{
  "aliases": [
    "foudre",
    "infy"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 263
  },
  "first_seen": {
    "domain": {
      "017eab31.space": "2020-10-25",
      "01ead12b.space": "2020-10-25",
      "0ca0453a.site": "2020-10-25",
      "149a673e.dynu.net": "2020-12-16",
      "149a673e.net": "2020-12-16",
      "149a673e.space": "2020-12-16",
      "149a673e.top": "2020-12-16",
      "14c7e2dc.space": "2020-10-25",
      "15bb747b.site": "2020-10-25",
      "15ce27c5.site": "2020-10-25",
      "16e53040.space": "2020-10-25",
      "177a5c4a.space": "2020-10-25",
      "17ecf559.site": "2020-10-25",
      "1cb3c4c0.space": "2020-10-25",
      "1d4ee030.space": "2020-10-25",
      "1d8bfc20.space": "2020-10-25",
      "1f0e7a56.space": "2020-10-25",
      "23dafa1e.space": "2020-10-25",
      "2daa46f1.space": "2020-10-25",
      "32c39cf4.dynu.net": "2020-12-16",
      "32c39cf4.net": "2020-12-16",
      "32c39cf4.space": "2020-12-16",
      "32c39cf4.top": "2020-12-16",
      "334edefd.dynu.net": "2020-12-16",
      "334edefd.net": "2020-12-16",
      "334edefd.space": "2020-12-16",
      "334edefd.top": "2020-12-16",
      "341a436d.space": "2020-10-25",
      "34231ae4.dynu.net": "2020-12-16",
      "34231ae4.net": "2020-12-16",
      "34231ae4.space": "2020-12-16",
      "34231ae4.top": "2020-12-16",
      "3828b6ed.site": "2020-10-25",
      "39451f31.space": "2020-10-25",
      "3a6e08b4.site": "2020-10-25",
      "3b75d0df.dynu.net": "2020-12-16",
      "3b75d0df.net": "2020-12-16",
      "3b75d0df.space": "2020-12-16",
      "3b75d0df.top": "2020-12-16",
      "3c6e6571.space": "2020-10-25",
      "3d9556cf.dynu.net": "2020-12-16",
      "3d9556cf.net": "2020-12-16",
      "3d9556cf.space": "2020-12-16",
      "3d9556cf.top": "2020-12-16",
      "3e8718c3.site": "2020-10-25",
      "3f4572f4.site": "2020-10-25",
      "42a9687b.dynu.net": "2020-12-16",
      "42a9687b.net": "2020-12-16",
      "42a9687b.space": "2020-12-16",
      "42a9687b.top": "2020-12-16",
      "431d73fb.space": "2020-10-25",
      "43242a72.dynu.net": "2020-12-16",
      "43242a72.net": "2020-12-16",
      "43242a72.space": "2020-12-16",
      "43242a72.top": "2020-12-16",
      "43ec206d.top": "2020-10-25",
      "4449ee6b.dynu.net": "2020-12-16",
      "4449ee6b.net": "2020-12-16",
      "4449ee6b.space": "2020-12-16",
      "4449ee6b.top": "2020-12-16",
      "45c4ac62.dynu.net": "2020-12-16",
      "45c4ac62.net": "2020-12-16",
      "45c4ac62.space": "2020-12-16",
      "45c4ac62.top": "2020-12-16",
      "4a926659.dynu.net": "2020-12-16",
      "4a926659.net": "2020-12-16",
      "4a926659.space": "2020-12-16",
      "4a926659.top": "2020-12-16",
      "4b6955e7.space": "2020-10-25",
      "4c72e049.dynu.net": "2020-12-16",
      "4c72e049.net": "2020-12-16",
      "4c72e049.space": "2020-12-16",
      "4c72e049.top": "2020-12-16",
      "4e422fa7.space": "2020-10-25",
      "4f2f867b.site": "2020-10-25",
      "5aad7667.space": "2020-10-25",
      "607d6cdc.space": "2020-10-25",
      "60ebc5cf.site": "2020-10-25",
      "61e200d6.space": "2020-10-25",
      "62c91753.site": "2020-10-25",
      "63c0d24a.space": "2020-10-25",
      "68094ac0.space": "2020-10-25",
      "6bb4f456.space": "2020-10-25",
      "76ede1bd.space": "2020-10-25",
      "7ba775ac.site": "2020-10-25",
      "8447b18a.space": "2020-10-25",
      "869182ff.site": "2020-10-25",
      "884efdfb.space": "2020-10-25",
      "891ec9e9.space": "2020-10-25",
      "8cc7767f.site": "2020-10-25",
      "8dceb366.space": "2020-10-25",
      "8ee5a4e3.site": "2020-10-25",
      "8fb167c7.space": "2020-10-25",
      "8fec61fa.space": "2020-10-25",
      "9155ccba.space": "2020-10-25",
      "9877fa8b.space": "2020-10-25",
      "98e38091.space": "2020-10-25",
      "9c1f58ab.site": "2020-10-25",
      "9f233843.space": "2020-10-25",
      "a20af0d2.space": "2020-10-25",
      "a367590e.site": "2020-10-25",
      "a4a55efc.space": "2020-10-25",
      "a64c234e.site": "2020-10-25",
      "aa478f47.dynu.net": "2020-12-16",
      "aa478f47.net": "2020-12-16",
      "aa478f47.space": "2020-12-16",
      "aa478f47.top": "2020-12-16",
      "abcacd4e.dynu.net": "2020-12-16",
      "abcacd4e.net": "2020-12-16",
      "abcacd4e.space": "2020-12-16",
      "abcacd4e.top": "2020-12-16",
      "aca70957.dynu.net": "2020-12-16",
      "aca70957.net": "2020-12-16",
      "aca70957.space": "2020-12-16",
      "aca70957.top": "2020-12-16",
      "ad2a4b5e.dynu.net": "2020-12-16",
      "ad2a4b5e.net": "2020-12-16",
      "ad2a4b5e.space": "2020-12-16",
      "ad2a4b5e.top": "2020-12-16",
      "analyse1.mooo.com": "2020-10-25",
      "b4a3174b.space": "2020-10-25",
      "best.short-name.com": "2020-10-25",
      "best2.short-name.com": "2020-10-25",
      "best2.short-url20.com": "2020-10-25",
      "best3.short-url20.com": "2020-10-25",
      "best4.short-url20.com": "2020-10-25",
      "best5.short-url20.com": "2020-10-25",
      "best6.short-url20.com": "2020-10-25",
      "best7.short-url20.com": "2020-10-25",
      "bestbox3.com": "2020-10-25",
      "bestupdateserver.com": "2020-10-25",
      "bestupdateserver2.com": "2020-10-25",
      "bestupser.awardspace.info": "2020-10-25",
      "bestwebstat.com": "2020-10-25",
      "bl2pe.bestwebstat.com": "2020-10-25",
      "box4035.net": "2020-10-25",
      "box4036.net": "2020-10-25",
      "box4037.net": "2020-10-25",
      "box4038.net": "2020-10-25",
      "box4039.net": "2020-10-25",
      "box4040.net": "2020-10-25",
      "box4041.net": "2020-10-25",
      "box4042.net": "2020-10-25",
      "box4043.net": "2020-10-25",
      "box4044.net": "2020-10-25",
      "box4045.net": "2020-10-25",
      "box4046.net": "2020-10-25",
      "box4047.net": "2020-10-25",
      "box4048.net": "2020-10-25",
      "box4049.net": "2020-10-25",
      "box4050.net": "2020-10-25",
      "box4051.net": "2020-10-25",
      "box4052.net": "2020-10-25",
      "box4053.net": "2020-10-25",
      "box4054.net": "2020-10-25",
      "box4055.net": "2020-10-25",
      "box4056.net": "2020-10-25",
      "box4057.net": "2020-10-25",
      "box4058.net": "2020-10-25",
      "box4059.net": "2020-10-25",
      "box4060.net": "2020-10-25",
      "box4061.net": "2020-10-25",
      "box4062.net": "2020-10-25",
      "box4063.net": "2020-10-25",
      "box4064.net": "2020-10-25",
      "box4065.net": "2020-10-25",
      "box4066.net": "2020-10-25",
      "box4067.net": "2020-10-25",
      "box4068.net": "2020-10-25",
      "box4069.net": "2020-10-25",
      "box4070.net": "2020-10-25",
      "box4071.net": "2020-10-25",
      "box4072.net": "2020-10-25",
      "box4075.net": "2020-10-25",
      "box4078.net": "2020-10-25",
      "box4079.net": "2020-10-25",
      "box4080.net": "2020-10-25",
      "box4081.net": "2020-10-25",
      "box4082.net": "2020-10-25",
      "box4083.net": "2020-10-25",
      "box4084.net": "2020-10-25",
      "box4085.net": "2020-10-25",
      "box4086.net": "2020-10-25",
      "box4087.net": "2020-10-25",
      "box4088.net": "2020-10-25",
      "box4089.net": "2020-10-25",
      "box4090.net": "2020-10-25",
      "c1.short-url20.com": "2020-10-25",
      "c4c9e3c4.space": "2020-10-25",
      "c5aeee9c.site": "2020-10-25",
      "cf75d89b.space": "2020-10-25",
      "d14b13d8.site": "2020-10-25",
      "d260045d.space": "2020-10-25",
      "d3a26e6a.space": "2020-10-25",
      "d4606998.site": "2020-10-25",
      "d50dc044.space": "2020-10-25",
      "d74b7e1d.space": "2020-10-25",
      "da2d7bc8.dynu.net": "2020-12-16",
      "da2d7bc8.net": "2020-12-16",
      "da2d7bc8.space": "2020-12-16",
      "da2d7bc8.top": "2020-12-16",
      "db54a845.dynu.net": "2020-10-25",
      "db54a845.net": "2020-10-25",
      "db54a845.space": "2020-10-25",
      "db54a845.top": "2020-10-25",
      "dba039c1.dynu.net": "2020-12-16",
      "dba039c1.net": "2020-12-16",
      "dba039c1.space": "2020-12-16",
      "dba039c1.top": "2020-12-16",
      "dbook.soon.it": "2020-10-25",
      "dccdfdd8.dynu.net": "2020-12-16",
      "dccdfdd8.net": "2020-12-16",
      "dccdfdd8.space": "2020-12-16",
      "dccdfdd8.top": "2020-12-16",
      "dd40bfd1.dynu.net": "2020-12-16",
      "dd40bfd1.net": "2020-12-16",
      "dd40bfd1.space": "2020-12-16",
      "dd40bfd1.top": "2020-12-16",
      "dsite.dyx.comextd.mine.bz": "2020-10-25",
      "e00be33d.space": "2020-10-25",
      "e00dc810.space": "2020-10-25",
      "e652fc2c.space": "2020-10-25",
      "eb18683d.site": "2020-10-25",
      "ee73f549.space": "2020-10-25",
      "f196b269.site": "2020-10-25",
      "f8b65751.space": "2020-10-25",
      "f8eb516c.space": "2020-10-25",
      "f9e29475.site": "2020-10-25",
      "fac983f0.space": "2020-10-25",
      "fastecs.netfirms.com": "2020-10-25",
      "fastupdate.net": "2020-10-25",
      "fbc046e9.site": "2020-10-25",
      "fe19f97f.space": "2020-10-25",
      "gstat.strangled.net": "2020-10-25",
      "lost.updateserver1.com": "2020-10-25",
      "lu.ige.es": "2020-10-25",
      "mand.pwnz.org": "2020-10-25",
      "myblog2000.com": "2020-10-25",
      "ns2.myblog2000.com": "2020-10-25",
      "nus.soon.it": "2020-10-25",
      "p208.ige.es": "2020-10-25",
      "safehostline.com": "2020-10-25",
      "safehostonline.com": "2020-10-25",
      "secup.soon.it": "2020-10-25",
      "short-name.com": "2020-10-25",
      "short-url20.com": "2020-10-25",
      "ttdl3.dynu.net": "2026-02-07",
      "update.info.gf": "2020-10-25",
      "updatebox4.com": "2020-10-25",
      "updateserver1.com": "2020-10-25",
      "updateserver3.com": "2020-10-25",
      "us1.short-name.com": "2020-10-25",
      "us12.short-url20.com": "2020-10-25",
      "us13.short-url20.com": "2020-10-25",
      "us15.short-url20.com": "2020-10-25",
      "us16.short-url20.com": "2020-10-25",
      "us1s2.strangled.net": "2020-10-25",
      "uvps1.cotbm.com": "2020-10-25",
      "wep.archvisio.com": "2020-10-25",
      "wep.soon.it": "2020-10-25",
      "wpstat.mine.bz": "2020-10-25",
      "wpstat.strangled.net": "2020-10-25",
      "youripinfo.com": "2020-10-25"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2020-10-25",
    "latest": "2026-02-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "017eab31.space",
      "01ead12b.space",
      "0ca0453a.site",
      "149a673e.dynu.net",
      "149a673e.net",
      "149a673e.space",
      "149a673e.top",
      "14c7e2dc.space",
      "15bb747b.site",
      "15ce27c5.site",
      "16e53040.space",
      "177a5c4a.space",
      "17ecf559.site",
      "1cb3c4c0.space",
      "1d4ee030.space",
      "1d8bfc20.space",
      "1f0e7a56.space",
      "23dafa1e.space",
      "2daa46f1.space",
      "32c39cf4.dynu.net",
      "32c39cf4.net",
      "32c39cf4.space",
      "32c39cf4.top",
      "334edefd.dynu.net",
      "334edefd.net",
      "334edefd.space",
      "334edefd.top",
      "341a436d.space",
      "34231ae4.dynu.net",
      "34231ae4.net",
      "34231ae4.space",
      "34231ae4.top",
      "3828b6ed.site",
      "39451f31.space",
      "3a6e08b4.site",
      "3b75d0df.dynu.net",
      "3b75d0df.net",
      "3b75d0df.space",
      "3b75d0df.top",
      "3c6e6571.space",
      "3d9556cf.dynu.net",
      "3d9556cf.net",
      "3d9556cf.space",
      "3d9556cf.top",
      "3e8718c3.site",
      "3f4572f4.site",
      "42a9687b.dynu.net",
      "42a9687b.net",
      "42a9687b.space",
      "42a9687b.top",
      "431d73fb.space",
      "43242a72.dynu.net",
      "43242a72.net",
      "43242a72.space",
      "43242a72.top",
      "43ec206d.top",
      "4449ee6b.dynu.net",
      "4449ee6b.net",
      "4449ee6b.space",
      "4449ee6b.top",
      "45c4ac62.dynu.net",
      "45c4ac62.net",
      "45c4ac62.space",
      "45c4ac62.top",
      "4a926659.dynu.net",
      "4a926659.net",
      "4a926659.space",
      "4a926659.top",
      "4b6955e7.space",
      "4c72e049.dynu.net",
      "4c72e049.net",
      "4c72e049.space",
      "4c72e049.top",
      "4e422fa7.space",
      "4f2f867b.site",
      "5aad7667.space",
      "607d6cdc.space",
      "60ebc5cf.site",
      "61e200d6.space",
      "62c91753.site",
      "63c0d24a.space",
      "68094ac0.space",
      "6bb4f456.space",
      "76ede1bd.space",
      "7ba775ac.site",
      "8447b18a.space",
      "869182ff.site",
      "884efdfb.space",
      "891ec9e9.space",
      "8cc7767f.site",
      "8dceb366.space",
      "8ee5a4e3.site",
      "8fb167c7.space",
      "8fec61fa.space",
      "9155ccba.space",
      "9877fa8b.space",
      "98e38091.space",
      "9c1f58ab.site",
      "9f233843.space",
      "a20af0d2.space",
      "a367590e.site",
      "a4a55efc.space",
      "a64c234e.site",
      "aa478f47.dynu.net",
      "aa478f47.net",
      "aa478f47.space",
      "aa478f47.top",
      "abcacd4e.dynu.net",
      "abcacd4e.net",
      "abcacd4e.space",
      "abcacd4e.top",
      "aca70957.dynu.net",
      "aca70957.net",
      "aca70957.space",
      "aca70957.top",
      "ad2a4b5e.dynu.net",
      "ad2a4b5e.net",
      "ad2a4b5e.space",
      "ad2a4b5e.top",
      "analyse1.mooo.com",
      "b4a3174b.space",
      "best.short-name.com",
      "best2.short-name.com",
      "best2.short-url20.com",
      "best3.short-url20.com",
      "best4.short-url20.com",
      "best5.short-url20.com",
      "best6.short-url20.com",
      "best7.short-url20.com",
      "bestbox3.com",
      "bestupdateserver.com",
      "bestupdateserver2.com",
      "bestupser.awardspace.info",
      "bestwebstat.com",
      "bl2pe.bestwebstat.com",
      "box4035.net",
      "box4036.net",
      "box4037.net",
      "box4038.net",
      "box4039.net",
      "box4040.net",
      "box4041.net",
      "box4042.net",
      "box4043.net",
      "box4044.net",
      "box4045.net",
      "box4046.net",
      "box4047.net",
      "box4048.net",
      "box4049.net",
      "box4050.net",
      "box4051.net",
      "box4052.net",
      "box4053.net",
      "box4054.net",
      "box4055.net",
      "box4056.net",
      "box4057.net",
      "box4058.net",
      "box4059.net",
      "box4060.net",
      "box4061.net",
      "box4062.net",
      "box4063.net",
      "box4064.net",
      "box4065.net",
      "box4066.net",
      "box4067.net",
      "box4068.net",
      "box4069.net",
      "box4070.net",
      "box4071.net",
      "box4072.net",
      "box4075.net",
      "box4078.net",
      "box4079.net",
      "box4080.net",
      "box4081.net",
      "box4082.net",
      "box4083.net",
      "box4084.net",
      "box4085.net",
      "box4086.net",
      "box4087.net",
      "box4088.net",
      "box4089.net",
      "box4090.net",
      "c1.short-url20.com",
      "c4c9e3c4.space",
      "c5aeee9c.site",
      "cf75d89b.space",
      "d14b13d8.site",
      "d260045d.space",
      "d3a26e6a.space",
      "d4606998.site",
      "d50dc044.space",
      "d74b7e1d.space",
      "da2d7bc8.dynu.net",
      "da2d7bc8.net",
      "da2d7bc8.space",
      "da2d7bc8.top",
      "db54a845.dynu.net",
      "db54a845.net",
      "db54a845.space",
      "db54a845.top",
      "dba039c1.dynu.net",
      "dba039c1.net",
      "dba039c1.space",
      "dba039c1.top",
      "dbook.soon.it",
      "dccdfdd8.dynu.net",
      "dccdfdd8.net",
      "dccdfdd8.space",
      "dccdfdd8.top",
      "dd40bfd1.dynu.net",
      "dd40bfd1.net",
      "dd40bfd1.space",
      "dd40bfd1.top",
      "dsite.dyx.comextd.mine.bz",
      "e00be33d.space",
      "e00dc810.space",
      "e652fc2c.space",
      "eb18683d.site",
      "ee73f549.space",
      "f196b269.site",
      "f8b65751.space",
      "f8eb516c.space",
      "f9e29475.site",
      "fac983f0.space",
      "fastecs.netfirms.com",
      "fastupdate.net",
      "fbc046e9.site",
      "fe19f97f.space",
      "gstat.strangled.net",
      "lost.updateserver1.com",
      "lu.ige.es",
      "mand.pwnz.org",
      "myblog2000.com",
      "ns2.myblog2000.com",
      "nus.soon.it",
      "p208.ige.es",
      "safehostline.com",
      "safehostonline.com",
      "secup.soon.it",
      "short-name.com",
      "short-url20.com",
      "ttdl3.dynu.net",
      "update.info.gf",
      "updatebox4.com",
      "updateserver1.com",
      "updateserver3.com",
      "us1.short-name.com",
      "us12.short-url20.com",
      "us13.short-url20.com",
      "us15.short-url20.com",
      "us16.short-url20.com",
      "us1s2.strangled.net",
      "uvps1.cotbm.com",
      "wep.archvisio.com",
      "wep.soon.it",
      "wpstat.mine.bz",
      "wpstat.strangled.net",
      "youripinfo.com"
    ]
  },
  "last_modified": "2026-02-07T19:08:09+00:00",
  "maltrail_groups": [
    "INFY"
  ],
  "references": [
    "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy",
    "https://twitter.com/ShadowChasing1/status/1339190981703266304",
    "https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/",
    "https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/",
    "https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/",
    "https://www.intezer.com/blog/research/prince-of-persia-the-sands-of-foudre/",
    "https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/",
    "https://www.safebreach.com/blog/prince-of-persia-part-ii/",
    "https://www.virustotal.com/gui/file/a64edb19e71549fb9248b27b58f911a4a1e8cd8b8e4adff93ecfb7e15a3cdad7/detection",
    "https://www.virustotal.com/gui/file/f535b46ad2452d61282f615faf35993e83b6c56c9533bf22c12f97f318242e06/detection",
    "https://www.virustotal.com/gui/file/f6bb93dda74c0de2032963e2804cacb47128603070fe04c372f86e69fa8ce47c/detection"
  ],
  "related": [],
  "slug": "INFY",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2026-02-07",
      "indicators": {
        "domain": [
          "ttdl3.dynu.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.safebreach.com/blog/prince-of-persia-a-decade-of-an-iranian-nation-state-apt-campaign-activity/",
        "https://www.safebreach.com/blog/prince-of-persia-part-ii/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 80
      },
      "first_seen": "2020-12-16",
      "indicators": {
        "domain": [
          "149a673e.dynu.net",
          "149a673e.net",
          "149a673e.space",
          "149a673e.top",
          "32c39cf4.dynu.net",
          "32c39cf4.net",
          "32c39cf4.space",
          "32c39cf4.top",
          "334edefd.dynu.net",
          "334edefd.net",
          "334edefd.space",
          "334edefd.top",
          "34231ae4.dynu.net",
          "34231ae4.net",
          "34231ae4.space",
          "34231ae4.top",
          "3b75d0df.dynu.net",
          "3b75d0df.net",
          "3b75d0df.space",
          "3b75d0df.top",
          "3d9556cf.dynu.net",
          "3d9556cf.net",
          "3d9556cf.space",
          "3d9556cf.top",
          "42a9687b.dynu.net",
          "42a9687b.net",
          "42a9687b.space",
          "42a9687b.top",
          "43242a72.dynu.net",
          "43242a72.net",
          "43242a72.space",
          "43242a72.top",
          "4449ee6b.dynu.net",
          "4449ee6b.net",
          "4449ee6b.space",
          "4449ee6b.top",
          "45c4ac62.dynu.net",
          "45c4ac62.net",
          "45c4ac62.space",
          "45c4ac62.top",
          "4a926659.dynu.net",
          "4a926659.net",
          "4a926659.space",
          "4a926659.top",
          "4c72e049.dynu.net",
          "4c72e049.net",
          "4c72e049.space",
          "4c72e049.top",
          "aa478f47.dynu.net",
          "aa478f47.net",
          "aa478f47.space",
          "aa478f47.top",
          "abcacd4e.dynu.net",
          "abcacd4e.net",
          "abcacd4e.space",
          "abcacd4e.top",
          "aca70957.dynu.net",
          "aca70957.net",
          "aca70957.space",
          "aca70957.top",
          "ad2a4b5e.dynu.net",
          "ad2a4b5e.net",
          "ad2a4b5e.space",
          "ad2a4b5e.top",
          "da2d7bc8.dynu.net",
          "da2d7bc8.net",
          "da2d7bc8.space",
          "da2d7bc8.top",
          "dba039c1.dynu.net",
          "dba039c1.net",
          "dba039c1.space",
          "dba039c1.top",
          "dccdfdd8.dynu.net",
          "dccdfdd8.net",
          "dccdfdd8.space",
          "dccdfdd8.top",
          "dd40bfd1.dynu.net",
          "dd40bfd1.net",
          "dd40bfd1.space",
          "dd40bfd1.top"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/ShadowChasing1/status/1339190981703266304",
        "https://www.virustotal.com/gui/file/f6bb93dda74c0de2032963e2804cacb47128603070fe04c372f86e69fa8ce47c/detection"
      ],
      "total": 80
    },
    {
      "counts": {
        "domain": 65
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "017eab31.space",
          "01ead12b.space",
          "0ca0453a.site",
          "14c7e2dc.space",
          "15bb747b.site",
          "15ce27c5.site",
          "16e53040.space",
          "17ecf559.site",
          "1cb3c4c0.space",
          "1d4ee030.space",
          "23dafa1e.space",
          "2daa46f1.space",
          "341a436d.space",
          "3828b6ed.site",
          "39451f31.space",
          "3a6e08b4.site",
          "3c6e6571.space",
          "3e8718c3.site",
          "3f4572f4.site",
          "431d73fb.space",
          "43ec206d.top",
          "4b6955e7.space",
          "4e422fa7.space",
          "4f2f867b.site",
          "5aad7667.space",
          "60ebc5cf.site",
          "61e200d6.space",
          "62c91753.site",
          "63c0d24a.space",
          "6bb4f456.space",
          "76ede1bd.space",
          "7ba775ac.site",
          "8447b18a.space",
          "869182ff.site",
          "884efdfb.space",
          "8cc7767f.site",
          "8dceb366.space",
          "8ee5a4e3.site",
          "8fec61fa.space",
          "9155ccba.space",
          "9877fa8b.space",
          "98e38091.space",
          "9c1f58ab.site",
          "9f233843.space",
          "a20af0d2.space",
          "a367590e.site",
          "a4a55efc.space",
          "a64c234e.site",
          "b4a3174b.space",
          "c4c9e3c4.space",
          "c5aeee9c.site",
          "d14b13d8.site",
          "d260045d.space",
          "d3a26e6a.space",
          "d4606998.site",
          "d50dc044.space",
          "d74b7e1d.space",
          "e00dc810.space",
          "e652fc2c.space",
          "eb18683d.site",
          "f196b269.site",
          "f8eb516c.space",
          "f9e29475.site",
          "fac983f0.space",
          "fbc046e9.site"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/unit42-prince-persia-ride-lightning-infy-returns-foudre/"
      ],
      "total": 65
    },
    {
      "counts": {
        "domain": 54
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "box4035.net",
          "box4036.net",
          "box4037.net",
          "box4038.net",
          "box4039.net",
          "box4040.net",
          "box4041.net",
          "box4042.net",
          "box4043.net",
          "box4044.net",
          "box4045.net",
          "box4046.net",
          "box4047.net",
          "box4048.net",
          "box4049.net",
          "box4050.net",
          "box4051.net",
          "box4052.net",
          "box4053.net",
          "box4055.net",
          "box4056.net",
          "box4057.net",
          "box4058.net",
          "box4059.net",
          "box4060.net",
          "box4061.net",
          "box4062.net",
          "box4063.net",
          "box4064.net",
          "box4065.net",
          "box4066.net",
          "box4067.net",
          "box4068.net",
          "box4069.net",
          "box4070.net",
          "box4071.net",
          "box4072.net",
          "box4075.net",
          "box4078.net",
          "box4079.net",
          "box4080.net",
          "box4081.net",
          "box4082.net",
          "box4083.net",
          "box4084.net",
          "box4085.net",
          "box4086.net",
          "box4087.net",
          "box4088.net",
          "box4089.net",
          "box4090.net",
          "p208.ige.es",
          "safehostline.com",
          "uvps1.cotbm.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/"
      ],
      "total": 54
    },
    {
      "counts": {
        "domain": 34
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "analyse1.mooo.com",
          "best.short-name.com",
          "best2.short-name.com",
          "best2.short-url20.com",
          "best3.short-url20.com",
          "best4.short-url20.com",
          "best5.short-url20.com",
          "best6.short-url20.com",
          "best7.short-url20.com",
          "bestwebstat.com",
          "bl2pe.bestwebstat.com",
          "c1.short-url20.com",
          "dbook.soon.it",
          "dsite.dyx.comextd.mine.bz",
          "fastecs.netfirms.com",
          "fastupdate.net",
          "lost.updateserver1.com",
          "mand.pwnz.org",
          "myblog2000.com",
          "ns2.myblog2000.com",
          "nus.soon.it",
          "safehostonline.com",
          "short-name.com",
          "short-url20.com",
          "update.info.gf",
          "us1.short-name.com",
          "us12.short-url20.com",
          "us13.short-url20.com",
          "us15.short-url20.com",
          "us16.short-url20.com",
          "wep.archvisio.com",
          "wep.soon.it",
          "wpstat.mine.bz",
          "wpstat.strangled.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy",
        "https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/"
      ],
      "total": 34
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "bestbox3.com",
          "bestupdateserver.com",
          "bestupdateserver2.com",
          "bestupser.awardspace.info",
          "box4054.net",
          "gstat.strangled.net",
          "lu.ige.es",
          "secup.soon.it",
          "updatebox4.com",
          "updateserver1.com",
          "updateserver3.com",
          "us1s2.strangled.net",
          "youripinfo.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.infy",
        "https://unit42.paloaltonetworks.com/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/",
        "https://unit42.paloaltonetworks.com/unit42-prince-of-persia-game-over/"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 11
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "177a5c4a.space",
          "1d8bfc20.space",
          "1f0e7a56.space",
          "607d6cdc.space",
          "68094ac0.space",
          "891ec9e9.space",
          "8fb167c7.space",
          "cf75d89b.space",
          "ee73f549.space",
          "f8b65751.space",
          "fe19f97f.space"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.intezer.com/blog/research/prince-of-persia-the-sands-of-foudre/"
      ],
      "total": 11
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2020-10-25",
      "indicators": {
        "domain": [
          "db54a845.dynu.net",
          "db54a845.net",
          "db54a845.space",
          "db54a845.top",
          "e00be33d.space"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/a64edb19e71549fb9248b27b58f911a4a1e8cd8b8e4adff93ecfb7e15a3cdad7/detection",
        "https://www.virustotal.com/gui/file/f535b46ad2452d61282f615faf35993e83b6c56c9533bf22c12f97f318242e06/detection"
      ],
      "total": 5
    }
  ]
}