{
  "type": "URL",
  "indicator": "https://login.feshbook.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://login.feshbook.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833629309,
      "indicator": "https://login.feshbook.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "65be56d257bb241c4fa3f68d",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:02.291000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be56d6df9d36bac14ccd87",
          "name": "AZORult CnC",
          "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
          "modified": "2024-03-04T14:03:17.574000",
          "created": "2024-02-03T15:08:06.808000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "whois whois",
            "january",
            "historical ssl",
            "referrer",
            "april",
            "resolutions",
            "siblings domain",
            "march",
            "february",
            "obz4usfn0 http",
            "problems",
            "threat network",
            "infrastructure",
            "st201601152",
            "startpage",
            "iframe",
            "united",
            "unknown",
            "search",
            "showing",
            "united kingdom",
            "creation date",
            "aaaa",
            "cname",
            "scan endpoints",
            "all octoseek",
            "date",
            "next",
            "script urls",
            "soa nxdomain",
            "link",
            "xml title",
            "portugal",
            "domain",
            "status",
            "expiration date",
            "pulse pulses",
            "as44273 host",
            "domain robot",
            "as61969 team",
            "body",
            "as8075",
            "netherlands",
            "servers",
            "emails",
            "duo insight",
            "type",
            "asnone united",
            "name servers",
            "germany unknown",
            "passive dns",
            "as14061",
            "as49453",
            "lowfi",
            "a domains",
            "urls",
            "privacy inc",
            "customer",
            "trojandropper",
            "dynamicloader",
            "default",
            "medium",
            "entries",
            "khtml",
            "download",
            "show",
            "activity",
            "http",
            "copy",
            "write",
            "malware",
            "adware affiliate",
            "hostname",
            "trojan",
            "pulse submit",
            "url analysis",
            "files",
            "as212913 fop",
            "russia unknown",
            "as397240",
            "as15169 google",
            "as19237 omnis",
            "as22169 omnis",
            "as20068 hawk",
            "as133618",
            "as47846",
            "as22489",
            "encrypt",
            "record value",
            "pragma",
            "accept ch",
            "ireland unknown",
            "msie",
            "chrome",
            "style",
            "gmt setcookie",
            "as6724 strato",
            "core",
            "win32",
            "backdoor",
            "expl",
            "exploit",
            "ipv4",
            "virtool",
            "azorult cnc",
            "possible",
            "as7018 att",
            "regsetvalueexa",
            "china as4134",
            "service",
            "asnone",
            "dns lookup",
            "ransom",
            "push",
            "eternalblue",
            "recon",
            "playgame",
            "domain name",
            "as13768 aptum",
            "meta",
            "error",
            "as43350 nforce",
            "as55286",
            "as60558 phoenix",
            "ip address",
            "registrar",
            "1996",
            "contacted",
            "unlocker",
            "red team",
            "af81 http",
            "execution",
            "open",
            "whois sslcert",
            "suspicious c2",
            "cve202322518",
            "collection",
            "vt graph",
            "excel",
            "emotet",
            "metro",
            "jeffrey reimer pt",
            "sharecare",
            "tsara brashears",
            "apple",
            "icloud"
          ],
          "references": [
            "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
            "qbot.zip",
            "imp.fusioninstall.com",
            "https://mylegalbid.com/malwarebytes",
            "192.185.223.216 | 192.168.56.1 [malware]",
            "http://45.159.189.105/bot/regex",
            "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
            "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
            "xhamster.comyouporn.com",
            "cams4all.com",
            "watchhers.net",
            "weconnect.com",
            "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
            "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
            "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
            "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
            "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
            "https://www.songculture.com/tsara-lynn-brashears-music",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "youramateuporn.com",
            "ns2.abovedomains.com",
            "ww16.porn-community.porn25.com",
            "https://totallyspies.1000hentai.com/tag/clover-porn/",
            "pirateproxy.cc",
            "mwilliams.dev@gmail.com | piratepages.com",
            "838114.parkingcrew.net",
            "static-push-preprod.porndig.com",
            "www.redtube.comyouporn.com",
            "https://severeporn-com.pornproxy.page/",
            "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
            "yoursexy.porn | indianyouporn.com",
            "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
            "cdn.pornsocket.com",
            "http://secure.indianpornpass.com/track/hotpornstuff",
            "www.anyxxxtube.net",
            "https://twitter.com/PORNO_SEXYBABES",
            "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
            "campaign-manager.sharecare.com",
            "qa.companycam.com",
            "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
            "24-70mm.camera",
            "dropboxpayments.com",
            "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
            "http://xred.mooo.com",
            "https://sexgalaxy.net/tag/rodneymoore/",
            "http://alive.overit.com/~schoolbu/badmood3.exe",
            "jimgaffigan.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United Kingdom of Great Britain and Northern Ireland",
            "United States of America",
            "Netherlands",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Adware Affiliate",
              "display_name": "Adware Affiliate",
              "target": null
            },
            {
              "id": "AZORult CnC",
              "display_name": "AZORult CnC",
              "target": null
            },
            {
              "id": "Possible",
              "display_name": "Possible",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8134,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 737,
            "FileHash-SHA1": 692,
            "FileHash-SHA256": 7488,
            "URL": 6694,
            "domain": 5247,
            "hostname": 2932,
            "email": 49,
            "CVE": 2,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 23842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "776 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "imp.fusioninstall.com",
        "watchhers.net",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "yoursexy.porn | indianyouporn.com",
        "xhamster.comyouporn.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "ns2.abovedomains.com",
        "dropboxpayments.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "angebot.staude.de",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "838114.parkingcrew.net",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "mwilliams.dev@gmail.com | piratepages.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "ww16.porn-community.porn25.com",
        "http://xred.mooo.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "cellebrite.com | enterprise.cellebrite.com",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "https://severeporn-com.pornproxy.page/",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "Trojan:Win32/WannaCry.350",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "www.anyxxxtube.net",
        "cdn.pornsocket.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "static-push-preprod.porndig.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "http://45.159.189.105/bot/regex",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "24-70mm.camera",
        "qbot.zip",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "https://mylegalbid.com/malwarebytes",
        "www.redtube.comyouporn.com",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "pirateproxy.cc",
        "deviceinbox.com",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "cams4all.com",
        "weconnect.com",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "youramateuporn.com",
        "jimgaffigan.com",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Azorult cnc",
            "Virtool",
            "Trojan:win32/wannacry.350",
            "Possible",
            "Adware affiliate"
          ],
          "industries": [],
          "unique_indicators": 36205
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/feshbook.com",
    "whois": "http://whois.domaintools.com/feshbook.com",
    "domain": "feshbook.com",
    "hostname": "login.feshbook.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "65be56d257bb241c4fa3f68d",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:02.291000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be56d6df9d36bac14ccd87",
      "name": "AZORult CnC",
      "description": "Behaviors\n\nSteals computer data, such as installed programs, machine globally unique identifier (GUID), system architecture, system language, user name, computer name, and operating system (OS) version\nSteals stored account information used in different installed File Transfer Protocol (FTP) clients or file manager software\nSteals stored email credentials of different mail clients\nSteals user names, passwords, and hostnames from different browsers\nSteals bitcoin wallets - Monero and uCoin\nSteals Steam and telegram credentials\nSteals Skype chat history and messages\nExecutes backdoor commands from a remote malicious user to collect host Internet protocol (IP) information, download/execute/delete file\nCapabilities\n\nInformation Theft\nBackdoor commands\nExploits\nDownload Routine\nImpact\n\nCompromise system security - with backdoor capabilities that can execute malicious commands, downloads and installs additional malwares",
      "modified": "2024-03-04T14:03:17.574000",
      "created": "2024-02-03T15:08:06.808000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "whois whois",
        "january",
        "historical ssl",
        "referrer",
        "april",
        "resolutions",
        "siblings domain",
        "march",
        "february",
        "obz4usfn0 http",
        "problems",
        "threat network",
        "infrastructure",
        "st201601152",
        "startpage",
        "iframe",
        "united",
        "unknown",
        "search",
        "showing",
        "united kingdom",
        "creation date",
        "aaaa",
        "cname",
        "scan endpoints",
        "all octoseek",
        "date",
        "next",
        "script urls",
        "soa nxdomain",
        "link",
        "xml title",
        "portugal",
        "domain",
        "status",
        "expiration date",
        "pulse pulses",
        "as44273 host",
        "domain robot",
        "as61969 team",
        "body",
        "as8075",
        "netherlands",
        "servers",
        "emails",
        "duo insight",
        "type",
        "asnone united",
        "name servers",
        "germany unknown",
        "passive dns",
        "as14061",
        "as49453",
        "lowfi",
        "a domains",
        "urls",
        "privacy inc",
        "customer",
        "trojandropper",
        "dynamicloader",
        "default",
        "medium",
        "entries",
        "khtml",
        "download",
        "show",
        "activity",
        "http",
        "copy",
        "write",
        "malware",
        "adware affiliate",
        "hostname",
        "trojan",
        "pulse submit",
        "url analysis",
        "files",
        "as212913 fop",
        "russia unknown",
        "as397240",
        "as15169 google",
        "as19237 omnis",
        "as22169 omnis",
        "as20068 hawk",
        "as133618",
        "as47846",
        "as22489",
        "encrypt",
        "record value",
        "pragma",
        "accept ch",
        "ireland unknown",
        "msie",
        "chrome",
        "style",
        "gmt setcookie",
        "as6724 strato",
        "core",
        "win32",
        "backdoor",
        "expl",
        "exploit",
        "ipv4",
        "virtool",
        "azorult cnc",
        "possible",
        "as7018 att",
        "regsetvalueexa",
        "china as4134",
        "service",
        "asnone",
        "dns lookup",
        "ransom",
        "push",
        "eternalblue",
        "recon",
        "playgame",
        "domain name",
        "as13768 aptum",
        "meta",
        "error",
        "as43350 nforce",
        "as55286",
        "as60558 phoenix",
        "ip address",
        "registrar",
        "1996",
        "contacted",
        "unlocker",
        "red team",
        "af81 http",
        "execution",
        "open",
        "whois sslcert",
        "suspicious c2",
        "cve202322518",
        "collection",
        "vt graph",
        "excel",
        "emotet",
        "metro",
        "jeffrey reimer pt",
        "sharecare",
        "tsara brashears",
        "apple",
        "icloud"
      ],
      "references": [
        "https://www.sharecare.com/doctor/jeffrey-reimer-6ie6z",
        "qbot.zip",
        "imp.fusioninstall.com",
        "https://mylegalbid.com/malwarebytes",
        "192.185.223.216 | 192.168.56.1 [malware]",
        "http://45.159.189.105/bot/regex",
        "https://success.trendmicro.com/dcx/s/solution/000146108-azorult-malware-information?language=en_US&sfdcIFrameOrigin=null",
        "http://config.premiuminstaller.com/config/ls/offers.json?pid=installer&ts=2014-10-14T18:54:45.9443368Z&br=CR&adprovider=marmarf",
        "xhamster.comyouporn.com",
        "cams4all.com",
        "watchhers.net",
        "weconnect.com",
        "icloud-appleidsuport.com | appleid.com | apple.com | apple-dns.net",
        "http://install.oinstaller5.com/o/jfaquew_jupdate/setup.exe?mode=dlshift&sf=0&subid=a208&filedescription=setup&adprovider=jfaquew&cpixe",
        "init.ess.apple.com | 0-courier.push.apple.com | dns1.registrar-servers.com",
        "Apple -dns1.registrar-servers.com | emails.redvue.com | icloud-appleidsuport.com",
        "https://songculture.com/tsara-brashears | https://www.songculture.com/tsara-brashears-music",
        "https://www.songculture.com/tsara-lynn-brashears-music",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "youramateuporn.com",
        "ns2.abovedomains.com",
        "ww16.porn-community.porn25.com",
        "https://totallyspies.1000hentai.com/tag/clover-porn/",
        "pirateproxy.cc",
        "mwilliams.dev@gmail.com | piratepages.com",
        "838114.parkingcrew.net",
        "static-push-preprod.porndig.com",
        "www.redtube.comyouporn.com",
        "https://severeporn-com.pornproxy.page/",
        "https://spankbang-com.pornproxy.page/593ao/video/sunshine%20mouth%20stuffed%20gagged%20and%20tied%20with%20her%20friend",
        "yoursexy.porn | indianyouporn.com",
        "source-6.youporn.express | source-6.sexpornsource.com\t hostname\tsource-3.xxxporn.club | source-2.pornhubs.best | source-2.freepornxo.com",
        "cdn.pornsocket.com",
        "http://secure.indianpornpass.com/track/hotpornstuff",
        "www.anyxxxtube.net",
        "https://twitter.com/PORNO_SEXYBABES",
        "http://www.my-sexcam.com/mf6w/?K48hY=mUHPm4taPKwCazx4uoqkcvO3m838TOpLC/XyTruUQEV1lwGjr5ldYJa4yIBvf0ifHE4=&sHB=DPfXxzFpo",
        "campaign-manager.sharecare.com",
        "qa.companycam.com",
        "https://app.join.engineeringim.com/e/er?utm_source=eloqua&utm_medium=email&utm_campaign=&sp_cid=&utm_content=PB_NAM23BSE_PB_06_BATT_PW_Shmuel&sp_aid=27591&sp_rid=31788066&sp_eh=577a94ae55b9b9c106e776e684a2413f8c4dac061fc5b814c054be9e822698d9&s=949606000&lid=79146&elqTrackId=2AD273F3E5AB3555FA7D5FA11122C7C2&elq=a46790e54bbc42d2b0adbc4e6533814e&elqaid=27591&elqat=1",
        "24-70mm.camera",
        "dropboxpayments.com",
        "http://r3.i.lencr.org/ | r3.i.lencr.org | c.lencr.org | x1.c.lencr.org",
        "http://xred.mooo.com",
        "https://sexgalaxy.net/tag/rodneymoore/",
        "http://alive.overit.com/~schoolbu/badmood3.exe",
        "jimgaffigan.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United Kingdom of Great Britain and Northern Ireland",
        "United States of America",
        "Netherlands",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Adware Affiliate",
          "display_name": "Adware Affiliate",
          "target": null
        },
        {
          "id": "AZORult CnC",
          "display_name": "AZORult CnC",
          "target": null
        },
        {
          "id": "Possible",
          "display_name": "Possible",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8134,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 737,
        "FileHash-SHA1": 692,
        "FileHash-SHA256": 7488,
        "URL": 6694,
        "domain": 5247,
        "hostname": 2932,
        "email": 49,
        "CVE": 2,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 23842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "776 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://login.feshbook.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://login.feshbook.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631525.6542504
}