{
  "type": "URL",
  "indicator": "https://investor.j2global.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://investor.j2global.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3815587995,
      "indicator": "https://investor.j2global.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6671e5844c155814e69ba4dd",
          "name": "Mirai Botnet Injection  affecting Alienvault.",
          "description": "It's unclear if some users or service itself is injecting users or if service is under a Mirai attack. I found evidence of both outbound & inbound activities.  *Crowdsourced context: Activity related to MIRAI - according to source Cluster25 - \nThis IPV4 is used by MIRAI. Mirai is a malware that created a big botnet of networked devices running Linux making them remotely controlled bots that can be used for large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers.\n#zbetcheckin tracker\nDownloaded on 2023-11-07 19:34:59 UTC\nSRC URL : http://171.228.209.167/x86_64\nIP : 171.228.209.167\nAS : AS7552 Viettel Group\nYARA : #contentis_base64 #debuggerpattern__rdtsc #ip #math_entropy_6 #is__elf #http #ft_elf #executable_elf64",
          "modified": "2024-07-18T19:02:50.386000",
          "created": "2024-06-18T19:52:36.849000",
          "tags": [
            "problems",
            "threat network",
            "infrastructure",
            "historical ssl",
            "microsoft stuff",
            "domain check",
            "referrer",
            "generic malware",
            "injector",
            "no data",
            "tag count",
            "fri mar",
            "analyzer threat",
            "ip summary",
            "url summary",
            "summary",
            "downloader",
            "generic",
            "united",
            "as14315",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "america asn",
            "unknown",
            "ransom",
            "body",
            "coinminer",
            "malware generic",
            "wed jan",
            "first",
            "status",
            "creation date",
            "search",
            "date",
            "expiration date",
            "name servers",
            "next",
            "mirai",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "reverse dns",
            "location lao",
            "viet nam",
            "domain",
            "all search",
            "otx scoreblue",
            "hostname",
            "files ip",
            "lazarus",
            "as7552 viettel",
            "vietnam unknown",
            "win32",
            "worm",
            "win32sfone jul",
            "vietnam",
            "etag",
            "telecom",
            "as16625 akamai",
            "as20940",
            "germany",
            "united kingdom",
            "singapore",
            "as20546 soprado",
            "hong kong",
            "as45102 alibaba",
            "taobao network",
            "cname",
            "aaaa",
            "entries",
            "showing",
            "a domains",
            "as38731 vietel",
            "plesk",
            "a li",
            "default page",
            "plesk a",
            "mirai variant",
            "useragent",
            "apache",
            "accept",
            "hello",
            "create c",
            "read c",
            "delete",
            "write",
            "default",
            "create",
            "show",
            "medium",
            "dock",
            "execution",
            "copy",
            "xport",
            "address",
            "as131392",
            "cape",
            "orsam",
            "malware",
            "script urls",
            "moved",
            "record value",
            "cisco umbrella",
            "site",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "malicious site",
            "phishing site",
            "malicious url",
            "opencandy",
            "exploit",
            "agent",
            "phishing",
            "acint",
            "iframe",
            "crack",
            "conduit",
            "artemis",
            "riskware",
            "mimikatz",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "tiggre",
            "genkryptik",
            "presenoker",
            "filetour",
            "cleaner",
            "wacatac",
            "outbreak",
            "installcore",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "related pulses",
            "whois",
            "related",
            "msil",
            "zombie",
            "dridex",
            "location viet",
            "pulse submit",
            "url analysis",
            "content",
            "google tag",
            "utc gcfezl5ynvb",
            "utc na",
            "utc google",
            "analytics na",
            "utc linkedin",
            "insight tag",
            "deep malware",
            "iframes",
            "trackers",
            "external-resources",
            "text/html",
            "elf info",
            "header class",
            "elf64 data",
            "header version",
            "os abi",
            "unix",
            "v object",
            "file type",
            "exec",
            "executable file",
            "progbits",
            "type address",
            "offset size",
            "flags",
            "null",
            "nobits",
            "strtab",
            "ip detections",
            "country",
            "us bundled",
            "detections file",
            "name",
            "graph summary",
            "get hello",
            "jaws webserver",
            "outbound",
            "mvpower dvr",
            "shell uce",
            "inbound",
            "activity mirai",
            "mirai",
            "info",
            "performs dns",
            "mitre att",
            "access ta0006",
            "os credential",
            "dumping t1003",
            "enumerates",
            "command",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "relacionada",
            "mirai malware",
            "mirai 04022024",
            "nciipc",
            "ip reputaion",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "china as37963",
            "simplified",
            "trojanspy",
            "virustotal",
            "panda",
            "detections type",
            "shell",
            "javascript",
            "dns replication",
            "files referring",
            "lookups",
            "as7552",
            "vhash",
            "ssdeep",
            "magic elf",
            "sysv",
            "trid elf",
            "executable",
            "linux",
            "elf executable",
            "loccel1",
            "echobot",
            "bashlite",
            "malwarebazaar",
            "echobot malware",
            "win32 exe",
            "magic msdos",
            "pe32 executable",
            "intel",
            "ms windows",
            "trid dos",
            "compiler",
            "delphi",
            "serial number",
            "algorithm",
            "thumbprint",
            "valid from",
            "code signing",
            "from",
            "microsoft root",
            "name microsoft",
            "verisign time",
            "stamping",
            "contained",
            "info sections",
            "name virtual",
            "address virtual",
            "size raw",
            "size entropy",
            "md5 chi2",
            "regsetvalueexa",
            "type rtrcdata",
            "sha256 file",
            "threat roundup",
            "october",
            "august",
            "june",
            "september",
            "highly targeted",
            "cyberstalking",
            "round",
            "december",
            "sneaky server",
            "facebook",
            "stealer",
            "agent tesla",
            "pony",
            "april",
            "whitelisted",
            "encrypt",
            "targeting",
            "tsara brashears",
            "otx",
            "alienvault",
            "memcommit",
            "regsz",
            "regopenkeyexw",
            "english",
            "module load",
            "t1129",
            "t1082",
            "windows module",
            "dlls",
            "redline stealer",
            "updater",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "data redacted",
            "cloudflare",
            "redacted",
            "for privacy",
            "code",
            "server",
            "registrar abuse",
            "redacted for",
            "postal code",
            "registrant name",
            "red team",
            "shit",
            "logistics",
            "cyber defense",
            "gootloader",
            "march",
            "sinkhole",
            "just",
            "ramnit",
            "netsupport rat",
            "microsoft",
            "vault",
            "karen",
            "gifts",
            "hidden privacy",
            "threats",
            "malicious",
            "darkgate",
            "core",
            "hacktool",
            "emotet"
          ],
          "references": [
            "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
            "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
            "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
            "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
            "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
            "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
            "https://otx.alienvault.com/indicator/domain/bunny.net",
            "https://otx.alienvault.com/indicator/ip/210.211.117.205",
            "https://otx.alienvault.com/indicator/ip/143.244.50.212",
            "https://otx.alienvault.com/indicator/ip/125.235.4.59",
            "AV Detection: ELF:Mirai-GH\\ [Trj]",
            "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
            "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
            "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
            "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
            "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
            "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
            "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
            "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
            "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
            "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
            "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
            "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
            "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com",
            "Was anyone else notified? I'm not sure why I was.",
            "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
            "CS Sigma: Matches rule Python Initiated Connection by frack113"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Unix.Trojan.Mirai-9441505-0",
              "display_name": "Unix.Trojan.Mirai-9441505-0",
              "target": null
            },
            {
              "id": "ALF:E5.SpikeAex.rhh_mcv",
              "display_name": "ALF:E5.SpikeAex.rhh_mcv",
              "target": null
            },
            {
              "id": "Win.Dropper.Bulz-9910065-0",
              "display_name": "Win.Dropper.Bulz-9910065-0",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "Win.Dropper.Autoit-6688751-0",
              "display_name": "Win.Dropper.Autoit-6688751-0",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Dropper.Dridex-9986041-0",
              "display_name": "Win.Dropper.Dridex-9986041-0",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Zombie",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Zombie",
              "target": null
            },
            {
              "id": "Win.Packer.pkr_ce1a-9980177-0",
              "display_name": "Win.Packer.pkr_ce1a-9980177-0",
              "target": null
            },
            {
              "id": "Worm:Win32/Sfone.A",
              "display_name": "Worm:Win32/Sfone.A",
              "target": "/malware/Worm:Win32/Sfone.A"
            },
            {
              "id": "Worm:Win32/Sfone",
              "display_name": "Worm:Win32/Sfone",
              "target": "/malware/Worm:Win32/Sfone"
            },
            {
              "id": "Win.Malware.Bbabdcdc-7358312-0",
              "display_name": "Win.Malware.Bbabdcdc-7358312-0",
              "target": null
            },
            {
              "id": "Win32:Trojan-gen",
              "display_name": "Win32:Trojan-gen",
              "target": null
            },
            {
              "id": "trojan.mirai/fszhh",
              "display_name": "trojan.mirai/fszhh",
              "target": null
            },
            {
              "id": "DDOS:Linux/Mirai",
              "display_name": "DDOS:Linux/Mirai",
              "target": "/malware/DDOS:Linux/Mirai"
            },
            {
              "id": "ANDROID/AVE.Mirai.fszhh",
              "display_name": "ANDROID/AVE.Mirai.fszhh",
              "target": null
            },
            {
              "id": "Flyagent L",
              "display_name": "Flyagent L",
              "target": null
            },
            {
              "id": "Win-Trojan/Malpacked5.Gen",
              "display_name": "Win-Trojan/Malpacked5.Gen",
              "target": null
            },
            {
              "id": "Atros3.LDJ",
              "display_name": "Atros3.LDJ",
              "target": null
            },
            {
              "id": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
              "display_name": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Gucotut.A",
              "display_name": "TrojanSpy:Win32/Gucotut.A",
              "target": "/malware/TrojanSpy:Win32/Gucotut.A"
            },
            {
              "id": "W32/Pidgeon-A",
              "display_name": "W32/Pidgeon-A",
              "target": null
            },
            {
              "id": "Variant.Zusy.151902",
              "display_name": "Variant.Zusy.151902",
              "target": null
            },
            {
              "id": "trojan.mirai/fedr",
              "display_name": "trojan.mirai/fedr",
              "target": null
            },
            {
              "id": "Win.Malware.Trojanx-9862538-0",
              "display_name": "Win.Malware.Trojanx-9862538-0",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen\\ [Trj]",
              "display_name": "Win32:PWSX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "virus.ramnit/nimnul",
              "display_name": "virus.ramnit/nimnul",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 351,
            "FileHash-SHA1": 349,
            "FileHash-SHA256": 3715,
            "domain": 3326,
            "hostname": 5200,
            "URL": 13151,
            "email": 9,
            "CVE": 7,
            "CIDR": 2
          },
          "indicator_count": 26110,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 243,
          "modified_text": "640 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658f967a4fc7ebe8021b9382",
          "name": "Mirai Apple Attack +",
          "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-30T04:03:06.598000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659127f3265ec6306b607faa",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2023-12-31T08:36:03.380000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 30,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65944b9812ea52ab41c0259d",
          "name": "Mirai Apple Attack +",
          "description": "",
          "modified": "2024-01-29T03:01:29.910000",
          "created": "2024-01-02T17:44:56.709000",
          "tags": [
            "whois record",
            "ssl certificate",
            "contacted",
            "whois whois",
            "historical ssl",
            "referrer",
            "communicating",
            "resolutions",
            "apple",
            "collections",
            "core",
            "stealer",
            "execution",
            "ratel",
            "suspicious",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls https",
            "windir",
            "json data",
            "localappdata",
            "ascii text",
            "unicode text",
            "pattern match",
            "file",
            "indicator",
            "mitre att",
            "path",
            "factory",
            "hybrid",
            "general",
            "memcommit",
            "regsetvalueexa",
            "regdword",
            "t1055",
            "high",
            "regbinary",
            "dynamic dns",
            "regsetvalueexw",
            "regsz",
            "medium",
            "win32",
            "malware",
            "copy",
            "capture",
            "name servers",
            "creation date",
            "servers",
            "passive dns",
            "urls",
            "domain",
            "search",
            "expiration date",
            "scan endpoints",
            "all scoreblue",
            "date",
            "next",
            "applenoc",
            "showing",
            "status",
            "united",
            "as44273 host",
            "unknown",
            "all search",
            "otx scoreblue",
            "aaaa",
            "as54113",
            "privacy inc",
            "customer",
            "asnone united",
            "entries",
            "pulse pulses",
            "dga",
            "redacted for",
            "as20940",
            "body",
            "for privacy",
            "ipv4",
            "files",
            "location united",
            "america asn",
            "as54252",
            "type name",
            "dns replication",
            "iana",
            "whois lookup",
            "ipv4 address",
            "ripe ncc",
            "afrinic",
            "africa",
            "apnic",
            "asia pacific",
            "arin",
            "lacnic",
            "elf executable",
            "sysv",
            "linux",
            "elf wgetboat",
            "contacted urls",
            "red team",
            "tsara brashears",
            "apple phone",
            "unlocker",
            "fakedout threat",
            "hostname",
            "samples",
            "mirai",
            "ph elf",
            "telefonica de",
            "elf collection",
            "llwn",
            "text",
            "gp practice",
            "oracle",
            "apple ios",
            "password",
            "threat network",
            "kgs0",
            "kls0",
            "hacktool",
            "probe",
            "malicious"
          ],
          "references": [
            "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
            "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
            "https://twitter.com/PORNO_SEXYBABES",
            "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
            "103.246.145.111 phishing",
            "nr-data.net | Apple Private Data collection",
            "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
            "00000000.apple.com  | remote SIM Swap",
            "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
            "103.246.145.111  - scanning host",
            "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
            "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
            "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
            "usw2-platform-dmchat-avengers-prod-ext.apple.com",
            "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
            "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "RATel",
              "display_name": "RATel",
              "target": null
            },
            {
              "id": "trojan.mirai/genericrxui",
              "display_name": "trojan.mirai/genericrxui",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658f967a4fc7ebe8021b9382",
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 578,
            "FileHash-SHA1": 521,
            "FileHash-SHA256": 6392,
            "URL": 5741,
            "domain": 2243,
            "hostname": 1536,
            "SSLCertFingerprint": 2,
            "email": 8,
            "CVE": 1
          },
          "indicator_count": 17022,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "811 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
        "nr-data.net | Apple Private Data collection",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
        "103.246.145.111  - scanning host",
        "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
        "00000000.apple.com  | remote SIM Swap",
        "wallpapers-nature.com",
        "https://otx.alienvault.com/indicator/ip/210.211.117.205",
        "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "Was anyone else notified? I'm not sure why I was.",
        "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "https://otx.alienvault.com/indicator/domain/bunny.net",
        "https://otx.alienvault.com/indicator/ip/143.244.50.212",
        "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
        "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "AV Detection: ELF:Mirai-GH\\ [Trj]",
        "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
        "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
        "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
        "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
        "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
        "CS Sigma: Matches rule Python Initiated Connection by frack113",
        "https://twitter.com/PORNO_SEXYBABES",
        "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
        "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
        "https://otx.alienvault.com/indicator/ip/125.235.4.59",
        "103.246.145.111 phishing",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Ratel",
            "Trojan.mirai/fszhh",
            "Generic",
            "Worm:win32/sfone",
            "Unix.trojan.mirai-9441505-0",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Win32:pwsx-gen\\ [trj]",
            "A variant of win32/flystudio.packed.ad potentially unwanted",
            "Elf:mirai-gh\\ [trj]",
            "Win.packer.pkr_ce1a-9980177-0",
            "Ddos:linux/mirai",
            "Alf:heraklezeval:trojan:win32/zombie",
            "Trojanspy:win32/gucotut.a",
            "Alf:e5.spikeaex.rhh_mcv",
            "Variant.zusy.151902",
            "Win.malware.trojanx-9862538-0",
            "Atros3.ldj",
            "Win.dropper.autoit-6688751-0",
            "Virus.ramnit/nimnul",
            "Win.dropper.dridex-9986041-0",
            "Win.dropper.bulz-9910065-0",
            "Android/ave.mirai.fszhh",
            "Worm:win32/sfone.a",
            "Win32:malware-gen",
            "Win-trojan/malpacked5.gen",
            "Win32:trojan-gen",
            "W32/pidgeon-a",
            "Trojan.mirai/fedr",
            "Flyagent l",
            "Win.malware.bbabdcdc-7358312-0",
            "Trojan.mirai/genericrxui"
          ],
          "industries": [],
          "unique_indicators": 44729
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/j2global.com",
    "whois": "http://whois.domaintools.com/j2global.com",
    "domain": "j2global.com",
    "hostname": "investor.j2global.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6671e5844c155814e69ba4dd",
      "name": "Mirai Botnet Injection  affecting Alienvault.",
      "description": "It's unclear if some users or service itself is injecting users or if service is under a Mirai attack. I found evidence of both outbound & inbound activities.  *Crowdsourced context: Activity related to MIRAI - according to source Cluster25 - \nThis IPV4 is used by MIRAI. Mirai is a malware that created a big botnet of networked devices running Linux making them remotely controlled bots that can be used for large-scale network attacks. It primarily targets online consumer devices such as IP cameras and home routers.\n#zbetcheckin tracker\nDownloaded on 2023-11-07 19:34:59 UTC\nSRC URL : http://171.228.209.167/x86_64\nIP : 171.228.209.167\nAS : AS7552 Viettel Group\nYARA : #contentis_base64 #debuggerpattern__rdtsc #ip #math_entropy_6 #is__elf #http #ft_elf #executable_elf64",
      "modified": "2024-07-18T19:02:50.386000",
      "created": "2024-06-18T19:52:36.849000",
      "tags": [
        "problems",
        "threat network",
        "infrastructure",
        "historical ssl",
        "microsoft stuff",
        "domain check",
        "referrer",
        "generic malware",
        "injector",
        "no data",
        "tag count",
        "fri mar",
        "analyzer threat",
        "ip summary",
        "url summary",
        "summary",
        "downloader",
        "generic",
        "united",
        "as14315",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "america asn",
        "unknown",
        "ransom",
        "body",
        "coinminer",
        "malware generic",
        "wed jan",
        "first",
        "status",
        "creation date",
        "search",
        "date",
        "expiration date",
        "name servers",
        "next",
        "mirai",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "reverse dns",
        "location lao",
        "viet nam",
        "domain",
        "all search",
        "otx scoreblue",
        "hostname",
        "files ip",
        "lazarus",
        "as7552 viettel",
        "vietnam unknown",
        "win32",
        "worm",
        "win32sfone jul",
        "vietnam",
        "etag",
        "telecom",
        "as16625 akamai",
        "as20940",
        "germany",
        "united kingdom",
        "singapore",
        "as20546 soprado",
        "hong kong",
        "as45102 alibaba",
        "taobao network",
        "cname",
        "aaaa",
        "entries",
        "showing",
        "a domains",
        "as38731 vietel",
        "plesk",
        "a li",
        "default page",
        "plesk a",
        "mirai variant",
        "useragent",
        "apache",
        "accept",
        "hello",
        "create c",
        "read c",
        "delete",
        "write",
        "default",
        "create",
        "show",
        "medium",
        "dock",
        "execution",
        "copy",
        "xport",
        "address",
        "as131392",
        "cape",
        "orsam",
        "malware",
        "script urls",
        "moved",
        "record value",
        "cisco umbrella",
        "site",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "malicious site",
        "phishing site",
        "malicious url",
        "opencandy",
        "exploit",
        "agent",
        "phishing",
        "acint",
        "iframe",
        "crack",
        "conduit",
        "artemis",
        "riskware",
        "mimikatz",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "tiggre",
        "genkryptik",
        "presenoker",
        "filetour",
        "cleaner",
        "wacatac",
        "outbreak",
        "installcore",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "related pulses",
        "whois",
        "related",
        "msil",
        "zombie",
        "dridex",
        "location viet",
        "pulse submit",
        "url analysis",
        "content",
        "google tag",
        "utc gcfezl5ynvb",
        "utc na",
        "utc google",
        "analytics na",
        "utc linkedin",
        "insight tag",
        "deep malware",
        "iframes",
        "trackers",
        "external-resources",
        "text/html",
        "elf info",
        "header class",
        "elf64 data",
        "header version",
        "os abi",
        "unix",
        "v object",
        "file type",
        "exec",
        "executable file",
        "progbits",
        "type address",
        "offset size",
        "flags",
        "null",
        "nobits",
        "strtab",
        "ip detections",
        "country",
        "us bundled",
        "detections file",
        "name",
        "graph summary",
        "get hello",
        "jaws webserver",
        "outbound",
        "mvpower dvr",
        "shell uce",
        "inbound",
        "activity mirai",
        "mirai",
        "info",
        "performs dns",
        "mitre att",
        "access ta0006",
        "os credential",
        "dumping t1003",
        "enumerates",
        "command",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "relacionada",
        "mirai malware",
        "mirai 04022024",
        "nciipc",
        "ip reputaion",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "china as37963",
        "simplified",
        "trojanspy",
        "virustotal",
        "panda",
        "detections type",
        "shell",
        "javascript",
        "dns replication",
        "files referring",
        "lookups",
        "as7552",
        "vhash",
        "ssdeep",
        "magic elf",
        "sysv",
        "trid elf",
        "executable",
        "linux",
        "elf executable",
        "loccel1",
        "echobot",
        "bashlite",
        "malwarebazaar",
        "echobot malware",
        "win32 exe",
        "magic msdos",
        "pe32 executable",
        "intel",
        "ms windows",
        "trid dos",
        "compiler",
        "delphi",
        "serial number",
        "algorithm",
        "thumbprint",
        "valid from",
        "code signing",
        "from",
        "microsoft root",
        "name microsoft",
        "verisign time",
        "stamping",
        "contained",
        "info sections",
        "name virtual",
        "address virtual",
        "size raw",
        "size entropy",
        "md5 chi2",
        "regsetvalueexa",
        "type rtrcdata",
        "sha256 file",
        "threat roundup",
        "october",
        "august",
        "june",
        "september",
        "highly targeted",
        "cyberstalking",
        "round",
        "december",
        "sneaky server",
        "facebook",
        "stealer",
        "agent tesla",
        "pony",
        "april",
        "whitelisted",
        "encrypt",
        "targeting",
        "tsara brashears",
        "otx",
        "alienvault",
        "memcommit",
        "regsz",
        "regopenkeyexw",
        "english",
        "module load",
        "t1129",
        "t1082",
        "windows module",
        "dlls",
        "redline stealer",
        "updater",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "data redacted",
        "cloudflare",
        "redacted",
        "for privacy",
        "code",
        "server",
        "registrar abuse",
        "redacted for",
        "postal code",
        "registrant name",
        "red team",
        "shit",
        "logistics",
        "cyber defense",
        "gootloader",
        "march",
        "sinkhole",
        "just",
        "ramnit",
        "netsupport rat",
        "microsoft",
        "vault",
        "karen",
        "gifts",
        "hidden privacy",
        "threats",
        "malicious",
        "darkgate",
        "core",
        "hacktool",
        "emotet"
      ],
      "references": [
        "https://botnet.ngocronglau.xyz > link discovered by an Alienvault user who notified me they found it researching message from am active user.",
        "https://otx.alienvault.com/indicator/file/02b19639ad1efa59e77f45d130447c05bd2466e26a657cb9cc6ac2e8b30a0026",
        "https://otx.alienvault.com/indicator/file/001546d210a35b7c4c072b6c265f621cf4a9abdd152741d9b58deae2be204355",
        "https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "Unix.Mirai Botnet: https://otx.alienvault.com/indicator/hostname/botnet.ngocronglau.xyz",
        "CnC IP: https://otx.alienvault.com/indicator/ip/142.202.242.45",
        "https://otx.alienvault.com/indicator/domain/bunny.net",
        "https://otx.alienvault.com/indicator/ip/210.211.117.205",
        "https://otx.alienvault.com/indicator/ip/143.244.50.212",
        "https://otx.alienvault.com/indicator/ip/125.235.4.59",
        "AV Detection: ELF:Mirai-GH\\ [Trj]",
        "IDS Detections:  MVPower DVR Shell UCE Mirai  | Variant User-Agent (Outbound) JAWS Webserver Unauthenticated Shell Command Execution",
        "IDS Detections: Huawei Remote Command Execution (CVE-2017-17215) Huawei Remote Command Execution - Outbound (CVE-2017-17215) Huawei HG532 RCE Vulnerability (CVE-2017-17215) Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World) 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST",
        "IDS Detections: Mirai Variant User-Agent (Inbound) HackingTrio UA (Hello, World)",
        "IDS Detections: 401TRG Generic Webshell Request - POST with wget in body HTTP traffic on port 443 (POST) ...",
        "Alerts: dead_host network_icmp tcp_syn_scan nolookup_communication network_cnc_http network_http p2p_cnc writes_to_stdout",
        "Matches rule Linux_Trojan_Mirai_6a77af0f from ruleset Linux_Trojan_Mirai by Elastic Security | botnet.ngocronglau.xyz",
        "https://otx.alienvault.com/indicator/file/2b5deac6176124ee1f7d237f070c39b03c964fce9a9fba0aaa1bce102710d2e0",
        "cu-payment-porch.pdv-3.ap-southeast-2.production.jet-external.com | qa.proxy.cognito.tigomoney.io | https://trackon.fr/track/clique",
        "Crowdsourced YARA rules Matches:  rule INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Crowdsourced YARA rules Matches: INDICATOR_EXE_Packed_MEW from ruleset indicator_packed by ditekSHen",
        "Crowdsourced YARA rules Matches: SUSP_Unsigned_OSPPSVC from ruleset gen_sign_anomalies by Florian Roth (Nextron Systems",
        "Crowdsourced YARA rules Matches: IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems)",
        "Crowdsourced YARA rules Matches: Matches rule IMPLANT_4_v3_AlternativeRule from ruleset apt_grizzlybear_uscert by Florian Roth (Nextron Systems",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com",
        "Was anyone else notified? I'm not sure why I was.",
        "Through research I did notice many references to target I'm researching for. Phishing/Injection attempt? I didn't click on links.",
        "CS Sigma: Matches rule Python Initiated Connection by frack113"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Unix.Trojan.Mirai-9441505-0",
          "display_name": "Unix.Trojan.Mirai-9441505-0",
          "target": null
        },
        {
          "id": "ALF:E5.SpikeAex.rhh_mcv",
          "display_name": "ALF:E5.SpikeAex.rhh_mcv",
          "target": null
        },
        {
          "id": "Win.Dropper.Bulz-9910065-0",
          "display_name": "Win.Dropper.Bulz-9910065-0",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "Win.Dropper.Autoit-6688751-0",
          "display_name": "Win.Dropper.Autoit-6688751-0",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Dropper.Dridex-9986041-0",
          "display_name": "Win.Dropper.Dridex-9986041-0",
          "target": null
        },
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/Zombie",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/Zombie",
          "target": null
        },
        {
          "id": "Win.Packer.pkr_ce1a-9980177-0",
          "display_name": "Win.Packer.pkr_ce1a-9980177-0",
          "target": null
        },
        {
          "id": "Worm:Win32/Sfone.A",
          "display_name": "Worm:Win32/Sfone.A",
          "target": "/malware/Worm:Win32/Sfone.A"
        },
        {
          "id": "Worm:Win32/Sfone",
          "display_name": "Worm:Win32/Sfone",
          "target": "/malware/Worm:Win32/Sfone"
        },
        {
          "id": "Win.Malware.Bbabdcdc-7358312-0",
          "display_name": "Win.Malware.Bbabdcdc-7358312-0",
          "target": null
        },
        {
          "id": "Win32:Trojan-gen",
          "display_name": "Win32:Trojan-gen",
          "target": null
        },
        {
          "id": "trojan.mirai/fszhh",
          "display_name": "trojan.mirai/fszhh",
          "target": null
        },
        {
          "id": "DDOS:Linux/Mirai",
          "display_name": "DDOS:Linux/Mirai",
          "target": "/malware/DDOS:Linux/Mirai"
        },
        {
          "id": "ANDROID/AVE.Mirai.fszhh",
          "display_name": "ANDROID/AVE.Mirai.fszhh",
          "target": null
        },
        {
          "id": "Flyagent L",
          "display_name": "Flyagent L",
          "target": null
        },
        {
          "id": "Win-Trojan/Malpacked5.Gen",
          "display_name": "Win-Trojan/Malpacked5.Gen",
          "target": null
        },
        {
          "id": "Atros3.LDJ",
          "display_name": "Atros3.LDJ",
          "target": null
        },
        {
          "id": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
          "display_name": "a variant of Win32/FlyStudio.Packed.AD potentially unwanted",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Gucotut.A",
          "display_name": "TrojanSpy:Win32/Gucotut.A",
          "target": "/malware/TrojanSpy:Win32/Gucotut.A"
        },
        {
          "id": "W32/Pidgeon-A",
          "display_name": "W32/Pidgeon-A",
          "target": null
        },
        {
          "id": "Variant.Zusy.151902",
          "display_name": "Variant.Zusy.151902",
          "target": null
        },
        {
          "id": "trojan.mirai/fedr",
          "display_name": "trojan.mirai/fedr",
          "target": null
        },
        {
          "id": "Win.Malware.Trojanx-9862538-0",
          "display_name": "Win.Malware.Trojanx-9862538-0",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen\\ [Trj]",
          "display_name": "Win32:PWSX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "virus.ramnit/nimnul",
          "display_name": "virus.ramnit/nimnul",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 351,
        "FileHash-SHA1": 349,
        "FileHash-SHA256": 3715,
        "domain": 3326,
        "hostname": 5200,
        "URL": 13151,
        "email": 9,
        "CVE": 7,
        "CIDR": 2
      },
      "indicator_count": 26110,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 243,
      "modified_text": "640 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658f967a4fc7ebe8021b9382",
      "name": "Mirai Apple Attack +",
      "description": "This is hard to make sense of. All calls, clicks on a DGA Domain masquerading as desired service, lands you on the radar of a faux service where in turn bad actors attack everything. Target, remotely hack, follow, smear your life, same victim auto populates 79%, no hunt for assaulter.\n I'm assuming to see it one must 1st be in a Botnet. We keep seeing the same targets but no preparator. \nShe said \"Life was busy, life was good; full of health and hope. Then one sunny October day... I'm still grateful but what happened my body, thoughts and the world around me? Where's God? Am I a criminally responsible for getting attacked?\"",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-30T04:03:06.598000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659127f3265ec6306b607faa",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2023-12-31T08:36:03.380000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 30,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65944b9812ea52ab41c0259d",
      "name": "Mirai Apple Attack +",
      "description": "",
      "modified": "2024-01-29T03:01:29.910000",
      "created": "2024-01-02T17:44:56.709000",
      "tags": [
        "whois record",
        "ssl certificate",
        "contacted",
        "whois whois",
        "historical ssl",
        "referrer",
        "communicating",
        "resolutions",
        "apple",
        "collections",
        "core",
        "stealer",
        "execution",
        "ratel",
        "suspicious",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls https",
        "windir",
        "json data",
        "localappdata",
        "ascii text",
        "unicode text",
        "pattern match",
        "file",
        "indicator",
        "mitre att",
        "path",
        "factory",
        "hybrid",
        "general",
        "memcommit",
        "regsetvalueexa",
        "regdword",
        "t1055",
        "high",
        "regbinary",
        "dynamic dns",
        "regsetvalueexw",
        "regsz",
        "medium",
        "win32",
        "malware",
        "copy",
        "capture",
        "name servers",
        "creation date",
        "servers",
        "passive dns",
        "urls",
        "domain",
        "search",
        "expiration date",
        "scan endpoints",
        "all scoreblue",
        "date",
        "next",
        "applenoc",
        "showing",
        "status",
        "united",
        "as44273 host",
        "unknown",
        "all search",
        "otx scoreblue",
        "aaaa",
        "as54113",
        "privacy inc",
        "customer",
        "asnone united",
        "entries",
        "pulse pulses",
        "dga",
        "redacted for",
        "as20940",
        "body",
        "for privacy",
        "ipv4",
        "files",
        "location united",
        "america asn",
        "as54252",
        "type name",
        "dns replication",
        "iana",
        "whois lookup",
        "ipv4 address",
        "ripe ncc",
        "afrinic",
        "africa",
        "apnic",
        "asia pacific",
        "arin",
        "lacnic",
        "elf executable",
        "sysv",
        "linux",
        "elf wgetboat",
        "contacted urls",
        "red team",
        "tsara brashears",
        "apple phone",
        "unlocker",
        "fakedout threat",
        "hostname",
        "samples",
        "mirai",
        "ph elf",
        "telefonica de",
        "elf collection",
        "llwn",
        "text",
        "gp practice",
        "oracle",
        "apple ios",
        "password",
        "threat network",
        "kgs0",
        "kls0",
        "hacktool",
        "probe",
        "malicious"
      ],
      "references": [
        "https://www.rmvictimlaw.org/about-us/board-directors/hazel-heckers",
        "https://hybrid-analysis.com/sample/1f75fd5ec731cc5b1f338a5f7f44b42c9f1988214c373bf582d766934399b525",
        "https://twitter.com/PORNO_SEXYBABES",
        "IPv4 199.59.243.224  and  IPv4 67.21.93.249 - command_and_control",
        "103.246.145.111 phishing",
        "nr-data.net | Apple Private Data collection",
        "BitRAT CnC: File Hash SHA256 23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706",
        "00000000.apple.com  | remote SIM Swap",
        "https://otx.alienvault.com/indicator/file/23d60876953677ed4627f3449661dc549c0f747adb4b082078dac90d60ae7706#:~:text=%C3%97",
        "103.246.145.111  - scanning host",
        "https://app-portal.wsgc.com/saml20/idp/sso?SAMLRequest=jZFBb8IwDIX/SpR70zS0sEa0iA1NQ2IagrLDLlNII4jWJl2cwvj3qyhI7IJ2tPzs9/x5PPmpK3RQDrQ1GY4IxUgZaUttdhneFM/BA57kYxB1xRo+bf3erNR3q8CjbtAA7zsZbp3hVoAGbkStgHvJ19PXBWeE8sZZb6WtMJoCKOc7qydroK2VWyt30FJtVosM771vgIfhETTZCvkF3roTkXtnjZaVIqBk67Q/hUICRrMugzbCn3NfR0XTBI11XlTkCDtJpK3Dc0Ia6rIJASxG81mGP0dpOYqGVEZxGYkk3iaDVMZMKipGMR0kSScDaNXcgBfGZ5hRNghoGrC4YIzTlNMhidPkA6Pl5bhHbXpo90hsexHwl6JYBsu3dYHR+xV+J8AX1Pzs7m4Z318srmBx/m+M4/DWK7+Uf7+c/wI=&RelayState=AcE8QCtmc3hl5id4ZjN8p",
        "https://www.virustotal.com/en/domain/sipa.be (GoodCop - BadCop 404 error. This may have been a dorkingbeauty graph or collection. There seems to be several VT users experiencing similar issues w/overlap",
        "https://ms13p01if-qufw21344001.ms.if.apple.com:8083/",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 (Apple remote hacktool that enter via Apple media)",
        "usw2-platform-dmchat-avengers-prod-ext.apple.com",
        "https://otx.alienvault.com/indicator/hostname/00000000.apple.com#:~:text=%C3%97",
        "Malware Hosting * Spyware: http://141.98.6.249/boat.arm7,  http://141.98.6.249/boat.ppc , http://141.98.6.249/boat.x86"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "RATel",
          "display_name": "RATel",
          "target": null
        },
        {
          "id": "trojan.mirai/genericrxui",
          "display_name": "trojan.mirai/genericrxui",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658f967a4fc7ebe8021b9382",
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 578,
        "FileHash-SHA1": 521,
        "FileHash-SHA256": 6392,
        "URL": 5741,
        "domain": 2243,
        "hostname": 1536,
        "SSLCertFingerprint": 2,
        "email": 8,
        "CVE": 1
      },
      "indicator_count": 17022,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "811 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://investor.j2global.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://investor.j2global.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776628753.541099
}