{
  "type": "URL",
  "indicator": "https://kvm.3ztl.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://kvm.3ztl.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3683060911,
      "indicator": "https://kvm.3ztl.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "66141ecabe8f1ab189351dd3",
          "name": "Tofsee Botnet: Google.com.uy | Install | Injection | Pegasus Monitoring",
          "description": "Installed remotely by nefarious actor by Trojan dropper. Typically not install via PlayStore/AppStore; can be with severe compromise/ VPNs will be fake. Examples: 1.1.1.1, 1.1.1.4, Proton AG or Proton.ch. Not visible: [.uy.]. All data, monitored, manipulated, tracked, location,  vehicle tracking, webcams, IP track, data cryptocurrency mining, tracked 24/7, collection, DDoS attacks, ransom, full CnC.\nTweakers.net, .bv , etc., observed, pegasus related",
          "modified": "2024-05-08T16:00:34.588000",
          "created": "2024-04-08T16:43:54.908000",
          "tags": [
            "installer",
            "tofsee",
            "trojan",
            "dropper",
            "dns",
            "as20940",
            "united",
            "aaaa",
            "as15703",
            "search",
            "servers",
            "as8455 schuberg",
            "a domains",
            "encrypt",
            "code",
            "tweakers",
            "unknown",
            "ransom",
            "body",
            "webcams",
            "banker",
            "location tracking",
            "vehicle tracking",
            "device tracking",
            "exploitation",
            "redirects",
            "ip tracking",
            "vpn nullify",
            "vehicle keycodes",
            "search threat",
            "analyzer feeds",
            "panel platform",
            "search platform",
            "profile user",
            "iocs",
            "redacted for",
            "passive dns",
            "all scoreblue",
            "hostname",
            "next",
            "cnc",
            "scanning host",
            "milesone",
            "virtual currency mining",
            "crypto",
            "regsetvalueexa",
            "regdword",
            "default",
            "show",
            "regbinary",
            "read c",
            "settingswpad",
            "as15169",
            "malware",
            "copy",
            "write",
            "upatre",
            "ids detections",
            "scan endpoints",
            "filehash",
            "av detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "ransom",
            "related pulses",
            "entries",
            "icmp traffic",
            "packing t1045",
            "t1045",
            "pe resource",
            "august",
            "win32",
            "for privacy",
            "creation date",
            "name servers",
            "urls",
            "date",
            "status",
            "as15169 google",
            "as44273 host",
            "ipv4",
            "pulse submit",
            "url analysis",
            "msie",
            "chrome",
            "moved",
            "title",
            "gmt content",
            "apple",
            "invalidate_gift_cards",
            "tulach rebranded",
            "hallrender rebranded",
            "as8075",
            "verdana",
            "td tr",
            "domain",
            "germany unknown",
            "as34011 host",
            "etag",
            "medium",
            "module load",
            "invalidate_google_play",
            "algorithm",
            "v3 serial",
            "number",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "first",
            "win32 exe",
            "win32 dll",
            "javascript",
            "mozilla firefox",
            "edition",
            "detections type",
            "name",
            "keeweb",
            "setup",
            "firefox setup",
            "record type",
            "ttl value",
            "android",
            "files",
            "formbook",
            "critical cmd",
            "tracker",
            "tsara brashears",
            "remote",
            "historical ssl",
            "referrer",
            "march",
            "body html",
            "head meta",
            "moved title",
            "head body",
            "pegasus",
            "nemtih",
            "hit",
            "men",
            "gift_card_mining",
            "google_play_card_mining",
            "miner",
            "htmladodb may",
            "twitter",
            "win64",
            "as21342",
            "as2914 ntt",
            "as15334",
            "error",
            "certificate",
            "checkbox",
            "accept",
            "record value",
            "emails",
            "domain name"
          ],
          "references": [
            "Virustotal  - google.com.uy",
            "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
            "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
            "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
            "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect",
            "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
            "nr-data.net [Apple Private Data Collection]",
            "checkip.dyndns.org [command and control]",
            "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
            "144.76.108.82 [scanning host]",
            "Yara Detections PEtite24",
            "FormBook IP: 142.251.211.243",
            "https://pegasusm2.bullsbikesusa.com",
            "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Trojan:MSIL/TrojanDropper",
              "display_name": "Trojan:MSIL/TrojanDropper",
              "target": "/malware/Trojan:MSIL/TrojanDropper"
            },
            {
              "id": "Installer",
              "display_name": "Installer",
              "target": null
            },
            {
              "id": "Sf:Agent-DQ\\ [Trj]",
              "display_name": "Sf:Agent-DQ\\ [Trj]",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Upatre!rfn",
              "display_name": "TrojanDownloader:Win32/Upatre!rfn",
              "target": "/malware/TrojanDownloader:Win32/Upatre!rfn"
            },
            {
              "id": "Win32:DropperX-gen\\ [Drp]",
              "display_name": "Win32:DropperX-gen\\ [Drp]",
              "target": null
            },
            {
              "id": "Win.Trojan.Tofsee-9770082-1",
              "display_name": "Win.Trojan.Tofsee-9770082-1",
              "target": null
            },
            {
              "id": "Ransom:Win32/StopCrypt.AK!MTB",
              "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
              "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1574.005",
              "name": "Executable Installer File Permissions Weakness",
              "display_name": "T1574.005 - Executable Installer File Permissions Weakness"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1493",
              "name": "Transmitted Data Manipulation",
              "display_name": "T1493 - Transmitted Data Manipulation"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1013",
              "name": "Port Monitors",
              "display_name": "T1013 - Port Monitors"
            },
            {
              "id": "T1430",
              "name": "Location Tracking",
              "display_name": "T1430 - Location Tracking"
            },
            {
              "id": "T1468",
              "name": "Remotely Track Device Without Authorization",
              "display_name": "T1468 - Remotely Track Device Without Authorization"
            },
            {
              "id": "T1450",
              "name": "Exploit SS7 to Track Device Location",
              "display_name": "T1450 - Exploit SS7 to Track Device Location"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1483",
              "name": "Domain Generation Algorithms",
              "display_name": "T1483 - Domain Generation Algorithms"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1472",
              "name": "Generate Fraudulent Advertising Revenue",
              "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 392,
            "FileHash-SHA1": 468,
            "FileHash-SHA256": 3233,
            "URL": 8667,
            "domain": 2219,
            "hostname": 3480,
            "email": 8
          },
          "indicator_count": 18467,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "711 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5c5ebba25ca46fc5b36bc",
          "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:11:39.752000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "msie",
            "chrome",
            "certificate",
            "hostname",
            "url analysis",
            "http response",
            "final url",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers date",
            "connection",
            "date sat",
            "html info",
            "forbidden",
            "google tag",
            "utc aw741566034",
            "utc redirection",
            "asnone united",
            "as54113",
            "cname",
            "script urls",
            "as19527 google",
            "as35280 acorus",
            "encrypt",
            "reverse dns",
            "location dublin",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "as4808 china",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "tulach",
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "social engineering",
            "contact made by mark brian sabey",
            "contact made by o'dea",
            "benjamin c"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4655,
            "URL": 9981,
            "FileHash-MD5": 219,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 6722,
            "hostname": 4341,
            "CVE": 2,
            "email": 12,
            "BitcoinAddress": 3
          },
          "indicator_count": 26148,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbadc21b9891c459b9d2",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:13.975000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9995,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbbbcb7a479db222f053",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:27.745000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9996,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 26000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "753 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80944a3d1c9e36346e0c1",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "",
          "modified": "2024-02-27T03:01:21.421000",
          "created": "2024-01-29T20:23:32.737000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "65b5cbbbcb7a479db222f053",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4174,
            "URL": 9617,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6801,
            "hostname": 4314,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25400,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "782 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709ba0e1e42d8a734c0c6c",
          "name": "Apple TV - v2 all the ioc's that audio capture is effecting",
          "description": "",
          "modified": "2023-12-06T16:04:48.541000",
          "created": "2023-12-06T16:04:48.541000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 556,
            "URL": 1041,
            "hostname": 289,
            "domain": 272,
            "FileHash-MD5": 28,
            "FileHash-SHA1": 16
          },
          "indicator_count": 2202,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "646a5cff16d0269ba40b93a1",
          "name": "Apple TV - v2 all the ioc's that audio capture is effecting",
          "description": "Apple\u00a0TV\u00a04K brings the best of TV, music and games to your home, and brings all your favourite apps and apps to the biggest screen in the world - on Apple's latest product.",
          "modified": "2023-06-23T22:14:17.716000",
          "created": "2023-05-21T18:03:43.947000",
          "tags": [
            "airpods",
            "sharing",
            "apple tv",
            "apple",
            "strong",
            "learn",
            "siri",
            "apple store",
            "apple arcade",
            "watch",
            "world dominion",
            "control center",
            "maverick",
            "snake",
            "enjoy",
            "live",
            "footer",
            "august",
            "dragon",
            "thor",
            "love",
            "find"
          ],
          "references": [
            "https://c.apple.com/r?v=2&la=en&lc=usa&a=z2+nb8HWCoHziyJtbRYNxEJqOcwA12xbGoofYjHA7/qZL3jGl6qS9pGKxbZ5tK8v8Qqg3Sm3Uxz4XAgMHwMbNqvdMZ9t4LIAQOyrLz/xgXyGzsiYOHDluMFaNO9CKk+fHUhZttYRgfSJDWI9j5E3AqTcx0p4xX8ZEOpEJwiu0LQ/eG5coVr4EW5hkFGO8V+uFdHSYh3M9qz59+NmpF7nYeYPEX3vJHQ9p9RE2FN0JGM=&ct=ac2A2c4M4v"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Sharing",
              "display_name": "Sharing",
              "target": null
            },
            {
              "id": "AirPods",
              "display_name": "AirPods",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            }
          ],
          "industries": [
            "Entertainment"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 289,
            "URL": 1041,
            "domain": 272,
            "FileHash-SHA256": 556,
            "FileHash-MD5": 28,
            "FileHash-SHA1": 16
          },
          "indicator_count": 2202,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1031 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "checkip.dyndns.org [command and control]",
        "enterprise.cellebrite.com [ digitalclues.com]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "Yara Detections PEtite24",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
        "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "Online Research",
        "WebTools",
        "144.76.108.82 [scanning host]",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "FormBook IP: 142.251.211.243",
        "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
        "https://tulach.cc/ [malware engineering | phishing]",
        "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "training001.blackbagtech.com [opportunity?]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Virustotal  - google.com.uy",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://www.nsogroup.com",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "https://pegasusm2.bullsbikesusa.com",
        "Alienvault OTX",
        "Data Analysis",
        "https://c.apple.com/r?v=2&la=en&lc=usa&a=z2+nb8HWCoHziyJtbRYNxEJqOcwA12xbGoofYjHA7/qZL3jGl6qS9pGKxbZ5tK8v8Qqg3Sm3Uxz4XAgMHwMbNqvdMZ9t4LIAQOyrLz/xgXyGzsiYOHDluMFaNO9CKk+fHUhZttYRgfSJDWI9j5E3AqTcx0p4xX8ZEOpEJwiu0LQ/eG5coVr4EW5hkFGO8V+uFdHSYh3M9qz59+NmpF7nYeYPEX3vJHQ9p9RE2FN0JGM=&ct=ac2A2c4M4v",
        "message.htm.com [ message stealer]",
        "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "nr-data.net [Apple Private Data Collection]",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
        "deviceinbox.com [malware hosting]",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net",
        "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group"
          ],
          "malware_families": [
            "Installer",
            "Sf:agent-dq\\ [trj]",
            "Eternalblue",
            "Backdoor:win32/mydoom",
            "Tulach",
            "Amadey",
            "Trojandownloader:win32/upatre!rfn",
            "Trojan:msil/trojandropper",
            "Tofsee",
            "Ransom:win32/stopcrypt.ak!mtb",
            "Pegasus",
            "Airpods",
            "Quasar rat",
            "Backdoor:msil/asyncrat",
            "Win32:dropperx-gen\\ [drp]",
            "Sharing",
            "Win.trojan.tofsee-9770082-1",
            "Backdoor:msil/quasarrat"
          ],
          "industries": [
            "Hacking",
            "Entertainment",
            "Social media",
            "Technology",
            "Healthcare",
            "Civil society",
            "Media"
          ],
          "unique_indicators": 69136
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/3ztl.net",
    "whois": "http://whois.domaintools.com/3ztl.net",
    "domain": "3ztl.net",
    "hostname": "kvm.3ztl.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "66141ecabe8f1ab189351dd3",
      "name": "Tofsee Botnet: Google.com.uy | Install | Injection | Pegasus Monitoring",
      "description": "Installed remotely by nefarious actor by Trojan dropper. Typically not install via PlayStore/AppStore; can be with severe compromise/ VPNs will be fake. Examples: 1.1.1.1, 1.1.1.4, Proton AG or Proton.ch. Not visible: [.uy.]. All data, monitored, manipulated, tracked, location,  vehicle tracking, webcams, IP track, data cryptocurrency mining, tracked 24/7, collection, DDoS attacks, ransom, full CnC.\nTweakers.net, .bv , etc., observed, pegasus related",
      "modified": "2024-05-08T16:00:34.588000",
      "created": "2024-04-08T16:43:54.908000",
      "tags": [
        "installer",
        "tofsee",
        "trojan",
        "dropper",
        "dns",
        "as20940",
        "united",
        "aaaa",
        "as15703",
        "search",
        "servers",
        "as8455 schuberg",
        "a domains",
        "encrypt",
        "code",
        "tweakers",
        "unknown",
        "ransom",
        "body",
        "webcams",
        "banker",
        "location tracking",
        "vehicle tracking",
        "device tracking",
        "exploitation",
        "redirects",
        "ip tracking",
        "vpn nullify",
        "vehicle keycodes",
        "search threat",
        "analyzer feeds",
        "panel platform",
        "search platform",
        "profile user",
        "iocs",
        "redacted for",
        "passive dns",
        "all scoreblue",
        "hostname",
        "next",
        "cnc",
        "scanning host",
        "milesone",
        "virtual currency mining",
        "crypto",
        "regsetvalueexa",
        "regdword",
        "default",
        "show",
        "regbinary",
        "read c",
        "settingswpad",
        "as15169",
        "malware",
        "copy",
        "write",
        "upatre",
        "ids detections",
        "scan endpoints",
        "filehash",
        "av detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "ransom",
        "related pulses",
        "entries",
        "icmp traffic",
        "packing t1045",
        "t1045",
        "pe resource",
        "august",
        "win32",
        "for privacy",
        "creation date",
        "name servers",
        "urls",
        "date",
        "status",
        "as15169 google",
        "as44273 host",
        "ipv4",
        "pulse submit",
        "url analysis",
        "msie",
        "chrome",
        "moved",
        "title",
        "gmt content",
        "apple",
        "invalidate_gift_cards",
        "tulach rebranded",
        "hallrender rebranded",
        "as8075",
        "verdana",
        "td tr",
        "domain",
        "germany unknown",
        "as34011 host",
        "etag",
        "medium",
        "module load",
        "invalidate_google_play",
        "algorithm",
        "v3 serial",
        "number",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "first",
        "win32 exe",
        "win32 dll",
        "javascript",
        "mozilla firefox",
        "edition",
        "detections type",
        "name",
        "keeweb",
        "setup",
        "firefox setup",
        "record type",
        "ttl value",
        "android",
        "files",
        "formbook",
        "critical cmd",
        "tracker",
        "tsara brashears",
        "remote",
        "historical ssl",
        "referrer",
        "march",
        "body html",
        "head meta",
        "moved title",
        "head body",
        "pegasus",
        "nemtih",
        "hit",
        "men",
        "gift_card_mining",
        "google_play_card_mining",
        "miner",
        "htmladodb may",
        "twitter",
        "win64",
        "as21342",
        "as2914 ntt",
        "as15334",
        "error",
        "certificate",
        "checkbox",
        "accept",
        "record value",
        "emails",
        "domain name"
      ],
      "references": [
        "Virustotal  - google.com.uy",
        "https://hybrid-analysis.com/sample/79c5841a534b53013389ba76326a067895bdf5e41ad279d82b2002f6c8f2cda6",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key>Mercedes+benz+Key+programmer",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=lost+my+mercedes+key",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=webcam+models+livecambabes.webcam>korean+webcam+models",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=www.livecambabes.Webcam>sexy+girls+dildoing",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=avon+representative>50calpaintballshop.com>avon+representative+directory [Beware: redirects]",
        "http://www.50calpaintballshop.com/phpinfo.php?a[]=how+to+join+avon+uk>how+do+i+join+avon+online [redirects to fraud representatives]",
        "Reports of victims meeting fraud direct sales reps in home/coffee shops. Reps store PII, financial, SSN# on device. Orders in victims name. ID theft ring",
        "https://www.herbgordonsubaru.com/?ddcref=careconnect_NM102-01&utm_campaign=newsconnect&utm_medium=email&utm_source=careconnect",
        "https://www.herbgordonsubaru.com/new-inventory/index?search=&model=Outback&utm_source=careconnect&utm_medium=email&utm_campaign=marketdriver-sales&ddcref=careconnect_marketdriversales",
        "nr-data.net [Apple Private Data Collection]",
        "checkip.dyndns.org [command and control]",
        "checkip.dyndns.org Alerts: dead_host network_icmp nolookup_communication modifies_proxy_wpad packer_polymorphic recon_beacon",
        "144.76.108.82 [scanning host]",
        "Yara Detections PEtite24",
        "FormBook IP: 142.251.211.243",
        "https://pegasusm2.bullsbikesusa.com",
        "https://microcenterinsider.com/pub/cc?_ri_=X0Gzc2X=AQpglLjHJlTQG0amRRrN1tkKAFGSTzdEjURWMTwh5gzdnK5Wo4uRBMFITdmoHEE1NzdwpzaEqrzcUkeItzbfVXtpKX=BATA"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Trojan:MSIL/TrojanDropper",
          "display_name": "Trojan:MSIL/TrojanDropper",
          "target": "/malware/Trojan:MSIL/TrojanDropper"
        },
        {
          "id": "Installer",
          "display_name": "Installer",
          "target": null
        },
        {
          "id": "Sf:Agent-DQ\\ [Trj]",
          "display_name": "Sf:Agent-DQ\\ [Trj]",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Upatre!rfn",
          "display_name": "TrojanDownloader:Win32/Upatre!rfn",
          "target": "/malware/TrojanDownloader:Win32/Upatre!rfn"
        },
        {
          "id": "Win32:DropperX-gen\\ [Drp]",
          "display_name": "Win32:DropperX-gen\\ [Drp]",
          "target": null
        },
        {
          "id": "Win.Trojan.Tofsee-9770082-1",
          "display_name": "Win.Trojan.Tofsee-9770082-1",
          "target": null
        },
        {
          "id": "Ransom:Win32/StopCrypt.AK!MTB",
          "display_name": "Ransom:Win32/StopCrypt.AK!MTB",
          "target": "/malware/Ransom:Win32/StopCrypt.AK!MTB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1574.005",
          "name": "Executable Installer File Permissions Weakness",
          "display_name": "T1574.005 - Executable Installer File Permissions Weakness"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1493",
          "name": "Transmitted Data Manipulation",
          "display_name": "T1493 - Transmitted Data Manipulation"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1013",
          "name": "Port Monitors",
          "display_name": "T1013 - Port Monitors"
        },
        {
          "id": "T1430",
          "name": "Location Tracking",
          "display_name": "T1430 - Location Tracking"
        },
        {
          "id": "T1468",
          "name": "Remotely Track Device Without Authorization",
          "display_name": "T1468 - Remotely Track Device Without Authorization"
        },
        {
          "id": "T1450",
          "name": "Exploit SS7 to Track Device Location",
          "display_name": "T1450 - Exploit SS7 to Track Device Location"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1483",
          "name": "Domain Generation Algorithms",
          "display_name": "T1483 - Domain Generation Algorithms"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1472",
          "name": "Generate Fraudulent Advertising Revenue",
          "display_name": "T1472 - Generate Fraudulent Advertising Revenue"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 392,
        "FileHash-SHA1": 468,
        "FileHash-SHA256": 3233,
        "URL": 8667,
        "domain": 2219,
        "hostname": 3480,
        "email": 8
      },
      "indicator_count": 18467,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "711 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5c5ebba25ca46fc5b36bc",
      "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:11:39.752000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "msie",
        "chrome",
        "certificate",
        "hostname",
        "url analysis",
        "http response",
        "final url",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers date",
        "connection",
        "date sat",
        "html info",
        "forbidden",
        "google tag",
        "utc aw741566034",
        "utc redirection",
        "asnone united",
        "as54113",
        "cname",
        "script urls",
        "as19527 google",
        "as35280 acorus",
        "encrypt",
        "reverse dns",
        "location dublin",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "as4808 china",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "tulach",
        "c-67-181-73-197.hsd1.ca.comcast.net",
        "social engineering",
        "contact made by mark brian sabey",
        "contact made by o'dea",
        "benjamin c"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4655,
        "URL": 9981,
        "FileHash-MD5": 219,
        "FileHash-SHA1": 213,
        "FileHash-SHA256": 6722,
        "hostname": 4341,
        "CVE": 2,
        "email": 12,
        "BitcoinAddress": 3
      },
      "indicator_count": 26148,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "753 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbadc21b9891c459b9d2",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:13.975000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9995,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "753 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbbbcb7a479db222f053",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:27.745000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9996,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 26000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "753 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80944a3d1c9e36346e0c1",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "",
      "modified": "2024-02-27T03:01:21.421000",
      "created": "2024-01-29T20:23:32.737000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "65b5cbbbcb7a479db222f053",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4174,
        "URL": 9617,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6801,
        "hostname": 4314,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25400,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "782 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709ba0e1e42d8a734c0c6c",
      "name": "Apple TV - v2 all the ioc's that audio capture is effecting",
      "description": "",
      "modified": "2023-12-06T16:04:48.541000",
      "created": "2023-12-06T16:04:48.541000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 556,
        "URL": 1041,
        "hostname": 289,
        "domain": 272,
        "FileHash-MD5": 28,
        "FileHash-SHA1": 16
      },
      "indicator_count": 2202,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650a0b7c9a6b3c5d0a2a3960",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
      "modified": "2023-10-19T14:04:37.381000",
      "created": "2023-09-19T20:58:36.137000",
      "tags": [
        "contacted",
        "threat roundup",
        "execution",
        "ssl certificate",
        "dark web",
        "crypto threat",
        "resolutions",
        "referrer",
        "stealer",
        "quasar",
        "asyncrat",
        "error",
        "social engineering",
        "iPhone phishing",
        "Apple phishing",
        "email phishing",
        "emotet",
        "remote",
        "attacks"
      ],
      "references": [
        "Alienvault OTX",
        "Data Analysis",
        "Online Research",
        "WebTools"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "India"
      ],
      "malware_families": [
        {
          "id": "Backdoor:MSIL/AsyncRAT",
          "display_name": "Backdoor:MSIL/AsyncRAT",
          "target": "/malware/Backdoor:MSIL/AsyncRAT"
        },
        {
          "id": "Backdoor:MSIL/QuasarRat",
          "display_name": "Backdoor:MSIL/QuasarRat",
          "target": "/malware/Backdoor:MSIL/QuasarRat"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1548",
          "name": "Abuse Elevation Control Mechanism",
          "display_name": "T1548 - Abuse Elevation Control Mechanism"
        }
      ],
      "industries": [
        "Media",
        "Social Media",
        "Technology",
        "Hacking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 5791,
        "URL": 11513,
        "domain": 2317,
        "hostname": 3255,
        "CVE": 3
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "646a5cff16d0269ba40b93a1",
      "name": "Apple TV - v2 all the ioc's that audio capture is effecting",
      "description": "Apple\u00a0TV\u00a04K brings the best of TV, music and games to your home, and brings all your favourite apps and apps to the biggest screen in the world - on Apple's latest product.",
      "modified": "2023-06-23T22:14:17.716000",
      "created": "2023-05-21T18:03:43.947000",
      "tags": [
        "airpods",
        "sharing",
        "apple tv",
        "apple",
        "strong",
        "learn",
        "siri",
        "apple store",
        "apple arcade",
        "watch",
        "world dominion",
        "control center",
        "maverick",
        "snake",
        "enjoy",
        "live",
        "footer",
        "august",
        "dragon",
        "thor",
        "love",
        "find"
      ],
      "references": [
        "https://c.apple.com/r?v=2&la=en&lc=usa&a=z2+nb8HWCoHziyJtbRYNxEJqOcwA12xbGoofYjHA7/qZL3jGl6qS9pGKxbZ5tK8v8Qqg3Sm3Uxz4XAgMHwMbNqvdMZ9t4LIAQOyrLz/xgXyGzsiYOHDluMFaNO9CKk+fHUhZttYRgfSJDWI9j5E3AqTcx0p4xX8ZEOpEJwiu0LQ/eG5coVr4EW5hkFGO8V+uFdHSYh3M9qz59+NmpF7nYeYPEX3vJHQ9p9RE2FN0JGM=&ct=ac2A2c4M4v"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Sharing",
          "display_name": "Sharing",
          "target": null
        },
        {
          "id": "AirPods",
          "display_name": "AirPods",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        }
      ],
      "industries": [
        "Entertainment"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 289,
        "URL": 1041,
        "domain": 272,
        "FileHash-SHA256": 556,
        "FileHash-MD5": 28,
        "FileHash-SHA1": 16
      },
      "indicator_count": 2202,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1031 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://kvm.3ztl.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://kvm.3ztl.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642305.2352483
}