{
  "type": "URL",
  "indicator": "https://images.ploooop.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://images.ploooop.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3785878029,
      "indicator": "https://images.ploooop.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "65eff46bdd371899ca5be7d7",
          "name": "CrypterX-gen | Video-lal.com | M. Brian Sabey \u2022 Hall Render | Rexxfield",
          "description": "Videolal results. Parked. Owner of domain has subsidiaries including Huge Domains. It's possible for attacker to post a 404 error page,  park, post it for sale, malvertize. HoneyPotBot? \n\nFireeye. A bit much. william.ballenthin@fireeye.com\t\ncontain a resource (.rsrc) section moritz.raabe@fireeye.com. Overkill. What would Scooby Doo? Scooby!? \nTarget reports opening her MacBook Pro after it was replaced by Apple. It hadn't been in use. She opened it, surprised it was on, automatically connected to a store wifi (she was home) A worker was typing away in terminal. Fought hacker for recordings app containing Jeffrey Reimers aggressions. She lost. Terrified she murdered her MacBook by drowning  & dismemberment. Big mistake. Cloned MacBook.  Clicked on links trigger malicious downloads, network & DNS issues.",
          "modified": "2024-04-11T04:01:24.166000",
          "created": "2024-03-12T06:21:31.484000",
          "tags": [
            "upatre malware",
            "rwi dtools",
            "page dow",
            "security",
            "bitfender",
            "yandex",
            "malware",
            "all octoseek",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "file score",
            "fireeye",
            "injection",
            "worm",
            "trojan",
            "network",
            "poster",
            "honeybots",
            "united",
            "unknown",
            "win32upatre mar",
            "passive dns",
            "entries",
            "ipv4",
            "body",
            "artro",
            "generic malware",
            "formbook",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "generic",
            "hostnames",
            "pattern match",
            "ascii text",
            "png image",
            "root ca",
            "file",
            "authority",
            "indicator",
            "mitre att",
            "ck id",
            "class",
            "date",
            "enterprise",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "trident",
            "as47846",
            "germany unknown",
            "as2906 netflix",
            "scan endpoints",
            "domain",
            "urls",
            "files",
            "trojanspy",
            "mozilla",
            "dynamicloader",
            "medium",
            "title",
            "ms windows",
            "head",
            "intel",
            "inetsim http",
            "delete c",
            "show",
            "winnt",
            "copy",
            "powershell",
            "write",
            "next",
            "suspicious",
            "shop",
            "graph api",
            "status",
            "join",
            "vt community",
            "api key",
            "xcitium verdict",
            "cloud",
            "contacted",
            "contacted urls",
            "ssl certificate",
            "referrer",
            "historical ssl",
            "parent domain",
            "apple ios",
            "resolutions",
            "execution",
            "hacktool",
            "outbound connection",
            "detection list",
            "blacklist"
          ],
          "references": [
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
            "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
            "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
            "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
            "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
            "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
            "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
            "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
            "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
            "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
            "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
            "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
            "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
            "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
            "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
            "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
            "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
            "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
            "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
            "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
            "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
            "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
            "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
            "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
            "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
            "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
            "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
            "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
            "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
            "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win32:CrypterX-gen\\ [Trj]",
              "display_name": "Win32:CrypterX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Other:Malware-gen\\ [Trj]",
              "display_name": "Other:Malware-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Win32.Renos/Artro",
              "display_name": "Win32.Renos/Artro",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "I-Worm/Bagle.QE",
              "display_name": "I-Worm/Bagle.QE",
              "target": null
            },
            {
              "id": "Worm.Bagle-44",
              "display_name": "Worm.Bagle-44",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.DE",
              "display_name": "TrojanSpy:Win32/Nivdort.DE",
              "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
            },
            {
              "id": "Win.Trojan.Generic-9897526-0",
              "display_name": "Win.Trojan.Generic-9897526-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Knigsfot-125",
              "display_name": "Win.Trojan.Knigsfot-125",
              "target": null
            },
            {
              "id": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "display_name": "ALF:TrojanDownloader:Win32/Vadokrist.A",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-9957168-0",
              "display_name": "Win.Trojan.Generic-9957168-0",
              "target": null
            },
            {
              "id": "Win.Adware.RelevantKnowledge-9821121-0",
              "display_name": "Win.Adware.RelevantKnowledge-9821121-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
              "target": null
            },
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1622,
            "FileHash-SHA1": 934,
            "FileHash-SHA256": 3289,
            "URL": 9605,
            "domain": 2321,
            "hostname": 2411,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 20186,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "783 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65618963e4e45d0c53f8e770",
          "name": "ww1.imobitracking.net",
          "description": "critical, cronup threat, cyber threat, data, serious, tracking, emails collection, relay router , emotet, exploit, content reputation.\n\nSerious tracking efforts, malicious.",
          "modified": "2023-12-25T03:01:27.395000",
          "created": "2023-11-25T05:42:59.043000",
          "tags": [
            "creation date",
            "search",
            "passive dns",
            "urls",
            "address",
            "record value",
            "emails",
            "date",
            "showing",
            "body",
            "unknown",
            "cowboy",
            "encrypt",
            "resolver ip",
            "whois lookups",
            "server",
            "iana id",
            "registrar abuse",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "registrar",
            "first",
            "dns replication",
            "algorithm",
            "key usage",
            "google",
            "record type",
            "ttl value",
            "cname",
            "data",
            "v3 serial",
            "contacted",
            "ssl certificate",
            "threat roundup",
            "march",
            "august",
            "referrer",
            "whois record",
            "communicating",
            "june",
            "april",
            "copy",
            "february",
            "cobalt strike",
            "remcos",
            "emotet",
            "core",
            "noname057",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "internet storm",
            "united",
            "cyber threat",
            "heur",
            "malicious url",
            "mail spammer",
            "suppobox",
            "bambernek",
            "cronup threat",
            "team",
            "facebook",
            "malicious",
            "phishing",
            "download",
            "virut",
            "unruy",
            "bandoo",
            "matsnu",
            "tofsee",
            "simda",
            "vawtrak",
            "hotmail",
            "qakbot",
            "asyncrat",
            "tsara brashears",
            "no data",
            "count blacklist",
            "tag tag",
            "pattern match",
            "ascii text",
            "file",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "appdata",
            "path",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "tor known",
            "tor relayrouter",
            "node tcp",
            "traffic",
            "host",
            "cins active",
            "poor reputation",
            "spammer",
            "barracuda et",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "agent",
            "wacatac",
            "bank",
            "opencandy",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "presenoker",
            "filetour",
            "conduit",
            "xtrat",
            "azorult",
            "service",
            "runescape",
            "acint",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "exploit",
            "xrat",
            "installcore",
            "patcher",
            "adload",
            "win64",
            "softcnapp",
            "union",
            "ponmocup",
            "fusioncore",
            "trojanspy",
            "webtoolbar",
            "maltiverse",
            "114.114.114.114",
            "tulach",
            "tracking",
            "apple",
            "illegal",
            "target",
            "c2",
            "cnc",
            "scanning_host",
            "CVE-2011-0611",
            "CVE-2017-0147",
            "CVE-2014-3153",
            "CVE-2016-0189",
            "CVE-2017-0199",
            "CVE-2017-8570",
            "CVE-2017-11882",
            "CVE-2018-4893",
            "CVE-2018-8174",
            "CVE-2020-0601",
            "CVE-2023-22518"
          ],
          "references": [
            "ww1.imobitracking.net",
            "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
            "114.114.114.114",
            "signin-appleid.jackpotiot.com",
            "https://www.anyxxxtube.net/media/favicon/apple",
            "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://httpdev.findatoyota.com",
            "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
            "t.prototype.hasownproperty.call",
            "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
            "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Private Internet Access",
              "display_name": "Private Internet Access",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "XRat",
              "display_name": "XRat",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "Bandoo",
              "display_name": "Bandoo",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "Remcos",
              "display_name": "Remcos",
              "target": null
            },
            {
              "id": "Vawtrak",
              "display_name": "Vawtrak",
              "target": null
            },
            {
              "id": "Tiggre",
              "display_name": "Tiggre",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Ponmocup",
              "display_name": "TrojanDropper:Win32/Ponmocup",
              "target": "/malware/TrojanDropper:Win32/Ponmocup"
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1569,
            "FileHash-MD5": 489,
            "URL": 7420,
            "domain": 917,
            "FileHash-SHA1": 247,
            "email": 3,
            "FileHash-SHA256": 2578,
            "CVE": 11
          },
          "indicator_count": 13234,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "891 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6561581c55aacc7f571968af",
          "name": "Mirai | Inmortal | Loki | SpyEye",
          "description": "attack, cyber threat, network, vehicle tracking, cnc, athena cyber stalking, betabot, social engineering, Cisco umbrella, bambernek simda, active threat, ongoing spreader, spyware, redline stealer, qakbot, anilise, milemighmedia, sweetheart videos botnetwork, targeting ,  redirects, network, targeted toyota tracking",
          "modified": "2023-12-25T01:00:05.300000",
          "created": "2023-11-25T02:12:44.278000",
          "tags": [
            "replication",
            "date",
            "graph summary",
            "ssl certificate",
            "contacted",
            "whois record",
            "historical ssl",
            "threat roundup",
            "august",
            "tsara brashears",
            "whois whois",
            "execution",
            "dropped",
            "february",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "team",
            "malicious site",
            "malware",
            "phishing",
            "union",
            "bank",
            "unsafe",
            "united",
            "bambernek simda",
            "commerce",
            "pykspa",
            "bambernek",
            "ip reputation",
            "database",
            "vawtrak",
            "blacklist http",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "reverse dns",
            "software",
            "general full",
            "resource",
            "hash",
            "get h2",
            "protocol h2",
            "security tls",
            "url http",
            "main",
            "attention",
            "please",
            "adblock pro",
            "loki",
            "mon jul",
            "first",
            "linkid252669",
            "pjp3sltkz",
            "heur",
            "malware site",
            "phishing site",
            "artemis",
            "iframe",
            "riskware",
            "exploit",
            "fakealert",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "filetour",
            "cleaner",
            "wacatac",
            "xtrat",
            "genkryptik",
            "opencandy",
            "tiggre",
            "presenoker",
            "agent",
            "conduit",
            "xrat",
            "coinminer",
            "dropper",
            "alexa",
            "acint",
            "systweak",
            "behav",
            "download",
            "zbot",
            "xtreme",
            "installcore",
            "unruy",
            "patcher",
            "adload",
            "win64",
            "applicunwnt",
            "trojanspy",
            "webtoolbar",
            "cyber threat",
            "engineering",
            "firehol",
            "phishtank",
            "emotet",
            "ransomware",
            "malicious",
            "cobalt strike",
            "suppobox",
            "bradesco",
            "facebook",
            "banco",
            "nymaim",
            "smsspy",
            "stealer",
            "service",
            "mirai",
            "pony",
            "nanocore",
            "asyncrat",
            "downloader",
            "deepscan",
            "virut",
            "qakbot",
            "name verdict",
            "falcon sandbox",
            "blacklist https",
            "malicious url",
            "filerepmetagen",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "C2",
            "command_and_control",
            "spyware",
            "tracking",
            "targeting",
            "cyber stalking",
            "hostname",
            "simda",
            "kraken",
            "betabot",
            "zeus",
            "ramnit",
            "plasma",
            "citadel",
            "athena",
            "neutrino",
            "alina",
            "andromeda",
            "dexter",
            "unknown",
            "keylogger",
            "hawkeye",
            "phase",
            "jackpos",
            "spyeye",
            "vskimmer",
            "spitmo",
            "slingshot",
            "warbot",
            "redline stealer",
            "steam",
            "bandoo",
            "matsnu",
            "maltiverse",
            "bambernek gen",
            "internet storm",
            "infy",
            "inmortal",
            "addtopayload",
            "attack",
            "malvertizing"
          ],
          "references": [
            "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
            "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
            "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad",
            "http://dev.findatoyota.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "SpyEye",
              "display_name": "SpyEye",
              "target": null
            },
            {
              "id": "Citadel",
              "display_name": "Citadel",
              "target": null
            },
            {
              "id": "MilesMX",
              "display_name": "MilesMX",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 81,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2450,
            "FileHash-SHA256": 2684,
            "domain": 1254,
            "URL": 9244,
            "CVE": 13,
            "FileHash-MD5": 931,
            "FileHash-SHA1": 487
          },
          "indicator_count": 17063,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "891 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "https://httpdev.findatoyota.com",
        "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
        "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
        "http://dev.findatoyota.com/",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
        "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
        "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
        "deviceinbox.com",
        "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
        "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "ww1.imobitracking.net",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "Trojan:Win32/WannaCry.350",
        "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
        "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
        "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "t.prototype.hasownproperty.call",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
        "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "signin-appleid.jackpotiot.com",
        "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
        "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
        "https://www.anyxxxtube.net/media/favicon/apple",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
        "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
        "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
        "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
        "114.114.114.114",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
        "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
        "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
        "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "angebot.staude.de",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "CS IDS rule: (port_scan) TCP filtered portsweep"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Domains",
            "Trojanspy",
            "Win32.renos/artro",
            "Milesmx",
            "Alf:heraklezeval:trojan:win32/neurevt",
            "Alf:trojandownloader:win32/vadokrist.a",
            "Worm.bagle-44",
            "Opencandy",
            "Vawtrak",
            "Spyeye",
            "Other:malware-gen\\ [trj]",
            "Artro",
            "Citadel",
            "Xrat",
            "Win.trojan.generic-9897526-0",
            "Hacktool",
            "Private internet access",
            "Tofsee",
            "Win32:crypterx-gen\\ [trj]",
            "Bandoo",
            "Suppobox",
            "Win.trojan.knigsfot-125",
            "Formbook",
            "I-worm/bagle.qe",
            "Tulach malware",
            "Trojandropper:win32/ponmocup",
            "Inmortal",
            "Virut",
            "Remcos",
            "Win.trojan.generic-9957168-0",
            "Tiggre",
            "Win.adware.relevantknowledge-9821121-0",
            "Trojanspy:win32/nivdort.de",
            "Trojan:win32/wannacry.350",
            "Generic",
            "Webtoolbar"
          ],
          "industries": [],
          "unique_indicators": 58688
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ploooop.com",
    "whois": "http://whois.domaintools.com/ploooop.com",
    "domain": "ploooop.com",
    "hostname": "images.ploooop.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "65eff46bdd371899ca5be7d7",
      "name": "CrypterX-gen | Video-lal.com | M. Brian Sabey \u2022 Hall Render | Rexxfield",
      "description": "Videolal results. Parked. Owner of domain has subsidiaries including Huge Domains. It's possible for attacker to post a 404 error page,  park, post it for sale, malvertize. HoneyPotBot? \n\nFireeye. A bit much. william.ballenthin@fireeye.com\t\ncontain a resource (.rsrc) section moritz.raabe@fireeye.com. Overkill. What would Scooby Doo? Scooby!? \nTarget reports opening her MacBook Pro after it was replaced by Apple. It hadn't been in use. She opened it, surprised it was on, automatically connected to a store wifi (she was home) A worker was typing away in terminal. Fought hacker for recordings app containing Jeffrey Reimers aggressions. She lost. Terrified she murdered her MacBook by drowning  & dismemberment. Big mistake. Cloned MacBook.  Clicked on links trigger malicious downloads, network & DNS issues.",
      "modified": "2024-04-11T04:01:24.166000",
      "created": "2024-03-12T06:21:31.484000",
      "tags": [
        "upatre malware",
        "rwi dtools",
        "page dow",
        "security",
        "bitfender",
        "yandex",
        "malware",
        "all octoseek",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "file score",
        "fireeye",
        "injection",
        "worm",
        "trojan",
        "network",
        "poster",
        "honeybots",
        "united",
        "unknown",
        "win32upatre mar",
        "passive dns",
        "entries",
        "ipv4",
        "body",
        "artro",
        "generic malware",
        "formbook",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "generic",
        "hostnames",
        "pattern match",
        "ascii text",
        "png image",
        "root ca",
        "file",
        "authority",
        "indicator",
        "mitre att",
        "ck id",
        "class",
        "date",
        "enterprise",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "trident",
        "as47846",
        "germany unknown",
        "as2906 netflix",
        "scan endpoints",
        "domain",
        "urls",
        "files",
        "trojanspy",
        "mozilla",
        "dynamicloader",
        "medium",
        "title",
        "ms windows",
        "head",
        "intel",
        "inetsim http",
        "delete c",
        "show",
        "winnt",
        "copy",
        "powershell",
        "write",
        "next",
        "suspicious",
        "shop",
        "graph api",
        "status",
        "join",
        "vt community",
        "api key",
        "xcitium verdict",
        "cloud",
        "contacted",
        "contacted urls",
        "ssl certificate",
        "referrer",
        "historical ssl",
        "parent domain",
        "apple ios",
        "resolutions",
        "execution",
        "hacktool",
        "outbound connection",
        "detection list",
        "blacklist"
      ],
      "references": [
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/ \u2022",
        "http://systemforex.de/search/redirect.php?f= | http://it.marksypark.com | dont-delete.hugedomains.com | http://selfsparkcentral.com",
        "william.ballenthin@fireeye.com contain a resource (.rsrc) section\tmoritz.raabe@fireeye.com | Pattern match: \"jloup@gzip.org\" & \"fancybox@3.5.7\"",
        "FormBook: 104.247.81.53 \u2022 http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-MD5   6878e9896fdd84dcc11c997c9b7330ba",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA1   2e586f8db46953532b5e25e07add4dbaeea83a79",
        "Win32:CrypterX-gen\\ [Trj] | FileHash-SHA256  00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad",
        "Win32/Renos: https://otx.alienvault.com/malware/ALF:JASYP:TrojanDownloader:Win32%2FRenos/",
        "Other:Malware-gen\\ [Trj] | FileHash-MD5 b5168dab50187b33460201b35b96dea7",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA1 68868b3d0115e3d06f5fddb9d2ea6ad54270166c",
        "Other:Malware-gen\\ [Trj] | FileHash-SHA256 0000ba467dd40046e240c11251d9db03636d0e7c6f9f96354a46a441c2003143",
        "allocates_execute_remote_process \u2022 injection_write_memory \u2022 injection_resumethread \u2022 packer_entropy \u2022 network _icmp \u2022 injection_runpe",
        "injection_write_memory_exe \u2022 injection_ntsetcontextthread \u2022 dumped_buffer \u2022 checks_debugger \u2022 generates_crypto_key  \u2022 antivm_memory_available",
        "CnC IP Addresses: 104.247.81.53 \u2022 185.64.219.6 \u2022 199.191.50.82 \u2022 203.107.45.167 \u2022 91.195.240.94 \u2022 167.235.143.33",
        "AA47 More AV Detection Ratio 984  / 1000 IDS Detections Win32.Renos/ArtroMALWARETrojan Checkin M1 Possible Fake AV Checkin Fakealert. AA47 More AV Detection Ratio 984  / 1000 IDS Detections /Trojan Checkin M1 Possible Fake AV Checkin Fakealert.",
        "Videolal: 18.119.154.66:80 (endpoint request) \u2022 54.209.32.212 \u2022 http://videolal.com (phishing) \u2022 http://videolal.com/ \u2022 videolal.com \u2022 www.videolal.com \u2022",
        "www.videolal.com \u2022 httpvideolal.com \u2022 https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct.html",
        "https://www.hugedomains.com/domain_profile.cfm?d=videolal.com \u2022 https://www.hugedomains.com/domain_profile.cfm?d=videolal.com\"",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html \u2022",
        "https://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-sexual-misconduct-miscinception.html",
        "https://videolal.com/videos/tsara-brashears-assaulted-by-jeffrey-reimer-metlife-login-retirement.html \u2022 https://videolal.com/css/js/jquery-ui.min.js",
        "https://videolal.com/videos/tsara-brashears-dead-by-daylight.html \u2022 https://videolal.com/css/jquery-ui.css \u2022 http://videolal.com/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-dead.html \u2022 http://videolal.com/tsara-brashears.html \u2022 http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/videos/jeffrey-reimer-dpt-assaulted-tsara-brashears-massage-misconduct-miscinception.html",
        "http://videolal.com/jeffrey-reimer-dpt-sexual-misconduct.html \u2022 http://videolal.com/tsara-brashears.html",
        "http://videolal.com/tsara-brashears-dead-or-alive-song-rap.html \u2022 http://videolal.com/the-man-who-built-america-1.html",
        "http://videolal.com/the-man-who-built-america-1.html \u2022 http://videolal.com/pinnacol-assurance-assaulted-by-jeffrey-",
        "http://videolal.com/jeffrey-reimer-dpt-physical-therapy-assaulted-patient.html \u2022 http://videolal.com/jeff-reimer-",
        "http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html \u2022",
        "http://videolal.com/jeff-reimer-dpt-buys-assault-victims-silence.html \u2022 http://videolal.com/jeffrey-reimer-dpt-assaulted-tsara-brashears-denver.html",
        "https://otx.alienvault.com/otxapi/indicators/file/screenshot/4998a7eac2a056833d01ee1e60c68c1f83f9ad6cd790ced9511e73cc12780f3c",
        "https://otx.alienvault.com/malware/Trojan:Win32%2FCrypterX/",
        "\u2192https://otx.alienvault.com/pulse/65eedf74b7bdda41057bef3e",
        "\u2192https://otx.alienvault.com/pulse/65ef3723d27863fc33a6b671",
        "\u2192https://otx.alienvault.com/pulse/65e85fd4842119fff4e327cf",
        "\u2192https://otx.alienvault.com/pulse/65e843669f4ba77affa4b297"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win32:CrypterX-gen\\ [Trj]",
          "display_name": "Win32:CrypterX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Other:Malware-gen\\ [Trj]",
          "display_name": "Other:Malware-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Win32.Renos/Artro",
          "display_name": "Win32.Renos/Artro",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "I-Worm/Bagle.QE",
          "display_name": "I-Worm/Bagle.QE",
          "target": null
        },
        {
          "id": "Worm.Bagle-44",
          "display_name": "Worm.Bagle-44",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.DE",
          "display_name": "TrojanSpy:Win32/Nivdort.DE",
          "target": "/malware/TrojanSpy:Win32/Nivdort.DE"
        },
        {
          "id": "Win.Trojan.Generic-9897526-0",
          "display_name": "Win.Trojan.Generic-9897526-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Knigsfot-125",
          "display_name": "Win.Trojan.Knigsfot-125",
          "target": null
        },
        {
          "id": "ALF:TrojanDownloader:Win32/Vadokrist.A",
          "display_name": "ALF:TrojanDownloader:Win32/Vadokrist.A",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-9957168-0",
          "display_name": "Win.Trojan.Generic-9957168-0",
          "target": null
        },
        {
          "id": "Win.Adware.RelevantKnowledge-9821121-0",
          "display_name": "Win.Adware.RelevantKnowledge-9821121-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Neurevt",
          "target": null
        },
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1622,
        "FileHash-SHA1": 934,
        "FileHash-SHA256": 3289,
        "URL": 9605,
        "domain": 2321,
        "hostname": 2411,
        "CVE": 1,
        "email": 3
      },
      "indicator_count": 20186,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "783 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65618963e4e45d0c53f8e770",
      "name": "ww1.imobitracking.net",
      "description": "critical, cronup threat, cyber threat, data, serious, tracking, emails collection, relay router , emotet, exploit, content reputation.\n\nSerious tracking efforts, malicious.",
      "modified": "2023-12-25T03:01:27.395000",
      "created": "2023-11-25T05:42:59.043000",
      "tags": [
        "creation date",
        "search",
        "passive dns",
        "urls",
        "address",
        "record value",
        "emails",
        "date",
        "showing",
        "body",
        "unknown",
        "cowboy",
        "encrypt",
        "resolver ip",
        "whois lookups",
        "server",
        "iana id",
        "registrar abuse",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "registrar",
        "first",
        "dns replication",
        "algorithm",
        "key usage",
        "google",
        "record type",
        "ttl value",
        "cname",
        "data",
        "v3 serial",
        "contacted",
        "ssl certificate",
        "threat roundup",
        "march",
        "august",
        "referrer",
        "whois record",
        "communicating",
        "june",
        "april",
        "copy",
        "february",
        "cobalt strike",
        "remcos",
        "emotet",
        "core",
        "noname057",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware site",
        "phishing site",
        "malicious site",
        "malware",
        "internet storm",
        "united",
        "cyber threat",
        "heur",
        "malicious url",
        "mail spammer",
        "suppobox",
        "bambernek",
        "cronup threat",
        "team",
        "facebook",
        "malicious",
        "phishing",
        "download",
        "virut",
        "unruy",
        "bandoo",
        "matsnu",
        "tofsee",
        "simda",
        "vawtrak",
        "hotmail",
        "qakbot",
        "asyncrat",
        "tsara brashears",
        "no data",
        "count blacklist",
        "tag tag",
        "pattern match",
        "ascii text",
        "file",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "appdata",
        "path",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "tor known",
        "tor relayrouter",
        "node tcp",
        "traffic",
        "host",
        "cins active",
        "poor reputation",
        "spammer",
        "barracuda et",
        "artemis",
        "iframe",
        "cleaner",
        "unsafe",
        "riskware",
        "agent",
        "wacatac",
        "bank",
        "opencandy",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "presenoker",
        "filetour",
        "conduit",
        "xtrat",
        "azorult",
        "service",
        "runescape",
        "acint",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "exploit",
        "xrat",
        "installcore",
        "patcher",
        "adload",
        "win64",
        "softcnapp",
        "union",
        "ponmocup",
        "fusioncore",
        "trojanspy",
        "webtoolbar",
        "maltiverse",
        "114.114.114.114",
        "tulach",
        "tracking",
        "apple",
        "illegal",
        "target",
        "c2",
        "cnc",
        "scanning_host",
        "CVE-2011-0611",
        "CVE-2017-0147",
        "CVE-2014-3153",
        "CVE-2016-0189",
        "CVE-2017-0199",
        "CVE-2017-8570",
        "CVE-2017-11882",
        "CVE-2018-4893",
        "CVE-2018-8174",
        "CVE-2020-0601",
        "CVE-2023-22518"
      ],
      "references": [
        "ww1.imobitracking.net",
        "https://www.hybrid-analysis.com/sample/dcf9f5e78d4645b38540d25c4d8ca7fe3e019671caadf7cade4cc01008282bff",
        "114.114.114.114",
        "signin-appleid.jackpotiot.com",
        "https://www.anyxxxtube.net/media/favicon/apple",
        "http://manage.apple.com.webobjectsd5dbc98dcc983a7028bd82d1a47540.dsiblings.com/Info/information.html",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://httpdev.findatoyota.com",
        "https://secure.medicalexpo.com/request-management-ws/views/contact-details.xhtml?token=A3QIgyaKRur%2BIjZfA4R8MkKBwXLdgMI5Gg%2F0dwmuMj0",
        "t.prototype.hasownproperty.call",
        "https://www.assurant.com/?utm_source=email&utm_medium=email&utm_campaign=Mobile_Transactional_withad&utm_content=Deductible+Charge+Acknowledgement+PD-MB&utm_term=",
        "http://trkr.similarphotocleaner.com/trackerwcfsrv/tracker.svc/trackoffersview/?q=pxl=mco2191_mco2146_mco1132&utm_source=mcosfl&utm_medium=mcosfl&utm_campaign=mcosfl&x-count=1&x-context=osversion-5.1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Private Internet Access",
          "display_name": "Private Internet Access",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "XRat",
          "display_name": "XRat",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "Bandoo",
          "display_name": "Bandoo",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "Remcos",
          "display_name": "Remcos",
          "target": null
        },
        {
          "id": "Vawtrak",
          "display_name": "Vawtrak",
          "target": null
        },
        {
          "id": "Tiggre",
          "display_name": "Tiggre",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Ponmocup",
          "display_name": "TrojanDropper:Win32/Ponmocup",
          "target": "/malware/TrojanDropper:Win32/Ponmocup"
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1569,
        "FileHash-MD5": 489,
        "URL": 7420,
        "domain": 917,
        "FileHash-SHA1": 247,
        "email": 3,
        "FileHash-SHA256": 2578,
        "CVE": 11
      },
      "indicator_count": 13234,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "891 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6561581c55aacc7f571968af",
      "name": "Mirai | Inmortal | Loki | SpyEye",
      "description": "attack, cyber threat, network, vehicle tracking, cnc, athena cyber stalking, betabot, social engineering, Cisco umbrella, bambernek simda, active threat, ongoing spreader, spyware, redline stealer, qakbot, anilise, milemighmedia, sweetheart videos botnetwork, targeting ,  redirects, network, targeted toyota tracking",
      "modified": "2023-12-25T01:00:05.300000",
      "created": "2023-11-25T02:12:44.278000",
      "tags": [
        "replication",
        "date",
        "graph summary",
        "ssl certificate",
        "contacted",
        "whois record",
        "historical ssl",
        "threat roundup",
        "august",
        "tsara brashears",
        "whois whois",
        "execution",
        "dropped",
        "february",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "team",
        "malicious site",
        "malware",
        "phishing",
        "union",
        "bank",
        "unsafe",
        "united",
        "bambernek simda",
        "commerce",
        "pykspa",
        "bambernek",
        "ip reputation",
        "database",
        "vawtrak",
        "blacklist http",
        "search live",
        "api blog",
        "docs pricing",
        "login",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "reverse dns",
        "software",
        "general full",
        "resource",
        "hash",
        "get h2",
        "protocol h2",
        "security tls",
        "url http",
        "main",
        "attention",
        "please",
        "adblock pro",
        "loki",
        "mon jul",
        "first",
        "linkid252669",
        "pjp3sltkz",
        "heur",
        "malware site",
        "phishing site",
        "artemis",
        "iframe",
        "riskware",
        "exploit",
        "fakealert",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "filetour",
        "cleaner",
        "wacatac",
        "xtrat",
        "genkryptik",
        "opencandy",
        "tiggre",
        "presenoker",
        "agent",
        "conduit",
        "xrat",
        "coinminer",
        "dropper",
        "alexa",
        "acint",
        "systweak",
        "behav",
        "download",
        "zbot",
        "xtreme",
        "installcore",
        "unruy",
        "patcher",
        "adload",
        "win64",
        "applicunwnt",
        "trojanspy",
        "webtoolbar",
        "cyber threat",
        "engineering",
        "firehol",
        "phishtank",
        "emotet",
        "ransomware",
        "malicious",
        "cobalt strike",
        "suppobox",
        "bradesco",
        "facebook",
        "banco",
        "nymaim",
        "smsspy",
        "stealer",
        "service",
        "mirai",
        "pony",
        "nanocore",
        "asyncrat",
        "downloader",
        "deepscan",
        "virut",
        "qakbot",
        "name verdict",
        "falcon sandbox",
        "blacklist https",
        "malicious url",
        "filerepmetagen",
        "et cins",
        "active threat",
        "reputation ip",
        "threats et",
        "cins active",
        "poor reputation",
        "ip tcp",
        "C2",
        "command_and_control",
        "spyware",
        "tracking",
        "targeting",
        "cyber stalking",
        "hostname",
        "simda",
        "kraken",
        "betabot",
        "zeus",
        "ramnit",
        "plasma",
        "citadel",
        "athena",
        "neutrino",
        "alina",
        "andromeda",
        "dexter",
        "unknown",
        "keylogger",
        "hawkeye",
        "phase",
        "jackpos",
        "spyeye",
        "vskimmer",
        "spitmo",
        "slingshot",
        "warbot",
        "redline stealer",
        "steam",
        "bandoo",
        "matsnu",
        "maltiverse",
        "bambernek gen",
        "internet storm",
        "infy",
        "inmortal",
        "addtopayload",
        "attack",
        "malvertizing"
      ],
      "references": [
        "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
        "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
        "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad",
        "http://dev.findatoyota.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "SpyEye",
          "display_name": "SpyEye",
          "target": null
        },
        {
          "id": "Citadel",
          "display_name": "Citadel",
          "target": null
        },
        {
          "id": "MilesMX",
          "display_name": "MilesMX",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 81,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2450,
        "FileHash-SHA256": 2684,
        "domain": 1254,
        "URL": 9244,
        "CVE": 13,
        "FileHash-MD5": 931,
        "FileHash-SHA1": 487
      },
      "indicator_count": 17063,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "891 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://images.ploooop.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://images.ploooop.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780498843.788069
}