{
  "type": "URL",
  "indicator": "http://docs.devmate.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://docs.devmate.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833385504,
      "indicator": "http://docs.devmate.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "69d3532c76eb3bf5edd9609b",
          "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
          "description": "",
          "modified": "2026-04-06T06:31:08.181000",
          "created": "2026-04-06T06:31:08.181000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65bbb998c3b7662e5059b6c2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "56 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d3532a6537880f6e2c68dc",
          "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
          "description": "",
          "modified": "2026-04-06T06:31:06.730000",
          "created": "2026-04-06T06:31:06.730000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65bbb998c3b7662e5059b6c2",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "56 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb9815816db0de034f3a3",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:17.285000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb98c440c1c45ec12ccdc",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:28.063000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb98d9818cca8f130c195",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:29.619000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbb998c3b7662e5059b6c2",
          "name": "Dark Power - Pegasus |  https://lawlink.com/",
          "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
          "modified": "2024-03-02T13:01:40.418000",
          "created": "2024-02-01T15:32:40.759000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "expiration",
            "url http",
            "url https",
            "hostname",
            "domain",
            "domain xn",
            "orgid1054",
            "ruen",
            "multiru",
            "multi",
            "fh no",
            "f no",
            "m892175",
            "n1822",
            "contact",
            "contacted",
            "ciphersuite",
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "1b@ssl.com",
            "apple",
            "all octoseek",
            "aaaa",
            "access",
            "alerts",
            "analyze",
            "antivirus",
            "apple as714",
            "apple as8075",
            "bootstrap@4.6.2",
            "body",
            "cellebrite",
            "cobalt strike",
            "command and control",
            "content type",
            "core",
            "create c",
            "cyber threat",
            "dark power",
            "privilege",
            "abuse",
            "legal",
            "privilege abuse",
            "preemptive policing",
            "ransomware",
            "dns",
            "worm",
            "network",
            "rat",
            "bat",
            "colorado",
            "douglas county",
            "pd",
            "racism",
            "sexism",
            "cover up",
            "malicious",
            "jeffrey reimer dpt",
            "default",
            "defender",
            "delete c",
            "dnssec",
            "document file",
            "dynamic",
            "dynamicloader",
            "emotet",
            "execution",
            "expiration",
            "date",
            "factory",
            "february",
            "filehash",
            "formbook",
            "hacktool",
            "framing",
            "harstel",
            "florence, co",
            "sherida",
            "spyeye",
            "castle pines",
            "tools",
            "defense",
            "medical malpractice fraud",
            "scheme",
            "tsara brashears",
            "targeting",
            "swatting",
            "high",
            "hostname",
            "hostnames",
            "malicious prosecution",
            "apb",
            "installer",
            "intel",
            "iocs",
            "ios",
            "lawlink@2x.svg",
            "local",
            "local",
            "lockbit",
            "lumma stealer",
            "corruption",
            "state actors",
            "untitled states",
            "installer",
            "intel",
            "makop",
            "malware",
            "silencing",
            "ms windows",
            "human rights",
            "civil rights",
            "retaliation",
            "name servers",
            "next",
            "passive dns",
            "paste",
            "collect contacts",
            "password",
            "unlock phone",
            "ios",
            "apple gateway",
            "android overlay",
            "interfacing",
            "pe32",
            "pegasus",
            "phishing",
            "protect",
            "pulse",
            "pulses",
            "qakbot",
            "quasar",
            "ransomexx",
            "read c",
            "record value",
            "regdword",
            "regsetvalueexa",
            "relacionada",
            "sample",
            "samples",
            "scan endpoints",
            "search",
            "servers",
            "shared",
            "show",
            "ssl certificate",
            "status",
            "stealer",
            "survivor",
            "t1063",
            "targets sa",
            "url",
            "xport",
            "write c",
            "write",
            "win32",
            "whois record",
            "threat",
            "threat analyzer",
            "tlsv1",
            "tracking",
            "united",
            "unknown",
            "urls",
            "urls https",
            "ursnif",
            "v2 document",
            "vanilla-lazyload@12.0.0",
            "vista event"
          ],
          "references": [
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
            "cbi.com",
            "deviceinbox.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
            "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
            "support.apple.com [nefarious]",
            "caselaw.lawlink.com",
            "http://mail.thyrsus.com/ [phishing]",
            "ppa.launchpad.net [Apple open use]",
            "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
            "1click-uninstaller.informer.com [Apple - access PE]",
            "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan"
          ],
          "malware_families": [
            {
              "id": "ALF:Trojan:PowerShell/DynamicLoader",
              "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/FormBook",
              "display_name": "ALF:Trojan:Win32/FormBook",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored.E",
              "display_name": "Worm:Win32/Bloored.E",
              "target": "/malware/Worm:Win32/Bloored.E"
            },
            {
              "id": "Makop",
              "display_name": "Makop",
              "target": null
            },
            {
              "id": "RansomEXX (ELF)",
              "display_name": "RansomEXX (ELF)",
              "target": null
            },
            {
              "id": "Ransom:Win32/Makop",
              "display_name": "Ransom:Win32/Makop",
              "target": "/malware/Ransom:Win32/Makop"
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "PWS:Win32/XPort",
              "display_name": "PWS:Win32/XPort",
              "target": "/malware/PWS:Win32/XPort"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Dark Power",
              "display_name": "Dark Power",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "LockBit",
              "display_name": "LockBit",
              "target": null
            },
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1562.003",
              "name": "Impair Command History Logging",
              "display_name": "T1562.003 - Impair Command History Logging"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1505.001",
              "name": "SQL Stored Procedures",
              "display_name": "T1505.001 - SQL Stored Procedures"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1353,
            "URL": 5046,
            "FileHash-MD5": 5182,
            "FileHash-SHA1": 2869,
            "FileHash-SHA256": 4063,
            "hostname": 2471,
            "email": 28,
            "CVE": 2,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 21019,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "cbi.com",
        "Trojan:Win32/WannaCry.350",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "cellebrite.com | enterprise.cellebrite.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "http://mail.thyrsus.com/ [phishing]",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "caselaw.lawlink.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "deviceinbox.com",
        "angebot.staude.de",
        "ppa.launchpad.net [Apple open use]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "support.apple.com [nefarious]",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Qakbot",
            "Worm:win32/bloored.e",
            "Ransomexx (elf)",
            "Alf:trojan:powershell/dynamicloader",
            "Ransom:win32/makop",
            "Pws:win32/xport",
            "Alf:trojan:win32/formbook",
            "Trojan:win32/wannacry.350",
            "Makop",
            "Lockbit",
            "Formbook",
            "Emotet",
            "Lumma stealer",
            "Pegasus",
            "Dark power",
            "Cobalt strike",
            "Quasar rat",
            "Hacktool"
          ],
          "industries": [],
          "unique_indicators": 31459
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/devmate.com",
    "whois": "http://whois.domaintools.com/devmate.com",
    "domain": "devmate.com",
    "hostname": "docs.devmate.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "69d3532c76eb3bf5edd9609b",
      "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
      "description": "",
      "modified": "2026-04-06T06:31:08.181000",
      "created": "2026-04-06T06:31:08.181000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65bbb998c3b7662e5059b6c2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "56 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d3532a6537880f6e2c68dc",
      "name": "clone credit octoseek-Dark Power - Pegasus | https://lawlink.com/ CREATED 2 YEARS AGO MODIFIED 2 YEARS AGO by OctoSeek",
      "description": "",
      "modified": "2026-04-06T06:31:06.730000",
      "created": "2026-04-06T06:31:06.730000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65bbb998c3b7662e5059b6c2",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "56 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb9815816db0de034f3a3",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:17.285000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb98c440c1c45ec12ccdc",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:28.063000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb98d9818cca8f130c195",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:29.619000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbb998c3b7662e5059b6c2",
      "name": "Dark Power - Pegasus |  https://lawlink.com/",
      "description": "Dark Power ransomware first emerged in early 2023. The group engages in multi-extortion, threatening to release victim data for various reasons. Dark Power encrypts the victim's files and requests a ransom payment in exchange for the decryption key. Dark Power's ransom note is distinct from other ransomware campaigns.\n\nPrivilege and other abusive practices considering individuals targeted.",
      "modified": "2024-03-02T13:01:40.418000",
      "created": "2024-02-01T15:32:40.759000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "expiration",
        "url http",
        "url https",
        "hostname",
        "domain",
        "domain xn",
        "orgid1054",
        "ruen",
        "multiru",
        "multi",
        "fh no",
        "f no",
        "m892175",
        "n1822",
        "contact",
        "contacted",
        "ciphersuite",
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "1b@ssl.com",
        "apple",
        "all octoseek",
        "aaaa",
        "access",
        "alerts",
        "analyze",
        "antivirus",
        "apple as714",
        "apple as8075",
        "bootstrap@4.6.2",
        "body",
        "cellebrite",
        "cobalt strike",
        "command and control",
        "content type",
        "core",
        "create c",
        "cyber threat",
        "dark power",
        "privilege",
        "abuse",
        "legal",
        "privilege abuse",
        "preemptive policing",
        "ransomware",
        "dns",
        "worm",
        "network",
        "rat",
        "bat",
        "colorado",
        "douglas county",
        "pd",
        "racism",
        "sexism",
        "cover up",
        "malicious",
        "jeffrey reimer dpt",
        "default",
        "defender",
        "delete c",
        "dnssec",
        "document file",
        "dynamic",
        "dynamicloader",
        "emotet",
        "execution",
        "expiration",
        "date",
        "factory",
        "february",
        "filehash",
        "formbook",
        "hacktool",
        "framing",
        "harstel",
        "florence, co",
        "sherida",
        "spyeye",
        "castle pines",
        "tools",
        "defense",
        "medical malpractice fraud",
        "scheme",
        "tsara brashears",
        "targeting",
        "swatting",
        "high",
        "hostname",
        "hostnames",
        "malicious prosecution",
        "apb",
        "installer",
        "intel",
        "iocs",
        "ios",
        "lawlink@2x.svg",
        "local",
        "local",
        "lockbit",
        "lumma stealer",
        "corruption",
        "state actors",
        "untitled states",
        "installer",
        "intel",
        "makop",
        "malware",
        "silencing",
        "ms windows",
        "human rights",
        "civil rights",
        "retaliation",
        "name servers",
        "next",
        "passive dns",
        "paste",
        "collect contacts",
        "password",
        "unlock phone",
        "ios",
        "apple gateway",
        "android overlay",
        "interfacing",
        "pe32",
        "pegasus",
        "phishing",
        "protect",
        "pulse",
        "pulses",
        "qakbot",
        "quasar",
        "ransomexx",
        "read c",
        "record value",
        "regdword",
        "regsetvalueexa",
        "relacionada",
        "sample",
        "samples",
        "scan endpoints",
        "search",
        "servers",
        "shared",
        "show",
        "ssl certificate",
        "status",
        "stealer",
        "survivor",
        "t1063",
        "targets sa",
        "url",
        "xport",
        "write c",
        "write",
        "win32",
        "whois record",
        "threat",
        "threat analyzer",
        "tlsv1",
        "tracking",
        "united",
        "unknown",
        "urls",
        "urls https",
        "ursnif",
        "v2 document",
        "vanilla-lazyload@12.0.0",
        "vista event"
      ],
      "references": [
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software",
        "cbi.com",
        "deviceinbox.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS unlocker password cracker]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing, apple data collecting, malvertizing]",
        "http://api.steampowered.com/http:/api.steampowered.com/ISteamUser/GetPlayerSummaries/v2/?key=C48A57D233D635FB8F3F10A436ECC1C6&steamids=76561198381531427 [Apple ' Get Player Summary]",
        "support.apple.com [nefarious]",
        "caselaw.lawlink.com",
        "http://mail.thyrsus.com/ [phishing]",
        "ppa.launchpad.net [Apple open use]",
        "http://www.apple.com/certificateauthority/AppleApplicationIntegrationCA5G1.cer [Apple Ubuntu access]",
        "1click-uninstaller.informer.com [Apple - access PE]",
        "http://findbetterresults.com/Merino_Wool_Sweater.cfm?domain=forever-maroc.info&fp=8hY5xppsJcgtsARaT7WA9YWFkv73AgUQdyA1jnNh+yA3h9O8vZwUKqaru+BK8mHlpfLdKQ3uyLeEMmr67cTpI5enUnehh8e08wXWZNWzuUuirPDdezatbM1egtU/y9NvL+vDq1mMMFh/mM2oY2OTk3Q55I/HPDvMg9G5tDB7B2NI1ORnlbH9It49w5nNtE8GPJO62ZrvE7op4RE1uejyAg==&yep=tn+cv4IO28h1WrEcdzQlEs/jm101ce3N5Yd+dISS3zi1qqYLL/bRey5jbLHFBau3HlE+l5mG3OfHGMjIhgUcSjmzkFmO8xF5WIF5bJ3TAo5F28EHKI1Zq/4skZteAEAU5z84hISeRSzcOq5BOh6KqXkJ975lpWA3dnOl6D4sRQWtda/GdACNYKHuxXk56T3vAIxgvjIsOYAJmKp5S"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan"
      ],
      "malware_families": [
        {
          "id": "ALF:Trojan:PowerShell/DynamicLoader",
          "display_name": "ALF:Trojan:PowerShell/DynamicLoader",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/FormBook",
          "display_name": "ALF:Trojan:Win32/FormBook",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored.E",
          "display_name": "Worm:Win32/Bloored.E",
          "target": "/malware/Worm:Win32/Bloored.E"
        },
        {
          "id": "Makop",
          "display_name": "Makop",
          "target": null
        },
        {
          "id": "RansomEXX (ELF)",
          "display_name": "RansomEXX (ELF)",
          "target": null
        },
        {
          "id": "Ransom:Win32/Makop",
          "display_name": "Ransom:Win32/Makop",
          "target": "/malware/Ransom:Win32/Makop"
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "PWS:Win32/XPort",
          "display_name": "PWS:Win32/XPort",
          "target": "/malware/PWS:Win32/XPort"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Dark Power",
          "display_name": "Dark Power",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "LockBit",
          "display_name": "LockBit",
          "target": null
        },
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1562.003",
          "name": "Impair Command History Logging",
          "display_name": "T1562.003 - Impair Command History Logging"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1505.001",
          "name": "SQL Stored Procedures",
          "display_name": "T1505.001 - SQL Stored Procedures"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1353,
        "URL": 5046,
        "FileHash-MD5": 5182,
        "FileHash-SHA1": 2869,
        "FileHash-SHA256": 4063,
        "hostname": 2471,
        "email": 28,
        "CVE": 2,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 21019,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://docs.devmate.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://docs.devmate.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780344990.2949865
}