{
  "type": "URL",
  "indicator": "https://d.dpt2.camect.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://d.dpt2.camect.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3811259556,
      "indicator": "https://d.dpt2.camect.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "65b85faa9b8e3e1206d7f25c",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
          "description": "",
          "modified": "2024-06-15T04:39:29.943000",
          "created": "2024-01-30T02:32:10.210000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3503,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28413,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "673 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597f9c7542ffc6fffaecb30",
          "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
          "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:44:55.030000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4d4b5e060fb8a606a8",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.403000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4da16bd99cc5c02528",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.406000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "805 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659719b77c383c73c05208a9",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-04T20:48:55.431000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e6e042a968005f7a5552",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-17T14:40:32.084000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc13594cf21dbe00b94807",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-02-01T21:55:37.581000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b85faa9b8e3e1206d7f25c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6585b183175afafb5e3bfff5",
          "name": "Potential Poodle Attack against a server | Injection | Threat Network",
          "description": "",
          "modified": "2024-01-21T15:01:52.390000",
          "created": "2023-12-22T15:55:47.977000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "december",
            "whois whois",
            "historical ssl",
            "referrer",
            "problems",
            "november",
            "tsara brashears",
            "startpage",
            "core",
            "hacktool",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "win32 dll",
            "magic pe32",
            "intel",
            "ms windows",
            "compiler",
            "no data",
            "tag count",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "iocs",
            "sample summary",
            "as54113",
            "united",
            "xamzexpires300",
            "unknown",
            "a domains",
            "passive dns",
            "entries",
            "github pages",
            "request id",
            "sea x",
            "virtool",
            "accept",
            "cache",
            "hit x",
            "date hash",
            "avast avg",
            "files show",
            "execution",
            "contacted",
            "threat analyzer",
            "threat",
            "paste",
            "hostnames",
            "urls http",
            "noname057",
            "generic malware",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "generic",
            "inject",
            "!#AddsCopyToStartup",
            "SLF:Exploit:Win32/UACPathBypass.A",
            "SSL excessive fatal alerts (possible POODLE attack against serve",
            "injector",
            "185.199.108.133",
            "malware infection",
            "link",
            "name servers",
            "date",
            "title",
            "urls",
            "domain robot",
            "for privacy",
            "redacted for",
            "expiration date",
            "emotet",
            "upx",
            "msil",
            "trojan",
            "malware",
            "apple",
            "data collection",
            "privilege escalation",
            "evasive",
            "show",
            "scan endpoints",
            "all octoseek",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "copy",
            "threat network",
            "service modification",
            "target",
            "targeting an individual",
            "cybercrime",
            "fraud services",
            "attack",
            "africa",
            "libel",
            "password cracker",
            "ios"
          ],
          "references": [
            "frostwire-5.3.9.windows.exe",
            "185.199.108.133",
            "cdn-185-199-108-133.github.com",
            "AS : AS16509 Amazon.com, Inc",
            "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe",
            "IP : 54.192.29.164",
            "https://otx.alienvault.com/indicator/ip/185.199.108.133",
            "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133",
            "YARA Rules",
            "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs",
            "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
            "Matches rule UPX from ruleset UPX by kevoreilly",
            "REFERENCE: https://goo.gl/hXbwiV",
            "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command",
            "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]",
            "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]",
            "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]",
            "www.anyxxxtube.net",
            "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]",
            "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]",
            "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]",
            "103.246.145.111 [malware]",
            "x.ss2.us",
            "nr-data.net [Apple Private Data Collection]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Magic",
              "display_name": "Magic",
              "target": null
            },
            {
              "id": "Multios.Coinminer.Miner-6781728-2",
              "display_name": "Multios.Coinminer.Miner-6781728-2",
              "target": null
            },
            {
              "id": "Win32/Ispen BADNEWS Fake User-Agent",
              "display_name": "Win32/Ispen BADNEWS Fake User-Agent",
              "target": null
            },
            {
              "id": "Babulya/CollectorStealer User-Agent",
              "display_name": "Babulya/CollectorStealer User-Agent",
              "target": null
            },
            {
              "id": "Win.Malware.Generic-9820446-0",
              "display_name": "Win.Malware.Generic-9820446-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "VirTool:MSIL/Obfuscator.BV",
              "display_name": "VirTool:MSIL/Obfuscator.BV",
              "target": "/malware/VirTool:MSIL/Obfuscator.BV"
            },
            {
              "id": "Win.Trojan.Emotet-9850453-0",
              "display_name": "Win.Trojan.Emotet-9850453-0",
              "target": null
            },
            {
              "id": "ALF:HSTR:HackTool:ExtremeInjector.S01",
              "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
              "target": null
            },
            {
              "id": "!#HSTR:Win32/Spectorsoft",
              "display_name": "!#HSTR:Win32/Spectorsoft",
              "target": "/malware/!#HSTR:Win32/Spectorsoft"
            },
            {
              "id": "ALF:Base64EncodeFunctionMonitorW",
              "display_name": "ALF:Base64EncodeFunctionMonitorW",
              "target": null
            },
            {
              "id": "185.199.108.133.Malware_Host",
              "display_name": "185.199.108.133.Malware_Host",
              "target": null
            },
            {
              "id": "adware.opencandy",
              "display_name": "adware.opencandy",
              "target": null
            },
            {
              "id": "Malvertizing",
              "display_name": "Malvertizing",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1872,
            "FileHash-SHA1": 1140,
            "FileHash-SHA256": 2367,
            "URL": 1969,
            "domain": 327,
            "hostname": 1025,
            "email": 1
          },
          "indicator_count": 8701,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "819 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6585b18d61efd8798827c12a",
          "name": "Potential Poodle Attack against a server | Injection | Threat Network",
          "description": "",
          "modified": "2024-01-21T15:01:52.390000",
          "created": "2023-12-22T15:55:57.639000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "december",
            "whois whois",
            "historical ssl",
            "referrer",
            "problems",
            "november",
            "tsara brashears",
            "startpage",
            "core",
            "hacktool",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "win32 dll",
            "magic pe32",
            "intel",
            "ms windows",
            "compiler",
            "no data",
            "tag count",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "iocs",
            "sample summary",
            "as54113",
            "united",
            "xamzexpires300",
            "unknown",
            "a domains",
            "passive dns",
            "entries",
            "github pages",
            "request id",
            "sea x",
            "virtool",
            "accept",
            "cache",
            "hit x",
            "date hash",
            "avast avg",
            "files show",
            "execution",
            "contacted",
            "threat analyzer",
            "threat",
            "paste",
            "hostnames",
            "urls http",
            "noname057",
            "generic malware",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "generic",
            "inject",
            "!#AddsCopyToStartup",
            "SLF:Exploit:Win32/UACPathBypass.A",
            "SSL excessive fatal alerts (possible POODLE attack against serve",
            "injector",
            "185.199.108.133",
            "malware infection",
            "link",
            "name servers",
            "date",
            "title",
            "urls",
            "domain robot",
            "for privacy",
            "redacted for",
            "expiration date",
            "emotet",
            "upx",
            "msil",
            "trojan",
            "malware",
            "apple",
            "data collection",
            "privilege escalation",
            "evasive",
            "show",
            "scan endpoints",
            "all octoseek",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "copy",
            "threat network",
            "service modification",
            "target",
            "targeting an individual",
            "cybercrime",
            "fraud services",
            "attack",
            "africa",
            "libel",
            "password cracker",
            "ios"
          ],
          "references": [
            "frostwire-5.3.9.windows.exe",
            "185.199.108.133",
            "cdn-185-199-108-133.github.com",
            "AS : AS16509 Amazon.com, Inc",
            "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe",
            "IP : 54.192.29.164",
            "https://otx.alienvault.com/indicator/ip/185.199.108.133",
            "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133",
            "YARA Rules",
            "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs",
            "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
            "Matches rule UPX from ruleset UPX by kevoreilly",
            "REFERENCE: https://goo.gl/hXbwiV",
            "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command",
            "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
            "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]",
            "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]",
            "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]",
            "www.anyxxxtube.net",
            "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]",
            "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]",
            "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]",
            "103.246.145.111 [malware]",
            "x.ss2.us",
            "nr-data.net [Apple Private Data Collection]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Magic",
              "display_name": "Magic",
              "target": null
            },
            {
              "id": "Multios.Coinminer.Miner-6781728-2",
              "display_name": "Multios.Coinminer.Miner-6781728-2",
              "target": null
            },
            {
              "id": "Win32/Ispen BADNEWS Fake User-Agent",
              "display_name": "Win32/Ispen BADNEWS Fake User-Agent",
              "target": null
            },
            {
              "id": "Babulya/CollectorStealer User-Agent",
              "display_name": "Babulya/CollectorStealer User-Agent",
              "target": null
            },
            {
              "id": "Win.Malware.Generic-9820446-0",
              "display_name": "Win.Malware.Generic-9820446-0",
              "target": null
            },
            {
              "id": "Worm:Win32/AutoRun!atmn",
              "display_name": "Worm:Win32/AutoRun!atmn",
              "target": "/malware/Worm:Win32/AutoRun!atmn"
            },
            {
              "id": "VirTool:MSIL/Obfuscator.BV",
              "display_name": "VirTool:MSIL/Obfuscator.BV",
              "target": "/malware/VirTool:MSIL/Obfuscator.BV"
            },
            {
              "id": "Win.Trojan.Emotet-9850453-0",
              "display_name": "Win.Trojan.Emotet-9850453-0",
              "target": null
            },
            {
              "id": "ALF:HSTR:HackTool:ExtremeInjector.S01",
              "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
              "target": null
            },
            {
              "id": "!#HSTR:Win32/Spectorsoft",
              "display_name": "!#HSTR:Win32/Spectorsoft",
              "target": "/malware/!#HSTR:Win32/Spectorsoft"
            },
            {
              "id": "ALF:Base64EncodeFunctionMonitorW",
              "display_name": "ALF:Base64EncodeFunctionMonitorW",
              "target": null
            },
            {
              "id": "185.199.108.133.Malware_Host",
              "display_name": "185.199.108.133.Malware_Host",
              "target": null
            },
            {
              "id": "adware.opencandy",
              "display_name": "adware.opencandy",
              "target": null
            },
            {
              "id": "Malvertizing",
              "display_name": "Malvertizing",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1872,
            "FileHash-SHA1": 1140,
            "FileHash-SHA256": 2367,
            "URL": 1969,
            "domain": 327,
            "hostname": 1025,
            "email": 1
          },
          "indicator_count": 8701,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "819 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.myminiweb.com/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://otx.alienvault.com/indicator/ip/185.199.108.133",
        "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133",
        "http://alohatube.xyz/search/tsara-brashears",
        "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]",
        "REFERENCE: https://goo.gl/hXbwiV",
        "185.199.108.133",
        "dvd-game-new-releases.info",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "x.ss2.us",
        "AS : AS16509 Amazon.com, Inc",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe",
        "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]",
        "1.116.217.151 [Cobalt Strike]",
        "103.246.145.111 [malware]",
        "vtbehaviour.commondatastorage.googleapis.com",
        "www.anyxxxtube.net",
        "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs",
        "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command",
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "YARA Rules",
        "frostwire-5.3.9.windows.exe",
        "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]",
        "IP : 54.192.29.164",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "ns3.hallgrandsale.ru",
        "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]",
        "nr-data.net [Apple Private Data Collection]",
        "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "cdn-185-199-108-133.github.com",
        "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]",
        "Matches rule UPX from ruleset UPX by kevoreilly"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:hstr:hacktool:extremeinjector.s01",
            "Hacktool",
            "Babulya/collectorstealer user-agent",
            "Malvertizing",
            "Et",
            "Virtool",
            "Win.trojan.emotet-9850453-0",
            "Virtool:msil/obfuscator.bv",
            "Alf:heraklezeval:trojan:win32/agenttesla!rfn",
            "Adware.opencandy",
            "Alf:base64encodefunctionmonitorw",
            "Hallrender",
            "185.199.108.133.malware_host",
            "Win.malware.generic-9820446-0",
            "Tulach",
            "Win32/ispen badnews fake user-agent",
            "Emotet",
            "Content reputation",
            "Cobalt strike",
            "Multios.coinminer.miner-6781728-2",
            "Generic",
            "Magic",
            "Worm:win32/autorun!atmn",
            "!#hstr:win32/spectorsoft",
            "Hallgrand"
          ],
          "industries": [],
          "unique_indicators": 55006
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/camect.com",
    "whois": "http://whois.domaintools.com/camect.com",
    "domain": "camect.com",
    "hostname": "d.dpt2.camect.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "65b85faa9b8e3e1206d7f25c",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
      "description": "",
      "modified": "2024-06-15T04:39:29.943000",
      "created": "2024-01-30T02:32:10.210000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3503,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28413,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "673 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597f9c7542ffc6fffaecb30",
      "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
      "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:44:55.030000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4d4b5e060fb8a606a8",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.403000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4da16bd99cc5c02528",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.406000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "805 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659719b77c383c73c05208a9",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-04T20:48:55.431000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e6e042a968005f7a5552",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-17T14:40:32.084000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc13594cf21dbe00b94807",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-02-01T21:55:37.581000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65b85faa9b8e3e1206d7f25c",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6585b183175afafb5e3bfff5",
      "name": "Potential Poodle Attack against a server | Injection | Threat Network",
      "description": "",
      "modified": "2024-01-21T15:01:52.390000",
      "created": "2023-12-22T15:55:47.977000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "december",
        "whois whois",
        "historical ssl",
        "referrer",
        "problems",
        "november",
        "tsara brashears",
        "startpage",
        "core",
        "hacktool",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "win32 dll",
        "magic pe32",
        "intel",
        "ms windows",
        "compiler",
        "no data",
        "tag count",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "iocs",
        "sample summary",
        "as54113",
        "united",
        "xamzexpires300",
        "unknown",
        "a domains",
        "passive dns",
        "entries",
        "github pages",
        "request id",
        "sea x",
        "virtool",
        "accept",
        "cache",
        "hit x",
        "date hash",
        "avast avg",
        "files show",
        "execution",
        "contacted",
        "threat analyzer",
        "threat",
        "paste",
        "hostnames",
        "urls http",
        "noname057",
        "generic malware",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "generic",
        "inject",
        "!#AddsCopyToStartup",
        "SLF:Exploit:Win32/UACPathBypass.A",
        "SSL excessive fatal alerts (possible POODLE attack against serve",
        "injector",
        "185.199.108.133",
        "malware infection",
        "link",
        "name servers",
        "date",
        "title",
        "urls",
        "domain robot",
        "for privacy",
        "redacted for",
        "expiration date",
        "emotet",
        "upx",
        "msil",
        "trojan",
        "malware",
        "apple",
        "data collection",
        "privilege escalation",
        "evasive",
        "show",
        "scan endpoints",
        "all octoseek",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "copy",
        "threat network",
        "service modification",
        "target",
        "targeting an individual",
        "cybercrime",
        "fraud services",
        "attack",
        "africa",
        "libel",
        "password cracker",
        "ios"
      ],
      "references": [
        "frostwire-5.3.9.windows.exe",
        "185.199.108.133",
        "cdn-185-199-108-133.github.com",
        "AS : AS16509 Amazon.com, Inc",
        "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe",
        "IP : 54.192.29.164",
        "https://otx.alienvault.com/indicator/ip/185.199.108.133",
        "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133",
        "YARA Rules",
        "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "Matches rule UPX from ruleset UPX by kevoreilly",
        "REFERENCE: https://goo.gl/hXbwiV",
        "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command",
        "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]",
        "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]",
        "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]",
        "www.anyxxxtube.net",
        "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]",
        "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]",
        "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]",
        "103.246.145.111 [malware]",
        "x.ss2.us",
        "nr-data.net [Apple Private Data Collection]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Magic",
          "display_name": "Magic",
          "target": null
        },
        {
          "id": "Multios.Coinminer.Miner-6781728-2",
          "display_name": "Multios.Coinminer.Miner-6781728-2",
          "target": null
        },
        {
          "id": "Win32/Ispen BADNEWS Fake User-Agent",
          "display_name": "Win32/Ispen BADNEWS Fake User-Agent",
          "target": null
        },
        {
          "id": "Babulya/CollectorStealer User-Agent",
          "display_name": "Babulya/CollectorStealer User-Agent",
          "target": null
        },
        {
          "id": "Win.Malware.Generic-9820446-0",
          "display_name": "Win.Malware.Generic-9820446-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "VirTool:MSIL/Obfuscator.BV",
          "display_name": "VirTool:MSIL/Obfuscator.BV",
          "target": "/malware/VirTool:MSIL/Obfuscator.BV"
        },
        {
          "id": "Win.Trojan.Emotet-9850453-0",
          "display_name": "Win.Trojan.Emotet-9850453-0",
          "target": null
        },
        {
          "id": "ALF:HSTR:HackTool:ExtremeInjector.S01",
          "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
          "target": null
        },
        {
          "id": "!#HSTR:Win32/Spectorsoft",
          "display_name": "!#HSTR:Win32/Spectorsoft",
          "target": "/malware/!#HSTR:Win32/Spectorsoft"
        },
        {
          "id": "ALF:Base64EncodeFunctionMonitorW",
          "display_name": "ALF:Base64EncodeFunctionMonitorW",
          "target": null
        },
        {
          "id": "185.199.108.133.Malware_Host",
          "display_name": "185.199.108.133.Malware_Host",
          "target": null
        },
        {
          "id": "adware.opencandy",
          "display_name": "adware.opencandy",
          "target": null
        },
        {
          "id": "Malvertizing",
          "display_name": "Malvertizing",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1872,
        "FileHash-SHA1": 1140,
        "FileHash-SHA256": 2367,
        "URL": 1969,
        "domain": 327,
        "hostname": 1025,
        "email": 1
      },
      "indicator_count": 8701,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "819 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6585b18d61efd8798827c12a",
      "name": "Potential Poodle Attack against a server | Injection | Threat Network",
      "description": "",
      "modified": "2024-01-21T15:01:52.390000",
      "created": "2023-12-22T15:55:57.639000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "december",
        "whois whois",
        "historical ssl",
        "referrer",
        "problems",
        "november",
        "tsara brashears",
        "startpage",
        "core",
        "hacktool",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "win32 dll",
        "magic pe32",
        "intel",
        "ms windows",
        "compiler",
        "no data",
        "tag count",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "iocs",
        "sample summary",
        "as54113",
        "united",
        "xamzexpires300",
        "unknown",
        "a domains",
        "passive dns",
        "entries",
        "github pages",
        "request id",
        "sea x",
        "virtool",
        "accept",
        "cache",
        "hit x",
        "date hash",
        "avast avg",
        "files show",
        "execution",
        "contacted",
        "threat analyzer",
        "threat",
        "paste",
        "hostnames",
        "urls http",
        "noname057",
        "generic malware",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "generic",
        "inject",
        "!#AddsCopyToStartup",
        "SLF:Exploit:Win32/UACPathBypass.A",
        "SSL excessive fatal alerts (possible POODLE attack against serve",
        "injector",
        "185.199.108.133",
        "malware infection",
        "link",
        "name servers",
        "date",
        "title",
        "urls",
        "domain robot",
        "for privacy",
        "redacted for",
        "expiration date",
        "emotet",
        "upx",
        "msil",
        "trojan",
        "malware",
        "apple",
        "data collection",
        "privilege escalation",
        "evasive",
        "show",
        "scan endpoints",
        "all octoseek",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "copy",
        "threat network",
        "service modification",
        "target",
        "targeting an individual",
        "cybercrime",
        "fraud services",
        "attack",
        "africa",
        "libel",
        "password cracker",
        "ios"
      ],
      "references": [
        "frostwire-5.3.9.windows.exe",
        "185.199.108.133",
        "cdn-185-199-108-133.github.com",
        "AS : AS16509 Amazon.com, Inc",
        "SRC URL : http://dl.frostwire.com/frostwire/5.3.9/frostwire-5.3.9.windows.exe",
        "IP : 54.192.29.164",
        "https://otx.alienvault.com/indicator/ip/185.199.108.133",
        "Malware Hosting: IPv4 185.199.108.133, 185.199.109.133, 185.199.110.133, 185.199.111.133",
        "YARA Rules",
        "Matches rule Windows_API_Function from ruleset Windows_API_Function by InQuest Labs",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "Matches rule UPX from ruleset UPX by kevoreilly",
        "REFERENCE: https://goo.gl/hXbwiV",
        "RULE_LINK: https://valhalla.nextron-systems.com/info/rule/SUSP_JS_Command",
        "More information: https://www.nextron-systems.com/notes-on-virustotal-matches/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing]",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term= [Mobile transactional with ads/ malicious]",
        "https://otx.alienvault.com/indicator/url/https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Walker | Apple Password Cracker]",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel [Apple exploit]",
        "www.pornhub.com [New Relic | nr-data.net | Apple Private Data Collection]",
        "www.anyxxxtube.net",
        "https://otx.alienvault.com/indicator/url/https://www.bleepingcomputer.com/forums/t/268006/wormmalware-that-kills-run-system-restore-regedit/ [ phishing attack directed towards Tsara Brashears]",
        "phishing-campaign-cloudstation-eu-west-98.githubusercontent.com [phishing]",
        "louisianarooflawyers.com [phishing| songculture.com redirect , compromised by threat actors]",
        "103.246.145.111 [malware]",
        "x.ss2.us",
        "nr-data.net [Apple Private Data Collection]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Magic",
          "display_name": "Magic",
          "target": null
        },
        {
          "id": "Multios.Coinminer.Miner-6781728-2",
          "display_name": "Multios.Coinminer.Miner-6781728-2",
          "target": null
        },
        {
          "id": "Win32/Ispen BADNEWS Fake User-Agent",
          "display_name": "Win32/Ispen BADNEWS Fake User-Agent",
          "target": null
        },
        {
          "id": "Babulya/CollectorStealer User-Agent",
          "display_name": "Babulya/CollectorStealer User-Agent",
          "target": null
        },
        {
          "id": "Win.Malware.Generic-9820446-0",
          "display_name": "Win.Malware.Generic-9820446-0",
          "target": null
        },
        {
          "id": "Worm:Win32/AutoRun!atmn",
          "display_name": "Worm:Win32/AutoRun!atmn",
          "target": "/malware/Worm:Win32/AutoRun!atmn"
        },
        {
          "id": "VirTool:MSIL/Obfuscator.BV",
          "display_name": "VirTool:MSIL/Obfuscator.BV",
          "target": "/malware/VirTool:MSIL/Obfuscator.BV"
        },
        {
          "id": "Win.Trojan.Emotet-9850453-0",
          "display_name": "Win.Trojan.Emotet-9850453-0",
          "target": null
        },
        {
          "id": "ALF:HSTR:HackTool:ExtremeInjector.S01",
          "display_name": "ALF:HSTR:HackTool:ExtremeInjector.S01",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/AgentTesla!rfn",
          "target": null
        },
        {
          "id": "!#HSTR:Win32/Spectorsoft",
          "display_name": "!#HSTR:Win32/Spectorsoft",
          "target": "/malware/!#HSTR:Win32/Spectorsoft"
        },
        {
          "id": "ALF:Base64EncodeFunctionMonitorW",
          "display_name": "ALF:Base64EncodeFunctionMonitorW",
          "target": null
        },
        {
          "id": "185.199.108.133.Malware_Host",
          "display_name": "185.199.108.133.Malware_Host",
          "target": null
        },
        {
          "id": "adware.opencandy",
          "display_name": "adware.opencandy",
          "target": null
        },
        {
          "id": "Malvertizing",
          "display_name": "Malvertizing",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1872,
        "FileHash-SHA1": 1140,
        "FileHash-SHA256": 2367,
        "URL": 1969,
        "domain": 327,
        "hostname": 1025,
        "email": 1
      },
      "indicator_count": 8701,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "819 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://d.dpt2.camect.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://d.dpt2.camect.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631706.4735267
}