{
  "type": "URL",
  "indicator": "https://bremeloracingleague.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://bremeloracingleague.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833622617,
      "indicator": "https://bremeloracingleague.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "65caca061fbb7674de86ec7b",
          "name": "Invicta Stealer",
          "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
          "modified": "2024-03-14T01:01:47.115000",
          "created": "2024-02-13T01:46:46.969000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "communicating",
            "whois whois",
            "subdomains",
            "referrer",
            "problems",
            "core",
            "startpage",
            "june",
            "passive dns",
            "urls",
            "domain",
            "otx telemetry",
            "body",
            "gmt content",
            "x adblock",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "date",
            "encrypt",
            "threat roundup",
            "october",
            "november",
            "march",
            "february",
            "apple ios",
            "april",
            "tsara brashears",
            "copy",
            "hacktool",
            "phishing",
            "metro",
            "crypto",
            "installer",
            "awful",
            "united",
            "unknown",
            "germany unknown",
            "search",
            "servers",
            "registrar",
            "name servers",
            "status",
            "next",
            "moved",
            "address",
            "creation date",
            "showing",
            "ipv4",
            "pulse submit",
            "url analysis",
            "accept",
            "aaaa",
            "record type",
            "ttl value",
            "html document",
            "ascii text",
            "anchor hrefs",
            "hrefs",
            "anchor",
            "anchor href",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "url https",
            "sample",
            "server",
            "code",
            "registry domain",
            "dnssec",
            "registrar url",
            "registrar whois",
            "iana id",
            "registrar abuse",
            "tech email",
            "fake update",
            "utilizes new",
            "idat loader",
            "stealc",
            "urls http",
            "isadultno",
            "adposbottom",
            "adformatplain",
            "adnetworks",
            "quasar rat",
            "ip detections",
            "country",
            "cellbrite",
            "execution",
            "pegasus",
            "malware",
            "agent tesla",
            "attack",
            "ukraine",
            "silent",
            "invicta stealer",
            "redline stealer",
            "orcus rat",
            "files",
            "germany asn",
            "as196763",
            "a domains",
            "redacted for",
            "record value",
            "for privacy",
            "emails",
            "name",
            "contacted urls",
            "bundled",
            "de indicators",
            "domains",
            "hashes",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "pulse pulses",
            "location united",
            "open",
            "cookie",
            "customer",
            "0 report",
            "sea alt",
            "certificate",
            "#targeting",
            "#discordwallets",
            "house.mo.gov"
          ],
          "references": [
            "https://www.facebooksunglassshop.com/",
            "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
            "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
            "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
            "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
            "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
            "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
            "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
            "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
            "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
            "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
            "edgedl.me.gvt1.com",
            "Link found in https://house.mo.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Invicta Stealer",
              "display_name": "Invicta Stealer",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Orcus RAT",
              "display_name": "Orcus RAT",
              "target": null
            },
            {
              "id": "Silent",
              "display_name": "Silent",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Civil Society",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 65,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 145,
            "FileHash-SHA256": 3848,
            "CVE": 3,
            "URL": 8291,
            "domain": 2541,
            "hostname": 3034,
            "email": 13
          },
          "indicator_count": 18028,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cab5eb4d0a233bf6f32edb",
          "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
          "description": "",
          "modified": "2024-03-11T02:01:13.710000",
          "created": "2024-02-13T00:20:59.154000",
          "tags": [
            "trojan",
            "show",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "april",
            "win32",
            "copy",
            "push",
            "malware infection",
            "threat roundup",
            "whois record",
            "contacted",
            "october",
            "execution",
            "january",
            "attack",
            "suspicious",
            "hacktool",
            "emotet",
            "injection",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "servicelogin",
            "kb document",
            "general full",
            "url https"
          ],
          "references": [
            "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/CryptInject.SD!MTB",
              "display_name": "Trojan:Win32/CryptInject.SD!MTB",
              "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
            },
            {
              "id": "Win.Malware.Fileinfector-9834127-0",
              "display_name": "Win.Malware.Fileinfector-9834127-0",
              "target": null
            },
            {
              "id": "Emotet b",
              "display_name": "Emotet b",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 276,
            "FileHash-SHA1": 274,
            "FileHash-SHA256": 3301,
            "URL": 2268,
            "hostname": 744,
            "CVE": 2,
            "domain": 340
          },
          "indicator_count": 7205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cab601f0d674294b603758",
          "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
          "description": "",
          "modified": "2024-03-11T02:01:13.710000",
          "created": "2024-02-13T00:21:21.869000",
          "tags": [
            "trojan",
            "show",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "april",
            "win32",
            "copy",
            "push",
            "malware infection",
            "threat roundup",
            "whois record",
            "contacted",
            "october",
            "execution",
            "january",
            "attack",
            "suspicious",
            "hacktool",
            "emotet",
            "injection",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "servicelogin",
            "kb document",
            "general full",
            "url https"
          ],
          "references": [
            "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/CryptInject.SD!MTB",
              "display_name": "Trojan:Win32/CryptInject.SD!MTB",
              "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
            },
            {
              "id": "Win.Malware.Fileinfector-9834127-0",
              "display_name": "Win.Malware.Fileinfector-9834127-0",
              "target": null
            },
            {
              "id": "Emotet b",
              "display_name": "Emotet b",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 276,
            "FileHash-SHA1": 274,
            "FileHash-SHA256": 3301,
            "URL": 2268,
            "hostname": 744,
            "CVE": 2,
            "domain": 340
          },
          "indicator_count": 7205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cab60667f8205c19d6b67b",
          "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
          "description": "",
          "modified": "2024-03-11T02:01:13.710000",
          "created": "2024-02-13T00:21:26.244000",
          "tags": [
            "trojan",
            "show",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "april",
            "win32",
            "copy",
            "push",
            "malware infection",
            "threat roundup",
            "whois record",
            "contacted",
            "october",
            "execution",
            "january",
            "attack",
            "suspicious",
            "hacktool",
            "emotet",
            "injection",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "servicelogin",
            "kb document",
            "general full",
            "url https"
          ],
          "references": [
            "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/CryptInject.SD!MTB",
              "display_name": "Trojan:Win32/CryptInject.SD!MTB",
              "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
            },
            {
              "id": "Win.Malware.Fileinfector-9834127-0",
              "display_name": "Win.Malware.Fileinfector-9834127-0",
              "target": null
            },
            {
              "id": "Emotet b",
              "display_name": "Emotet b",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 276,
            "FileHash-SHA1": 274,
            "FileHash-SHA256": 3301,
            "URL": 2268,
            "hostname": 744,
            "CVE": 2,
            "domain": 340
          },
          "indicator_count": 7205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cab616bb5869335d184ae7",
          "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
          "description": "",
          "modified": "2024-03-11T02:01:13.710000",
          "created": "2024-02-13T00:21:42.183000",
          "tags": [
            "trojan",
            "show",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "april",
            "win32",
            "copy",
            "push",
            "malware infection",
            "threat roundup",
            "whois record",
            "contacted",
            "october",
            "execution",
            "january",
            "attack",
            "suspicious",
            "hacktool",
            "emotet",
            "injection",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "servicelogin",
            "kb document",
            "general full",
            "url https"
          ],
          "references": [
            "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/CryptInject.SD!MTB",
              "display_name": "Trojan:Win32/CryptInject.SD!MTB",
              "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
            },
            {
              "id": "Win.Malware.Fileinfector-9834127-0",
              "display_name": "Win.Malware.Fileinfector-9834127-0",
              "target": null
            },
            {
              "id": "Emotet b",
              "display_name": "Emotet b",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 276,
            "FileHash-SHA1": 274,
            "FileHash-SHA256": 3301,
            "URL": 2268,
            "hostname": 744,
            "CVE": 2,
            "domain": 340
          },
          "indicator_count": 7205,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.facebooksunglassshop.com/",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "cellebrite.com | enterprise.cellebrite.com",
        "Link found in https://house.mo.com",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "deviceinbox.com",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "Trojan:Win32/WannaCry.350",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "edgedl.me.gvt1.com",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "wallpapers-nature.com",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "angebot.staude.de",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Silent",
            "Invicta stealer",
            "Trojan:win32/wannacry.350",
            "Win32:trojan-gen",
            "Quasar rat",
            "Pegasus",
            "Win.malware.fileinfector-9834127-0",
            "Trojan:win32/cryptinject.sd!mtb",
            "Emotet b",
            "Redline stealer",
            "Orcus rat",
            "Hacktool"
          ],
          "industries": [
            "Civil society",
            "Government",
            "Technology"
          ],
          "unique_indicators": 36394
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/bremeloracingleague.com",
    "whois": "http://whois.domaintools.com/bremeloracingleague.com",
    "domain": "bremeloracingleague.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "65caca061fbb7674de86ec7b",
      "name": "Invicta Stealer",
      "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
      "modified": "2024-03-14T01:01:47.115000",
      "created": "2024-02-13T01:46:46.969000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "resolutions",
        "communicating",
        "whois whois",
        "subdomains",
        "referrer",
        "problems",
        "core",
        "startpage",
        "june",
        "passive dns",
        "urls",
        "domain",
        "otx telemetry",
        "body",
        "gmt content",
        "x adblock",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "date",
        "encrypt",
        "threat roundup",
        "october",
        "november",
        "march",
        "february",
        "apple ios",
        "april",
        "tsara brashears",
        "copy",
        "hacktool",
        "phishing",
        "metro",
        "crypto",
        "installer",
        "awful",
        "united",
        "unknown",
        "germany unknown",
        "search",
        "servers",
        "registrar",
        "name servers",
        "status",
        "next",
        "moved",
        "address",
        "creation date",
        "showing",
        "ipv4",
        "pulse submit",
        "url analysis",
        "accept",
        "aaaa",
        "record type",
        "ttl value",
        "html document",
        "ascii text",
        "anchor hrefs",
        "hrefs",
        "anchor",
        "anchor href",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "url https",
        "sample",
        "server",
        "code",
        "registry domain",
        "dnssec",
        "registrar url",
        "registrar whois",
        "iana id",
        "registrar abuse",
        "tech email",
        "fake update",
        "utilizes new",
        "idat loader",
        "stealc",
        "urls http",
        "isadultno",
        "adposbottom",
        "adformatplain",
        "adnetworks",
        "quasar rat",
        "ip detections",
        "country",
        "cellbrite",
        "execution",
        "pegasus",
        "malware",
        "agent tesla",
        "attack",
        "ukraine",
        "silent",
        "invicta stealer",
        "redline stealer",
        "orcus rat",
        "files",
        "germany asn",
        "as196763",
        "a domains",
        "redacted for",
        "record value",
        "for privacy",
        "emails",
        "name",
        "contacted urls",
        "bundled",
        "de indicators",
        "domains",
        "hashes",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "pulse pulses",
        "location united",
        "open",
        "cookie",
        "customer",
        "0 report",
        "sea alt",
        "certificate",
        "#targeting",
        "#discordwallets",
        "house.mo.gov"
      ],
      "references": [
        "https://www.facebooksunglassshop.com/",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "edgedl.me.gvt1.com",
        "Link found in https://house.mo.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Invicta Stealer",
          "display_name": "Invicta Stealer",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Orcus RAT",
          "display_name": "Orcus RAT",
          "target": null
        },
        {
          "id": "Silent",
          "display_name": "Silent",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Civil Society",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 65,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 145,
        "FileHash-SHA256": 3848,
        "CVE": 3,
        "URL": 8291,
        "domain": 2541,
        "hostname": 3034,
        "email": 13
      },
      "indicator_count": 18028,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cab5eb4d0a233bf6f32edb",
      "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
      "description": "",
      "modified": "2024-03-11T02:01:13.710000",
      "created": "2024-02-13T00:20:59.154000",
      "tags": [
        "trojan",
        "show",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "april",
        "win32",
        "copy",
        "push",
        "malware infection",
        "threat roundup",
        "whois record",
        "contacted",
        "october",
        "execution",
        "january",
        "attack",
        "suspicious",
        "hacktool",
        "emotet",
        "injection",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "servicelogin",
        "kb document",
        "general full",
        "url https"
      ],
      "references": [
        "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/CryptInject.SD!MTB",
          "display_name": "Trojan:Win32/CryptInject.SD!MTB",
          "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
        },
        {
          "id": "Win.Malware.Fileinfector-9834127-0",
          "display_name": "Win.Malware.Fileinfector-9834127-0",
          "target": null
        },
        {
          "id": "Emotet b",
          "display_name": "Emotet b",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 276,
        "FileHash-SHA1": 274,
        "FileHash-SHA256": 3301,
        "URL": 2268,
        "hostname": 744,
        "CVE": 2,
        "domain": 340
      },
      "indicator_count": 7205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cab601f0d674294b603758",
      "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
      "description": "",
      "modified": "2024-03-11T02:01:13.710000",
      "created": "2024-02-13T00:21:21.869000",
      "tags": [
        "trojan",
        "show",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "april",
        "win32",
        "copy",
        "push",
        "malware infection",
        "threat roundup",
        "whois record",
        "contacted",
        "october",
        "execution",
        "january",
        "attack",
        "suspicious",
        "hacktool",
        "emotet",
        "injection",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "servicelogin",
        "kb document",
        "general full",
        "url https"
      ],
      "references": [
        "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/CryptInject.SD!MTB",
          "display_name": "Trojan:Win32/CryptInject.SD!MTB",
          "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
        },
        {
          "id": "Win.Malware.Fileinfector-9834127-0",
          "display_name": "Win.Malware.Fileinfector-9834127-0",
          "target": null
        },
        {
          "id": "Emotet b",
          "display_name": "Emotet b",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 276,
        "FileHash-SHA1": 274,
        "FileHash-SHA256": 3301,
        "URL": 2268,
        "hostname": 744,
        "CVE": 2,
        "domain": 340
      },
      "indicator_count": 7205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cab60667f8205c19d6b67b",
      "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
      "description": "",
      "modified": "2024-03-11T02:01:13.710000",
      "created": "2024-02-13T00:21:26.244000",
      "tags": [
        "trojan",
        "show",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "april",
        "win32",
        "copy",
        "push",
        "malware infection",
        "threat roundup",
        "whois record",
        "contacted",
        "october",
        "execution",
        "january",
        "attack",
        "suspicious",
        "hacktool",
        "emotet",
        "injection",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "servicelogin",
        "kb document",
        "general full",
        "url https"
      ],
      "references": [
        "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/CryptInject.SD!MTB",
          "display_name": "Trojan:Win32/CryptInject.SD!MTB",
          "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
        },
        {
          "id": "Win.Malware.Fileinfector-9834127-0",
          "display_name": "Win.Malware.Fileinfector-9834127-0",
          "target": null
        },
        {
          "id": "Emotet b",
          "display_name": "Emotet b",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 276,
        "FileHash-SHA1": 274,
        "FileHash-SHA256": 3301,
        "URL": 2268,
        "hostname": 744,
        "CVE": 2,
        "domain": 340
      },
      "indicator_count": 7205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cab616bb5869335d184ae7",
      "name": "Malware Infection | Pseudonym 'Kevin Harden' Malvertizing RedTube Subsidiary",
      "description": "",
      "modified": "2024-03-11T02:01:13.710000",
      "created": "2024-02-13T00:21:42.183000",
      "tags": [
        "trojan",
        "show",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "april",
        "win32",
        "copy",
        "push",
        "malware infection",
        "threat roundup",
        "whois record",
        "contacted",
        "october",
        "execution",
        "january",
        "attack",
        "suspicious",
        "hacktool",
        "emotet",
        "injection",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "servicelogin",
        "kb document",
        "general full",
        "url https"
      ],
      "references": [
        "https://www.redtube.com/ServiceLogin?hl=de&passive=true&continue=https://www.redtube.ccom/%3Fdata%3Dkevinharden1978%2540gmail.com%252Fkevinharden1978%2B.search",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/CryptInject.SD!MTB",
          "display_name": "Trojan:Win32/CryptInject.SD!MTB",
          "target": "/malware/Trojan:Win32/CryptInject.SD!MTB"
        },
        {
          "id": "Win.Malware.Fileinfector-9834127-0",
          "display_name": "Win.Malware.Fileinfector-9834127-0",
          "target": null
        },
        {
          "id": "Emotet b",
          "display_name": "Emotet b",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 276,
        "FileHash-SHA1": 274,
        "FileHash-SHA256": 3301,
        "URL": 2268,
        "hostname": 744,
        "CVE": 2,
        "domain": 340
      },
      "indicator_count": 7205,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://bremeloracingleague.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://bremeloracingleague.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776615773.7678742
}