{
  "type": "URL",
  "indicator": "https://mittbbss.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://mittbbss.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2992618298,
      "indicator": "https://mittbbss.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "65caca061fbb7674de86ec7b",
          "name": "Invicta Stealer",
          "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
          "modified": "2024-03-14T01:01:47.115000",
          "created": "2024-02-13T01:46:46.969000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "communicating",
            "whois whois",
            "subdomains",
            "referrer",
            "problems",
            "core",
            "startpage",
            "june",
            "passive dns",
            "urls",
            "domain",
            "otx telemetry",
            "body",
            "gmt content",
            "x adblock",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "date",
            "encrypt",
            "threat roundup",
            "october",
            "november",
            "march",
            "february",
            "apple ios",
            "april",
            "tsara brashears",
            "copy",
            "hacktool",
            "phishing",
            "metro",
            "crypto",
            "installer",
            "awful",
            "united",
            "unknown",
            "germany unknown",
            "search",
            "servers",
            "registrar",
            "name servers",
            "status",
            "next",
            "moved",
            "address",
            "creation date",
            "showing",
            "ipv4",
            "pulse submit",
            "url analysis",
            "accept",
            "aaaa",
            "record type",
            "ttl value",
            "html document",
            "ascii text",
            "anchor hrefs",
            "hrefs",
            "anchor",
            "anchor href",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "url https",
            "sample",
            "server",
            "code",
            "registry domain",
            "dnssec",
            "registrar url",
            "registrar whois",
            "iana id",
            "registrar abuse",
            "tech email",
            "fake update",
            "utilizes new",
            "idat loader",
            "stealc",
            "urls http",
            "isadultno",
            "adposbottom",
            "adformatplain",
            "adnetworks",
            "quasar rat",
            "ip detections",
            "country",
            "cellbrite",
            "execution",
            "pegasus",
            "malware",
            "agent tesla",
            "attack",
            "ukraine",
            "silent",
            "invicta stealer",
            "redline stealer",
            "orcus rat",
            "files",
            "germany asn",
            "as196763",
            "a domains",
            "redacted for",
            "record value",
            "for privacy",
            "emails",
            "name",
            "contacted urls",
            "bundled",
            "de indicators",
            "domains",
            "hashes",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "pulse pulses",
            "location united",
            "open",
            "cookie",
            "customer",
            "0 report",
            "sea alt",
            "certificate",
            "#targeting",
            "#discordwallets",
            "house.mo.gov"
          ],
          "references": [
            "https://www.facebooksunglassshop.com/",
            "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
            "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
            "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
            "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
            "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
            "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
            "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
            "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
            "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
            "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
            "edgedl.me.gvt1.com",
            "Link found in https://house.mo.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Invicta Stealer",
              "display_name": "Invicta Stealer",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Orcus RAT",
              "display_name": "Orcus RAT",
              "target": null
            },
            {
              "id": "Silent",
              "display_name": "Silent",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Civil Society",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 65,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 145,
            "FileHash-SHA256": 3848,
            "CVE": 3,
            "URL": 8291,
            "domain": 2541,
            "hostname": 3034,
            "email": 13
          },
          "indicator_count": 18028,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c1cdc5d695c35205593bde",
          "name": "https://callback.mobileboost.me",
          "description": "cobalt strike cnc, malware, network, execution, antivm_queries_computername, tulach, schema abuse, callback, contact, malicious, boost mobile, t-mobile, targets,Tsara, brashears, cyber threat, hacking, sabey, data center, cyber, cp",
          "modified": "2024-03-07T05:01:03.052000",
          "created": "2024-02-06T06:12:21.372000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "address domain",
            "url https",
            "http",
            "files domain",
            "files related",
            "cname",
            "united",
            "unknown",
            "nxdomain",
            "a nxdomain",
            "ssl certificate",
            "contacted",
            "whois record",
            "resolutions",
            "whois whois",
            "historical ssl",
            "referrer",
            "problems",
            "execution",
            "subdomains",
            "startpage",
            "simda",
            "first",
            "utc submissions",
            "submitters",
            "psiusa",
            "domain robot",
            "csc corporate",
            "domains",
            "tucows",
            "ltd dba",
            "com laude",
            "twitter",
            "indonesia",
            "installer",
            "kgs0",
            "kls0",
            "redlinestealer",
            "kangen",
            "china telecom",
            "group",
            "computer",
            "company limited",
            "summary iocs",
            "malware",
            "network",
            "obz4usfn0 http",
            "contacted urls",
            "gootloader",
            "iframe",
            "stus",
            "cnus",
            "regsetvalueexa",
            "cobalt strike",
            "search",
            "regdword",
            "ssl cert",
            "tlsv1 apr",
            "cobaltstrike",
            "trojan",
            "copy",
            "write",
            "june",
            "win64",
            "porkbun llc",
            "mb opera",
            "china unicom",
            "tmobileas21928",
            "graph community",
            "china education",
            "center",
            "showing",
            "entries"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1874,
            "hostname": 2812,
            "URL": 8308,
            "FileHash-SHA256": 5549,
            "FileHash-MD5": 364,
            "FileHash-SHA1": 326,
            "email": 3,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 19237,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "773 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659b0fd1ac7cb4d83834db1f",
          "name": "Botnet Command and Control Server | Malware Distribution Site",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-07T20:55:45.006000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a48ab7cd0bd218b17ccf6c",
          "name": "Botnet Command and Control Server | Malware",
          "description": "",
          "modified": "2024-02-06T20:02:52.205000",
          "created": "2024-01-15T01:30:31.655000",
          "tags": [
            "passive dns",
            "urls",
            "scan endpoints",
            "all octoseek",
            "url http",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "status code",
            "body",
            "httponly",
            "ssl certificate",
            "historical ssl",
            "whois record",
            "parent referrer",
            "whois whois",
            "communicating",
            "contacted",
            "contacted urls",
            "bundled",
            "pe resource",
            "dropped",
            "army",
            "machinename",
            "execution",
            "referrer",
            "malware distribution site",
            "phishing dropbox",
            "evasive",
            "banker",
            "dde",
            "dridex",
            "exploit",
            "dyre",
            "dyreza",
            "ransomware",
            "mydoom",
            "backdoor",
            "svg",
            "phising",
            "locky",
            "e-mail provider phishing",
            "spear phishing",
            "retefe",
            "defacement",
            "phishing development bank of singapore",
            "banjori",
            "suppobox",
            "zeus",
            "pony",
            "solar",
            "ransomware locky distribution site",
            "nymaim",
            "shade",
            "troldesh",
            "tvrat",
            "zbot",
            "elocky",
            "wisdomeyes",
            "kryptic",
            "sinkhole",
            "exploit",
            "worm",
            "backdoor",
            "injector",
            "botnet command and control server",
            "unknown",
            "domain",
            "creation date",
            "search",
            "date",
            "hostname",
            "next",
            "all search",
            "otx octoseek",
            "united",
            "as13335",
            "ipv4",
            "pulse submit",
            "url analysis",
            "iocs",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "files",
            "nxdomain",
            "win32",
            "meta",
            "wabot",
            "gmt contenttype",
            "dnssec",
            "name",
            "win32 exe",
            "detections file",
            "file size",
            "kb file",
            "domains",
            "registrar",
            "markmonitor inc",
            "status",
            "susp",
            "expiration date",
            "name servers",
            "domain related",
            "entries",
            "johnnsabey",
            "m. brian sabey",
            "mark sabey",
            "sabey data center",
            "utah",
            "http method",
            "http requests",
            "connect http",
            "get dns",
            "resolutions",
            "ip traffic",
            "problems",
            "alienvault part",
            "kgs0",
            "kls0",
            "schema abuse",
            "sneaky server",
            "iframe",
            "apple",
            "data collection"
          ],
          "references": [
            "http://security.didici.cc/cve"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "virus.virlock/nabucur",
              "display_name": "virus.virlock/nabucur",
              "target": null
            },
            {
              "id": "Virut",
              "display_name": "Virut",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Locky",
              "display_name": "Locky",
              "target": null
            },
            {
              "id": "Defacement",
              "display_name": "Defacement",
              "target": null
            },
            {
              "id": "Banjori",
              "display_name": "Banjori",
              "target": null
            },
            {
              "id": "Trojan.AvsEtecer",
              "display_name": "Trojan.AvsEtecer",
              "target": null
            },
            {
              "id": "SuppoBox",
              "display_name": "SuppoBox",
              "target": null
            },
            {
              "id": "ZeuS",
              "display_name": "ZeuS",
              "target": null
            },
            {
              "id": "Pony",
              "display_name": "Pony",
              "target": null
            },
            {
              "id": "Solar",
              "display_name": "Solar",
              "target": null
            },
            {
              "id": "Nymaim",
              "display_name": "Nymaim",
              "target": null
            },
            {
              "id": "TV RAT",
              "display_name": "TV RAT",
              "target": null
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Dyre",
              "display_name": "Dyre",
              "target": null
            },
            {
              "id": "ELocky",
              "display_name": "ELocky",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Locky (Decryptor)",
              "display_name": "Locky (Decryptor)",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "Trojan.WisdomEyes.16070401.9500",
              "display_name": "Trojan.WisdomEyes.16070401.9500",
              "target": null
            },
            {
              "id": "Gen:Variant.Strictor",
              "display_name": "Gen:Variant.Strictor",
              "target": null
            },
            {
              "id": "Adware.BrowseFox",
              "display_name": "Adware.BrowseFox",
              "target": null
            },
            {
              "id": "W32.eHeur",
              "display_name": "W32.eHeur",
              "target": null
            },
            {
              "id": "MSIL_Kryptik.P.gen",
              "display_name": "MSIL_Kryptik.P.gen",
              "target": null
            },
            {
              "id": "pykspa_v2_fake",
              "display_name": "pykspa_v2_fake",
              "target": null
            },
            {
              "id": "Worm:Win32/Pykspa",
              "display_name": "Worm:Win32/Pykspa",
              "target": "/malware/Worm:Win32/Pykspa"
            },
            {
              "id": "Pykspa",
              "display_name": "Pykspa",
              "target": null
            },
            {
              "id": "TEL:Exploit:Win32/Sinkers",
              "display_name": "TEL:Exploit:Win32/Sinkers",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1594",
              "name": "Search Victim-Owned Websites",
              "display_name": "T1594 - Search Victim-Owned Websites"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1574.008",
              "name": "Path Interception by Search Order Hijacking",
              "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1587.001",
              "name": "Malware",
              "display_name": "T1587.001 - Malware"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659b0fd1ac7cb4d83834db1f",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 231,
            "FileHash-SHA256": 3121,
            "URL": 4225,
            "domain": 1725,
            "hostname": 1416,
            "FileHash-SHA1": 225,
            "CVE": 2,
            "email": 3
          },
          "indicator_count": 10948,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "803 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659331580cd1571f730b8de2",
          "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
          "description": "",
          "modified": "2024-01-31T14:03:30.344000",
          "created": "2024-01-01T21:40:40.242000",
          "tags": [
            "maxads0",
            "kld1063",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls http",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "march",
            "communicating",
            "copy",
            "january",
            "collections",
            "execution",
            "malware",
            "startpage",
            "malicious",
            "ransomware",
            "agent tesla",
            "attack",
            "android",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "windir",
            "path",
            "programfiles",
            "pe32",
            "ms windows",
            "getprocaddress",
            "file type",
            "mitre att",
            "ck id",
            "show technique",
            "win64",
            "date",
            "open",
            "hybrid",
            "cookie",
            "tracking",
            "apple",
            "spyware",
            "malware",
            "tablet",
            "superwebbysearch",
            "hallrender",
            "pegasus",
            "briansabey",
            "aig",
            "abuse",
            "tulach"
          ],
          "references": [
            "findbetterresults.com",
            "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
            "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
            "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
            "www2.megawebfind.com                [command_and_control]",
            "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2368,
            "FileHash-SHA256": 4539,
            "hostname": 2892,
            "URL": 9741,
            "FileHash-MD5": 836,
            "FileHash-SHA1": 461,
            "CVE": 1
          },
          "indicator_count": 20838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659331589faf01b909c1802d",
          "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
          "description": "",
          "modified": "2024-01-31T14:03:30.344000",
          "created": "2024-01-01T21:40:40.413000",
          "tags": [
            "maxads0",
            "kld1063",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "hostnames",
            "urls http",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "march",
            "communicating",
            "copy",
            "january",
            "collections",
            "execution",
            "malware",
            "startpage",
            "malicious",
            "ransomware",
            "agent tesla",
            "attack",
            "android",
            "name verdict",
            "falcon sandbox",
            "reports",
            "falcon",
            "windir",
            "path",
            "programfiles",
            "pe32",
            "ms windows",
            "getprocaddress",
            "file type",
            "mitre att",
            "ck id",
            "show technique",
            "win64",
            "date",
            "open",
            "hybrid",
            "cookie",
            "tracking",
            "apple",
            "spyware",
            "malware",
            "tablet",
            "superwebbysearch",
            "hallrender",
            "pegasus",
            "briansabey",
            "aig",
            "abuse",
            "tulach"
          ],
          "references": [
            "findbetterresults.com",
            "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
            "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
            "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
            "www2.megawebfind.com                [command_and_control]",
            "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2368,
            "FileHash-SHA256": 4539,
            "hostname": 2892,
            "URL": 9741,
            "FileHash-MD5": 836,
            "FileHash-SHA1": 461,
            "CVE": 1
          },
          "indicator_count": 20838,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "wallpapers-nature.com",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "Data Analysis",
        "WebTools",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
        "edgedl.me.gvt1.com",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "findbetterresults.com",
        "www2.megawebfind.com                [command_and_control]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "http://security.didici.cc/cve",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "Alienvault OTX",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "Link found in https://house.mo.com",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "Online Research",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "https://www.facebooksunglassshop.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hacktool",
            "Zeus",
            "Banjori",
            "Virut",
            "Msil_kryptik.p.gen",
            "Zbot",
            "Virus.virlock/nabucur",
            "Invicta stealer",
            "Locky",
            "Defacement",
            "Elocky",
            "Adware.browsefox",
            "Agent tesla",
            "Backdoor:msil/quasarrat",
            "Tv rat",
            "Dridex",
            "Worm:win32/pykspa",
            "Pegasus",
            "Backdoor:msil/asyncrat",
            "Nymaim",
            "Pykspa_v2_fake",
            "Gen:variant.strictor",
            "Silent",
            "Redline stealer",
            "Pony",
            "Dyre",
            "Hallrender",
            "Pykspa",
            "Solar",
            "W32.eheur",
            "Orcus rat",
            "Locky (decryptor)",
            "Trojan.wisdomeyes.16070401.9500",
            "Quasar rat",
            "Ransomware",
            "Mydoom",
            "Trojan.avsetecer",
            "Tel:exploit:win32/sinkers",
            "Sabey",
            "Suppobox"
          ],
          "industries": [
            "Government",
            "Social media",
            "Media",
            "Hacking",
            "Civil society",
            "Technology"
          ],
          "unique_indicators": 88298
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mittbbss.com",
    "whois": "http://whois.domaintools.com/mittbbss.com",
    "domain": "mittbbss.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "65caca061fbb7674de86ec7b",
      "name": "Invicta Stealer",
      "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
      "modified": "2024-03-14T01:01:47.115000",
      "created": "2024-02-13T01:46:46.969000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "resolutions",
        "communicating",
        "whois whois",
        "subdomains",
        "referrer",
        "problems",
        "core",
        "startpage",
        "june",
        "passive dns",
        "urls",
        "domain",
        "otx telemetry",
        "body",
        "gmt content",
        "x adblock",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "date",
        "encrypt",
        "threat roundup",
        "october",
        "november",
        "march",
        "february",
        "apple ios",
        "april",
        "tsara brashears",
        "copy",
        "hacktool",
        "phishing",
        "metro",
        "crypto",
        "installer",
        "awful",
        "united",
        "unknown",
        "germany unknown",
        "search",
        "servers",
        "registrar",
        "name servers",
        "status",
        "next",
        "moved",
        "address",
        "creation date",
        "showing",
        "ipv4",
        "pulse submit",
        "url analysis",
        "accept",
        "aaaa",
        "record type",
        "ttl value",
        "html document",
        "ascii text",
        "anchor hrefs",
        "hrefs",
        "anchor",
        "anchor href",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "url https",
        "sample",
        "server",
        "code",
        "registry domain",
        "dnssec",
        "registrar url",
        "registrar whois",
        "iana id",
        "registrar abuse",
        "tech email",
        "fake update",
        "utilizes new",
        "idat loader",
        "stealc",
        "urls http",
        "isadultno",
        "adposbottom",
        "adformatplain",
        "adnetworks",
        "quasar rat",
        "ip detections",
        "country",
        "cellbrite",
        "execution",
        "pegasus",
        "malware",
        "agent tesla",
        "attack",
        "ukraine",
        "silent",
        "invicta stealer",
        "redline stealer",
        "orcus rat",
        "files",
        "germany asn",
        "as196763",
        "a domains",
        "redacted for",
        "record value",
        "for privacy",
        "emails",
        "name",
        "contacted urls",
        "bundled",
        "de indicators",
        "domains",
        "hashes",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "pulse pulses",
        "location united",
        "open",
        "cookie",
        "customer",
        "0 report",
        "sea alt",
        "certificate",
        "#targeting",
        "#discordwallets",
        "house.mo.gov"
      ],
      "references": [
        "https://www.facebooksunglassshop.com/",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "edgedl.me.gvt1.com",
        "Link found in https://house.mo.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Invicta Stealer",
          "display_name": "Invicta Stealer",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Orcus RAT",
          "display_name": "Orcus RAT",
          "target": null
        },
        {
          "id": "Silent",
          "display_name": "Silent",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Civil Society",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 65,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 145,
        "FileHash-SHA256": 3848,
        "CVE": 3,
        "URL": 8291,
        "domain": 2541,
        "hostname": 3034,
        "email": 13
      },
      "indicator_count": 18028,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65c1cdc5d695c35205593bde",
      "name": "https://callback.mobileboost.me",
      "description": "cobalt strike cnc, malware, network, execution, antivm_queries_computername, tulach, schema abuse, callback, contact, malicious, boost mobile, t-mobile, targets,Tsara, brashears, cyber threat, hacking, sabey, data center, cyber, cp",
      "modified": "2024-03-07T05:01:03.052000",
      "created": "2024-02-06T06:12:21.372000",
      "tags": [
        "passive dns",
        "urls",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "address domain",
        "url https",
        "http",
        "files domain",
        "files related",
        "cname",
        "united",
        "unknown",
        "nxdomain",
        "a nxdomain",
        "ssl certificate",
        "contacted",
        "whois record",
        "resolutions",
        "whois whois",
        "historical ssl",
        "referrer",
        "problems",
        "execution",
        "subdomains",
        "startpage",
        "simda",
        "first",
        "utc submissions",
        "submitters",
        "psiusa",
        "domain robot",
        "csc corporate",
        "domains",
        "tucows",
        "ltd dba",
        "com laude",
        "twitter",
        "indonesia",
        "installer",
        "kgs0",
        "kls0",
        "redlinestealer",
        "kangen",
        "china telecom",
        "group",
        "computer",
        "company limited",
        "summary iocs",
        "malware",
        "network",
        "obz4usfn0 http",
        "contacted urls",
        "gootloader",
        "iframe",
        "stus",
        "cnus",
        "regsetvalueexa",
        "cobalt strike",
        "search",
        "regdword",
        "ssl cert",
        "tlsv1 apr",
        "cobaltstrike",
        "trojan",
        "copy",
        "write",
        "june",
        "win64",
        "porkbun llc",
        "mb opera",
        "china unicom",
        "tmobileas21928",
        "graph community",
        "china education",
        "center",
        "showing",
        "entries"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1874,
        "hostname": 2812,
        "URL": 8308,
        "FileHash-SHA256": 5549,
        "FileHash-MD5": 364,
        "FileHash-SHA1": 326,
        "email": 3,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 19237,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "773 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659b0fd1ac7cb4d83834db1f",
      "name": "Botnet Command and Control Server | Malware Distribution Site",
      "description": "",
      "modified": "2024-02-06T20:02:52.205000",
      "created": "2024-01-07T20:55:45.006000",
      "tags": [
        "passive dns",
        "urls",
        "scan endpoints",
        "all octoseek",
        "url http",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "status code",
        "body",
        "httponly",
        "ssl certificate",
        "historical ssl",
        "whois record",
        "parent referrer",
        "whois whois",
        "communicating",
        "contacted",
        "contacted urls",
        "bundled",
        "pe resource",
        "dropped",
        "army",
        "machinename",
        "execution",
        "referrer",
        "malware distribution site",
        "phishing dropbox",
        "evasive",
        "banker",
        "dde",
        "dridex",
        "exploit",
        "dyre",
        "dyreza",
        "ransomware",
        "mydoom",
        "backdoor",
        "svg",
        "phising",
        "locky",
        "e-mail provider phishing",
        "spear phishing",
        "retefe",
        "defacement",
        "phishing development bank of singapore",
        "banjori",
        "suppobox",
        "zeus",
        "pony",
        "solar",
        "ransomware locky distribution site",
        "nymaim",
        "shade",
        "troldesh",
        "tvrat",
        "zbot",
        "elocky",
        "wisdomeyes",
        "kryptic",
        "sinkhole",
        "exploit",
        "worm",
        "backdoor",
        "injector",
        "botnet command and control server",
        "unknown",
        "domain",
        "creation date",
        "search",
        "date",
        "hostname",
        "next",
        "all search",
        "otx octoseek",
        "united",
        "as13335",
        "ipv4",
        "pulse submit",
        "url analysis",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "files",
        "nxdomain",
        "win32",
        "meta",
        "wabot",
        "gmt contenttype",
        "dnssec",
        "name",
        "win32 exe",
        "detections file",
        "file size",
        "kb file",
        "domains",
        "registrar",
        "markmonitor inc",
        "status",
        "susp",
        "expiration date",
        "name servers",
        "domain related",
        "entries",
        "johnnsabey",
        "m. brian sabey",
        "mark sabey",
        "sabey data center",
        "utah",
        "http method",
        "http requests",
        "connect http",
        "get dns",
        "resolutions",
        "ip traffic",
        "problems",
        "alienvault part",
        "kgs0",
        "kls0",
        "schema abuse",
        "sneaky server",
        "iframe",
        "apple",
        "data collection"
      ],
      "references": [
        "http://security.didici.cc/cve"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "virus.virlock/nabucur",
          "display_name": "virus.virlock/nabucur",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        },
        {
          "id": "Banjori",
          "display_name": "Banjori",
          "target": null
        },
        {
          "id": "Trojan.AvsEtecer",
          "display_name": "Trojan.AvsEtecer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "TV RAT",
          "display_name": "TV RAT",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Dyre",
          "display_name": "Dyre",
          "target": null
        },
        {
          "id": "ELocky",
          "display_name": "ELocky",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Locky (Decryptor)",
          "display_name": "Locky (Decryptor)",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan.WisdomEyes.16070401.9500",
          "display_name": "Trojan.WisdomEyes.16070401.9500",
          "target": null
        },
        {
          "id": "Gen:Variant.Strictor",
          "display_name": "Gen:Variant.Strictor",
          "target": null
        },
        {
          "id": "Adware.BrowseFox",
          "display_name": "Adware.BrowseFox",
          "target": null
        },
        {
          "id": "W32.eHeur",
          "display_name": "W32.eHeur",
          "target": null
        },
        {
          "id": "MSIL_Kryptik.P.gen",
          "display_name": "MSIL_Kryptik.P.gen",
          "target": null
        },
        {
          "id": "pykspa_v2_fake",
          "display_name": "pykspa_v2_fake",
          "target": null
        },
        {
          "id": "Worm:Win32/Pykspa",
          "display_name": "Worm:Win32/Pykspa",
          "target": "/malware/Worm:Win32/Pykspa"
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "TEL:Exploit:Win32/Sinkers",
          "display_name": "TEL:Exploit:Win32/Sinkers",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1594",
          "name": "Search Victim-Owned Websites",
          "display_name": "T1594 - Search Victim-Owned Websites"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 231,
        "FileHash-SHA256": 3121,
        "URL": 4225,
        "domain": 1725,
        "hostname": 1416,
        "FileHash-SHA1": 225,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10948,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a48ab7cd0bd218b17ccf6c",
      "name": "Botnet Command and Control Server | Malware",
      "description": "",
      "modified": "2024-02-06T20:02:52.205000",
      "created": "2024-01-15T01:30:31.655000",
      "tags": [
        "passive dns",
        "urls",
        "scan endpoints",
        "all octoseek",
        "url http",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "status code",
        "body",
        "httponly",
        "ssl certificate",
        "historical ssl",
        "whois record",
        "parent referrer",
        "whois whois",
        "communicating",
        "contacted",
        "contacted urls",
        "bundled",
        "pe resource",
        "dropped",
        "army",
        "machinename",
        "execution",
        "referrer",
        "malware distribution site",
        "phishing dropbox",
        "evasive",
        "banker",
        "dde",
        "dridex",
        "exploit",
        "dyre",
        "dyreza",
        "ransomware",
        "mydoom",
        "backdoor",
        "svg",
        "phising",
        "locky",
        "e-mail provider phishing",
        "spear phishing",
        "retefe",
        "defacement",
        "phishing development bank of singapore",
        "banjori",
        "suppobox",
        "zeus",
        "pony",
        "solar",
        "ransomware locky distribution site",
        "nymaim",
        "shade",
        "troldesh",
        "tvrat",
        "zbot",
        "elocky",
        "wisdomeyes",
        "kryptic",
        "sinkhole",
        "exploit",
        "worm",
        "backdoor",
        "injector",
        "botnet command and control server",
        "unknown",
        "domain",
        "creation date",
        "search",
        "date",
        "hostname",
        "next",
        "all search",
        "otx octoseek",
        "united",
        "as13335",
        "ipv4",
        "pulse submit",
        "url analysis",
        "iocs",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "files",
        "nxdomain",
        "win32",
        "meta",
        "wabot",
        "gmt contenttype",
        "dnssec",
        "name",
        "win32 exe",
        "detections file",
        "file size",
        "kb file",
        "domains",
        "registrar",
        "markmonitor inc",
        "status",
        "susp",
        "expiration date",
        "name servers",
        "domain related",
        "entries",
        "johnnsabey",
        "m. brian sabey",
        "mark sabey",
        "sabey data center",
        "utah",
        "http method",
        "http requests",
        "connect http",
        "get dns",
        "resolutions",
        "ip traffic",
        "problems",
        "alienvault part",
        "kgs0",
        "kls0",
        "schema abuse",
        "sneaky server",
        "iframe",
        "apple",
        "data collection"
      ],
      "references": [
        "http://security.didici.cc/cve"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "virus.virlock/nabucur",
          "display_name": "virus.virlock/nabucur",
          "target": null
        },
        {
          "id": "Virut",
          "display_name": "Virut",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "Locky",
          "display_name": "Locky",
          "target": null
        },
        {
          "id": "Defacement",
          "display_name": "Defacement",
          "target": null
        },
        {
          "id": "Banjori",
          "display_name": "Banjori",
          "target": null
        },
        {
          "id": "Trojan.AvsEtecer",
          "display_name": "Trojan.AvsEtecer",
          "target": null
        },
        {
          "id": "SuppoBox",
          "display_name": "SuppoBox",
          "target": null
        },
        {
          "id": "ZeuS",
          "display_name": "ZeuS",
          "target": null
        },
        {
          "id": "Pony",
          "display_name": "Pony",
          "target": null
        },
        {
          "id": "Solar",
          "display_name": "Solar",
          "target": null
        },
        {
          "id": "Nymaim",
          "display_name": "Nymaim",
          "target": null
        },
        {
          "id": "TV RAT",
          "display_name": "TV RAT",
          "target": null
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Dyre",
          "display_name": "Dyre",
          "target": null
        },
        {
          "id": "ELocky",
          "display_name": "ELocky",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Locky (Decryptor)",
          "display_name": "Locky (Decryptor)",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "Trojan.WisdomEyes.16070401.9500",
          "display_name": "Trojan.WisdomEyes.16070401.9500",
          "target": null
        },
        {
          "id": "Gen:Variant.Strictor",
          "display_name": "Gen:Variant.Strictor",
          "target": null
        },
        {
          "id": "Adware.BrowseFox",
          "display_name": "Adware.BrowseFox",
          "target": null
        },
        {
          "id": "W32.eHeur",
          "display_name": "W32.eHeur",
          "target": null
        },
        {
          "id": "MSIL_Kryptik.P.gen",
          "display_name": "MSIL_Kryptik.P.gen",
          "target": null
        },
        {
          "id": "pykspa_v2_fake",
          "display_name": "pykspa_v2_fake",
          "target": null
        },
        {
          "id": "Worm:Win32/Pykspa",
          "display_name": "Worm:Win32/Pykspa",
          "target": "/malware/Worm:Win32/Pykspa"
        },
        {
          "id": "Pykspa",
          "display_name": "Pykspa",
          "target": null
        },
        {
          "id": "TEL:Exploit:Win32/Sinkers",
          "display_name": "TEL:Exploit:Win32/Sinkers",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1594",
          "name": "Search Victim-Owned Websites",
          "display_name": "T1594 - Search Victim-Owned Websites"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1574.008",
          "name": "Path Interception by Search Order Hijacking",
          "display_name": "T1574.008 - Path Interception by Search Order Hijacking"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1587.001",
          "name": "Malware",
          "display_name": "T1587.001 - Malware"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659b0fd1ac7cb4d83834db1f",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 231,
        "FileHash-SHA256": 3121,
        "URL": 4225,
        "domain": 1725,
        "hostname": 1416,
        "FileHash-SHA1": 225,
        "CVE": 2,
        "email": 3
      },
      "indicator_count": 10948,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "803 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659331580cd1571f730b8de2",
      "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
      "description": "",
      "modified": "2024-01-31T14:03:30.344000",
      "created": "2024-01-01T21:40:40.242000",
      "tags": [
        "maxads0",
        "kld1063",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls http",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "march",
        "communicating",
        "copy",
        "january",
        "collections",
        "execution",
        "malware",
        "startpage",
        "malicious",
        "ransomware",
        "agent tesla",
        "attack",
        "android",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "windir",
        "path",
        "programfiles",
        "pe32",
        "ms windows",
        "getprocaddress",
        "file type",
        "mitre att",
        "ck id",
        "show technique",
        "win64",
        "date",
        "open",
        "hybrid",
        "cookie",
        "tracking",
        "apple",
        "spyware",
        "malware",
        "tablet",
        "superwebbysearch",
        "hallrender",
        "pegasus",
        "briansabey",
        "aig",
        "abuse",
        "tulach"
      ],
      "references": [
        "findbetterresults.com",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "www2.megawebfind.com                [command_and_control]",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2368,
        "FileHash-SHA256": 4539,
        "hostname": 2892,
        "URL": 9741,
        "FileHash-MD5": 836,
        "FileHash-SHA1": 461,
        "CVE": 1
      },
      "indicator_count": 20838,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659331589faf01b909c1802d",
      "name": "Agent Tesla | Spyware | Tracking Android & Apple users | Malware Attack",
      "description": "",
      "modified": "2024-01-31T14:03:30.344000",
      "created": "2024-01-01T21:40:40.413000",
      "tags": [
        "maxads0",
        "kld1063",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "hostnames",
        "urls http",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "march",
        "communicating",
        "copy",
        "january",
        "collections",
        "execution",
        "malware",
        "startpage",
        "malicious",
        "ransomware",
        "agent tesla",
        "attack",
        "android",
        "name verdict",
        "falcon sandbox",
        "reports",
        "falcon",
        "windir",
        "path",
        "programfiles",
        "pe32",
        "ms windows",
        "getprocaddress",
        "file type",
        "mitre att",
        "ck id",
        "show technique",
        "win64",
        "date",
        "open",
        "hybrid",
        "cookie",
        "tracking",
        "apple",
        "spyware",
        "malware",
        "tablet",
        "superwebbysearch",
        "hallrender",
        "pegasus",
        "briansabey",
        "aig",
        "abuse",
        "tulach"
      ],
      "references": [
        "findbetterresults.com",
        "https://hybrid-analysis.com/sample/bba36b3ae7c49d1cffcc5f8e045d81e9307a2e1a86b923f89008e9377d171fb6",
        "https://www.virustotal.com/gui/url/eed406872c2e6ef550b948510fe0b7b4c71f752f58551c2f8e61d31a19d2a153/summary",
        "http://www.applerewards.website/pl/3/index.html?voluumdata=BASE64dmlkLi4wMDAwMDAwMi00NGFiLTQzNDktODAwMC0wMDAwMDAwMDAwMDBfX3ZwaWQuLjJhYWQzMDAwLWJiMzYtMTFlNi04YTYyLTBlYzcxZTllMDMzMV9fY2FpZC4uNjBhMjIwOWUtNWMzNC00OGQ4LWIyNDctYWM5YzVkOTM3MzZhX19ydC4uUl9fbGlkLi4yYTRjOTA4My0zY2RmLTQyNDktOGJmOS0yODMxZWYzNGRhYTlfX29pZDEuLjUwMGE4NDhjLTA2NGEtNDYyZi05MDNmLTgxYzY4ODNmODEwZl9fdmFyMS4uNjA4OTYxX192YXIyLi42NzEwMjhfX3JkLi5vbmNsaWNrYWRzXC5cbmV0X19haWQuLl9fYWIuLl9fc2lkLi4&zoneid=608961&campaignid=671028&visitor_id=4003954",
        "www2.megawebfind.com                [command_and_control]",
        "https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=   [command_and_control]   stolec kradnie krypto"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2368,
        "FileHash-SHA256": 4539,
        "hostname": 2892,
        "URL": 9741,
        "FileHash-MD5": 836,
        "FileHash-SHA1": 461,
        "CVE": 1
      },
      "indicator_count": 20838,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "650a0b7c9a6b3c5d0a2a3960",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
      "modified": "2023-10-19T14:04:37.381000",
      "created": "2023-09-19T20:58:36.137000",
      "tags": [
        "contacted",
        "threat roundup",
        "execution",
        "ssl certificate",
        "dark web",
        "crypto threat",
        "resolutions",
        "referrer",
        "stealer",
        "quasar",
        "asyncrat",
        "error",
        "social engineering",
        "iPhone phishing",
        "Apple phishing",
        "email phishing",
        "emotet",
        "remote",
        "attacks"
      ],
      "references": [
        "Alienvault OTX",
        "Data Analysis",
        "Online Research",
        "WebTools"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "India"
      ],
      "malware_families": [
        {
          "id": "Backdoor:MSIL/AsyncRAT",
          "display_name": "Backdoor:MSIL/AsyncRAT",
          "target": "/malware/Backdoor:MSIL/AsyncRAT"
        },
        {
          "id": "Backdoor:MSIL/QuasarRat",
          "display_name": "Backdoor:MSIL/QuasarRat",
          "target": "/malware/Backdoor:MSIL/QuasarRat"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1548",
          "name": "Abuse Elevation Control Mechanism",
          "display_name": "T1548 - Abuse Elevation Control Mechanism"
        }
      ],
      "industries": [
        "Media",
        "Social Media",
        "Technology",
        "Hacking"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 5791,
        "URL": 11513,
        "domain": 2317,
        "hostname": 3255,
        "CVE": 3
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "913 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://mittbbss.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://mittbbss.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776638804.395331
}