mac.Malware",
              "display_name": "Mac.Malware",
              "target": null
            },
            {
              "id": "trojan.msil/stealer",
              "display_name": "trojan.msil/stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6580d422fb57aab8e21c1f39",
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1541,
            "URL": 3782,
            "domain": 1067,
            "hostname": 1297,
            "FileHash-MD5": 110,
            "FileHash-SHA1": 110,
            "CVE": 3
          },
          "indicator_count": 7910,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6510a2dd9c7acab85a26f978",
          "name": "Phishing sites 2023-09-24",
          "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
          "modified": "2023-10-24T20:02:37.137000",
          "created": "2023-09-24T20:58:05.025000",
          "tags": [
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "France"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 10,
            "URL": 5,
            "domain": 37579,
            "hostname": 3238
          },
          "indicator_count": 40832,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 190,
          "modified_text": "908 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "622dbb4dd65f7e1fa27e04f9",
          "name": "NewDom-7-20220313",
          "description": "ICANN-Dom",
          "modified": "2022-04-27T00:03:12.448000",
          "created": "2022-03-13T09:37:17.633000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ZENDataGELowC",
            "id": "152785",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 202,
          "modified_text": "1453 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        }
      ],
      "references": [
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "qbittorrent.exe",
        "discord.com",
        "MALWARE_Win_StormKitty",
        "EaZy Client.exe",
        "api.anonfiles.com",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community",
        "Traffic 13.107.4.52:80 (TCP)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Witchetty APT Group"
          ],
          "malware_families": [
            "Lokbit",
            "Mac.malware",
            "Trojan.msil/stealer",
            "Blueshell",
            "Witchetty"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6580d422fb57aab8e21c1f39",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password",
      "description": "Deeply hidden inRallypoint.com. \nWitchetty cyber espionage: Witchetty's activity was characterized by the use of two pieces of malware, a first-stage backdoor known as X4 and a second-stage payload.\n\nBlueShell is a backdoor malware developed in Go language, published on Github, and it supports Windows, Linux, and \nDalbit APT Group targets vulnerable servers to breach information including internal data from companies or encrypts files may demand money.",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-18T23:22:10.482000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6581d83bfd115be1f92d75a9",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
      "description": "",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-19T17:51:55.338000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6580d422fb57aab8e21c1f39",
      "export_count": 36,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6581d83e20634ac0d58ceca9",
      "name": "Witchetty Cyber Espionage| BlueShell | Capture Wi-Fi password  [Octoseek]",
      "description": "",
      "modified": "2024-01-17T23:03:40.729000",
      "created": "2023-12-19T17:51:58.995000",
      "tags": [
        "contacted",
        "ssl certificate",
        "group",
        "toolset",
        "attacks",
        "governments",
        "middle east",
        "dalbit",
        "march",
        "witchetty",
        "blueshell",
        "execution",
        "lockbit",
        "malware",
        "backdoor",
        "tsara brashears",
        "octoseek",
        "steganographic technique",
        "proxylogon",
        "lookback",
        "lookingfrog",
        "anonfiles",
        "publishing",
        "music",
        "torrent",
        "critical",
        "hallrender",
        "ttp",
        "uae",
        "protection",
        "macmalware",
        "linux malware",
        "apple",
        "proxyshell",
        "x4",
        "zero trust",
        "youtube",
        "safebae",
        "rallypoint",
        "poemhunter",
        "eazy client",
        "africa",
        "united states",
        "ta410",
        "second stage",
        "Capture Wi-Fi password",
        "password stealer",
        "whois whois",
        "agent tesla",
        "love",
        "mirai",
        "satacom",
        "miner",
        "dtrack",
        "nebula",
        "cobalt strike",
        "nanocore",
        "core",
        "hacktool"
      ],
      "references": [
        "EaZy Client.exe via qbittorrent.exe via AnonFiles origin RallyPoint",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.blueshell",
        "discord.com",
        "api.anonfiles.com",
        "checkip.dyndns.org",
        "checkip.dyndns.com",
        "DNS Query for Anonfiles.com Domain",
        "INDICATOR SUSPICIOUS_EXE_WirelessNetReccon",
        "INDICATOR SUSPICIOUS_EXE_CC_Regex",
        "DNS Query for Anonfiles.com Domain",
        "Traffic 13.107.4.52:80 (TCP)",
        "MALWARE_Win_StormKitty",
        "qbittorrent.exe",
        "EaZy Client.exe",
        "https://www.virustotal.com/gui/file/00047e1c8b4f336c86ed4ef148741c0d7658a0fd1107597acd4f22e5851e24ef/community"
      ],
      "public": 1,
      "adversary": "Witchetty APT Group",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Witchetty",
          "display_name": "Witchetty",
          "target": null
        },
        {
          "id": "BlueShell",
          "display_name": "BlueShell",
          "target": null
        },
        {
          "id": "Lokbit",
          "display_name": "Lokbit",
          "target": null
        },
        {
          "id": "Mac.Malware",
          "display_name": "Mac.Malware",
          "target": null
        },
        {
          "id": "trojan.msil/stealer",
          "display_name": "trojan.msil/stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6580d422fb57aab8e21c1f39",
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1541,
        "URL": 3782,
        "domain": 1067,
        "hostname": 1297,
        "FileHash-MD5": 110,
        "FileHash-SHA1": 110,
        "CVE": 3
      },
      "indicator_count": 7910,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6510a2dd9c7acab85a26f978",
      "name": "Phishing sites 2023-09-24",
      "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
      "modified": "2023-10-24T20:02:37.137000",
      "created": "2023-09-24T20:58:05.025000",
      "tags": [
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "France"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 10,
        "URL": 5,
        "domain": 37579,
        "hostname": 3238
      },
      "indicator_count": 40832,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 190,
      "modified_text": "908 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "622dbb4dd65f7e1fa27e04f9",
      "name": "NewDom-7-20220313",
      "description": "ICANN-Dom",
      "modified": "2022-04-27T00:03:12.448000",
      "created": "2022-03-13T09:37:17.633000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ZENDataGELowC",
        "id": "152785",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 202,
      "modified_text": "1453 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "zxcss.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "zxcss.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629197.4926312
}