{
  "type": "URL",
  "indicator": "https://originatesoft.scriptlisting.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://originatesoft.scriptlisting.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3784319644,
      "indicator": "https://originatesoft.scriptlisting.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "65b85faa9b8e3e1206d7f25c",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
          "description": "",
          "modified": "2024-06-15T04:39:29.943000",
          "created": "2024-01-30T02:32:10.210000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3503,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28413,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "674 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "659719b77c383c73c05208a9",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-04T20:48:55.431000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "807 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a7e6e042a968005f7a5552",
          "name": "Content Reputation | ET | Botnet | Targeting",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-01-17T14:40:32.084000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "659719b77c383c73c05208a9",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "807 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc13594cf21dbe00b94807",
          "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
          "description": "",
          "modified": "2024-02-03T19:04:07.916000",
          "created": "2024-02-01T21:55:37.581000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls http",
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "apple ios",
            "contacted",
            "tsara brashears",
            "whois",
            "resolutions",
            "password",
            "hacktool",
            "crypto",
            "execution",
            "emotet",
            "installer",
            "banker",
            "keylogger",
            "critical",
            "copy",
            "content reputation",
            "et",
            "submission",
            "comodo valkyrie",
            "verdict",
            "bitdefender",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url http",
            "search",
            "entries",
            "passive dns",
            "urls",
            "record value",
            "unknown",
            "united",
            "gmt content",
            "dynamic report",
            "0 report",
            "date",
            "accept",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "http response",
            "final url",
            "serving ip",
            "address",
            "ipv4",
            "files",
            "location china",
            "asn as45090",
            "dns resolutions",
            "twitter",
            "log id",
            "gmtn",
            "tls web",
            "encrypt",
            "ca issuers",
            "f20b201c",
            "b467295d",
            "b2931e3f",
            "false",
            "as15169 google",
            "domain",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "create c",
            "write c",
            "read c",
            "medium",
            "next",
            "dock",
            "write",
            "persistence",
            "delete c",
            "path",
            "xport",
            "default",
            "years ago",
            "modified",
            "created",
            "email",
            "active created",
            "white",
            "filehash",
            "memcommit",
            "tlsv1",
            "show",
            "win32",
            "malware",
            "get na",
            "systemroot",
            "starizona",
            "lscottsdale",
            "creation date",
            "emails",
            "domain name",
            "showing",
            "pulse submit",
            "amazon",
            "server ca",
            "b535",
            "tulach",
            "hallrender",
            "hallgrand",
            "briansabey",
            "brian sabey",
            "mark",
            "mark brian sabey",
            "mark sabey",
            "cybercrime",
            "cyber stalking",
            "botnet",
            "evader",
            "hacker",
            "targeting"
          ],
          "references": [
            "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
            "dvd-game-new-releases.info",
            "1.116.217.151 [Cobalt Strike]",
            "https://www.myminiweb.com/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "http://alohatube.xyz/search/tsara-brashears",
            "vtbehaviour.commondatastorage.googleapis.com",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://tulach.cc/",
            "ns3.hallgrandsale.ru"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "HallGrand",
              "display_name": "HallGrand",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1059.002",
              "name": "AppleScript",
              "display_name": "T1059.002 - AppleScript"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b85faa9b8e3e1206d7f25c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13324,
            "FileHash-MD5": 718,
            "FileHash-SHA1": 617,
            "FileHash-SHA256": 5761,
            "domain": 3501,
            "hostname": 4475,
            "CVE": 1,
            "email": 3,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 28411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "807 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655bd8cdff0012b85a94364f",
          "name": "Raven",
          "description": "Source: WITHU4EVER.com \nDeepScan , browser modifier, password cracker, C2",
          "modified": "2023-12-20T21:03:27.869000",
          "created": "2023-11-20T22:08:13.877000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "tsara brashears",
            "referrer",
            "kgs0",
            "kls0",
            "apple ios",
            "critical risk",
            "attack",
            "hacktool",
            "installer",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "value",
            "variables",
            "userrecovery",
            "raven",
            "cookies",
            "reverse dns",
            "software",
            "resource hash",
            "general full",
            "url https",
            "frankfurt",
            "main",
            "germany",
            "asn20940",
            "akamaiasn1",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "europeberlin",
            "aes256gcm",
            "no data",
            "tag count",
            "threat report",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "blacklist http",
            "cisco umbrella",
            "heur",
            "site",
            "site top",
            "html",
            "safe site",
            "site safe",
            "maltiverse",
            "alexa top",
            "million",
            "unsafe",
            "malware",
            "riskware",
            "dropper",
            "team",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "cve201711882",
            "auslogics",
            "deepscan",
            "genpack",
            "phish",
            "phishing",
            "bank",
            "first",
            "trojanclicker",
            "bnr",
            "webtoolbar",
            "trojanspy",
            "tsara brashears",
            "contacted",
            "sides with",
            "amadey bot",
            "excel",
            "macros ursnif",
            "sneaky server",
            "replacement",
            "unauthorized",
            "black basta",
            "devoted high",
            "core",
            "emotet",
            "cowardly lion group",
            "sabey tooth group",
            "cp",
            "cyber",
            "diat",
            "infostealer",
            "password"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/393a851d6948e2a5d0d70ce884b3e0b4b9287b5d089671cac229ed63b42f0dba",
            "https://urlscan.io/result/9feaa404-2c53-480d-8571-542121740809/#indicators",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/      \u2022 Phishing",
            "http://45.159.189.105/bot/regex \u2022 Tracking Tsara Brashears Botnetwork",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 Password Cracker",
            "nr-data.net   \u2022  Apple Private Data Collection",
            "www.supernetforme.com \u2022 CNC",
            "103.224.212.219  \u2022 CNC",
            "45.159.189.105      \u2022 CNC",
            "Resource: WithU4ever.com"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanClicker",
              "display_name": "TrojanClicker",
              "target": null
            },
            {
              "id": "BNR",
              "display_name": "BNR",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Sabey Tooth",
              "display_name": "Sabey Tooth",
              "target": null
            },
            {
              "id": "IObit",
              "display_name": "IObit",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Swrort Stager",
              "display_name": "Swrort Stager",
              "target": null
            },
            {
              "id": "TrojanClicker.",
              "display_name": "TrojanClicker.",
              "target": null
            },
            {
              "id": "Sality",
              "display_name": "Sality",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            },
            {
              "id": "Crack",
              "display_name": "Crack",
              "target": null
            },
            {
              "id": "PWS:Win32/Raven",
              "display_name": "PWS:Win32/Raven",
              "target": "/malware/PWS:Win32/Raven"
            },
            {
              "id": "MediaMagnet",
              "display_name": "MediaMagnet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059.003",
              "name": "Windows Command Shell",
              "display_name": "T1059.003 - Windows Command Shell"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1243,
            "URL": 4176,
            "FileHash-MD5": 63,
            "FileHash-SHA1": 24,
            "FileHash-SHA256": 1386,
            "domain": 518,
            "CIDR": 1,
            "CVE": 11,
            "email": 1
          },
          "indicator_count": 7423,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655bd8cfe894eabbe8ef2bc5",
          "name": "Raven",
          "description": "Source: WITHU4EVER.com \nDeepScan , browser modifier, password cracker, C2",
          "modified": "2023-12-20T21:03:27.869000",
          "created": "2023-11-20T22:08:15.066000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "whois whois",
            "tsara brashears",
            "referrer",
            "kgs0",
            "kls0",
            "apple ios",
            "critical risk",
            "attack",
            "hacktool",
            "installer",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "value",
            "variables",
            "userrecovery",
            "raven",
            "cookies",
            "reverse dns",
            "software",
            "resource hash",
            "general full",
            "url https",
            "frankfurt",
            "main",
            "germany",
            "asn20940",
            "akamaiasn1",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "europeberlin",
            "aes256gcm",
            "no data",
            "tag count",
            "threat report",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "blacklist http",
            "cisco umbrella",
            "heur",
            "site",
            "site top",
            "html",
            "safe site",
            "site safe",
            "maltiverse",
            "alexa top",
            "million",
            "unsafe",
            "malware",
            "riskware",
            "dropper",
            "team",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "cve201711882",
            "auslogics",
            "deepscan",
            "genpack",
            "phish",
            "phishing",
            "bank",
            "first",
            "trojanclicker",
            "bnr",
            "webtoolbar",
            "trojanspy",
            "tsara brashears",
            "contacted",
            "sides with",
            "amadey bot",
            "excel",
            "macros ursnif",
            "sneaky server",
            "replacement",
            "unauthorized",
            "black basta",
            "devoted high",
            "core",
            "emotet",
            "cowardly lion group",
            "sabey tooth group",
            "cp",
            "cyber",
            "diat",
            "infostealer",
            "password"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/393a851d6948e2a5d0d70ce884b3e0b4b9287b5d089671cac229ed63b42f0dba",
            "https://urlscan.io/result/9feaa404-2c53-480d-8571-542121740809/#indicators",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/      \u2022 Phishing",
            "http://45.159.189.105/bot/regex \u2022 Tracking Tsara Brashears Botnetwork",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 Password Cracker",
            "nr-data.net   \u2022  Apple Private Data Collection",
            "www.supernetforme.com \u2022 CNC",
            "103.224.212.219  \u2022 CNC",
            "45.159.189.105      \u2022 CNC",
            "Resource: WithU4ever.com"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanClicker",
              "display_name": "TrojanClicker",
              "target": null
            },
            {
              "id": "BNR",
              "display_name": "BNR",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "IceFog",
              "display_name": "IceFog",
              "target": null
            },
            {
              "id": "Sabey Tooth",
              "display_name": "Sabey Tooth",
              "target": null
            },
            {
              "id": "IObit",
              "display_name": "IObit",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Swrort Stager",
              "display_name": "Swrort Stager",
              "target": null
            },
            {
              "id": "TrojanClicker.",
              "display_name": "TrojanClicker.",
              "target": null
            },
            {
              "id": "Sality",
              "display_name": "Sality",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            },
            {
              "id": "Crack",
              "display_name": "Crack",
              "target": null
            },
            {
              "id": "PWS:Win32/Raven",
              "display_name": "PWS:Win32/Raven",
              "target": "/malware/PWS:Win32/Raven"
            },
            {
              "id": "MediaMagnet",
              "display_name": "MediaMagnet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1059.003",
              "name": "Windows Command Shell",
              "display_name": "T1059.003 - Windows Command Shell"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1114.002",
              "name": "Remote Email Collection",
              "display_name": "T1114.002 - Remote Email Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1243,
            "URL": 4176,
            "FileHash-MD5": 63,
            "FileHash-SHA1": 24,
            "FileHash-SHA256": 1386,
            "domain": 518,
            "CIDR": 1,
            "CVE": 11,
            "email": 1
          },
          "indicator_count": 7423,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/      \u2022 Phishing",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 Password Cracker",
        "ns3.hallgrandsale.ru",
        "www.supernetforme.com \u2022 CNC",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "nr-data.net   \u2022  Apple Private Data Collection",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.hybrid-analysis.com/sample/393a851d6948e2a5d0d70ce884b3e0b4b9287b5d089671cac229ed63b42f0dba",
        "45.159.189.105      \u2022 CNC",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "Resource: WithU4ever.com",
        "103.224.212.219  \u2022 CNC",
        "https://www.myminiweb.com/",
        "https://urlscan.io/result/9feaa404-2c53-480d-8571-542121740809/#indicators",
        "dvd-game-new-releases.info",
        "http://45.159.189.105/bot/regex \u2022 Tracking Tsara Brashears Botnetwork",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://tulach.cc/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Cobalt strike",
            "Artemis",
            "Icefog",
            "Sabey tooth",
            "Hallrender",
            "Unruy",
            "Sality",
            "Swrort stager",
            "Mediamagnet",
            "Trojanspy",
            "Pws:win32/raven",
            "Trojanclicker",
            "Webtoolbar",
            "Installcore",
            "Iobit",
            "Tulach",
            "Et",
            "Hallgrand",
            "Emotet",
            "Content reputation",
            "Trojanclicker.",
            "Bnr",
            "Crack"
          ],
          "industries": [],
          "unique_indicators": 34211
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/scriptlisting.com",
    "whois": "http://whois.domaintools.com/scriptlisting.com",
    "domain": "scriptlisting.com",
    "hostname": "originatesoft.scriptlisting.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "65b85faa9b8e3e1206d7f25c",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection ",
      "description": "",
      "modified": "2024-06-15T04:39:29.943000",
      "created": "2024-01-30T02:32:10.210000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3503,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28413,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "674 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "659719b77c383c73c05208a9",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-04T20:48:55.431000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "807 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a7e6e042a968005f7a5552",
      "name": "Content Reputation | ET | Botnet | Targeting",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-01-17T14:40:32.084000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "659719b77c383c73c05208a9",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "807 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc13594cf21dbe00b94807",
      "name": "Tsara Brashears Dead campaign | ET | Emotet Botnet | Injection",
      "description": "",
      "modified": "2024-02-03T19:04:07.916000",
      "created": "2024-02-01T21:55:37.581000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls http",
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "apple ios",
        "contacted",
        "tsara brashears",
        "whois",
        "resolutions",
        "password",
        "hacktool",
        "crypto",
        "execution",
        "emotet",
        "installer",
        "banker",
        "keylogger",
        "critical",
        "copy",
        "content reputation",
        "et",
        "submission",
        "comodo valkyrie",
        "verdict",
        "bitdefender",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url http",
        "search",
        "entries",
        "passive dns",
        "urls",
        "record value",
        "unknown",
        "united",
        "gmt content",
        "dynamic report",
        "0 report",
        "date",
        "accept",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "http response",
        "final url",
        "serving ip",
        "address",
        "ipv4",
        "files",
        "location china",
        "asn as45090",
        "dns resolutions",
        "twitter",
        "log id",
        "gmtn",
        "tls web",
        "encrypt",
        "ca issuers",
        "f20b201c",
        "b467295d",
        "b2931e3f",
        "false",
        "as15169 google",
        "domain",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "create c",
        "write c",
        "read c",
        "medium",
        "next",
        "dock",
        "write",
        "persistence",
        "delete c",
        "path",
        "xport",
        "default",
        "years ago",
        "modified",
        "created",
        "email",
        "active created",
        "white",
        "filehash",
        "memcommit",
        "tlsv1",
        "show",
        "win32",
        "malware",
        "get na",
        "systemroot",
        "starizona",
        "lscottsdale",
        "creation date",
        "emails",
        "domain name",
        "showing",
        "pulse submit",
        "amazon",
        "server ca",
        "b535",
        "tulach",
        "hallrender",
        "hallgrand",
        "briansabey",
        "brian sabey",
        "mark",
        "mark brian sabey",
        "mark sabey",
        "cybercrime",
        "cyber stalking",
        "botnet",
        "evader",
        "hacker",
        "targeting"
      ],
      "references": [
        "http://www.dvd-game-new-releases.info/skin/tsara-brashears-dead.akp",
        "dvd-game-new-releases.info",
        "1.116.217.151 [Cobalt Strike]",
        "https://www.myminiweb.com/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://alohatube.xyz/search/tsara-brashears",
        "vtbehaviour.commondatastorage.googleapis.com",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://tulach.cc/",
        "ns3.hallgrandsale.ru"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "HallGrand",
          "display_name": "HallGrand",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1059.002",
          "name": "AppleScript",
          "display_name": "T1059.002 - AppleScript"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65b85faa9b8e3e1206d7f25c",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13324,
        "FileHash-MD5": 718,
        "FileHash-SHA1": 617,
        "FileHash-SHA256": 5761,
        "domain": 3501,
        "hostname": 4475,
        "CVE": 1,
        "email": 3,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 28411,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "807 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655bd8cdff0012b85a94364f",
      "name": "Raven",
      "description": "Source: WITHU4EVER.com \nDeepScan , browser modifier, password cracker, C2",
      "modified": "2023-12-20T21:03:27.869000",
      "created": "2023-11-20T22:08:13.877000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "tsara brashears",
        "referrer",
        "kgs0",
        "kls0",
        "apple ios",
        "critical risk",
        "attack",
        "hacktool",
        "installer",
        "search live",
        "api blog",
        "docs pricing",
        "login",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "value",
        "variables",
        "userrecovery",
        "raven",
        "cookies",
        "reverse dns",
        "software",
        "resource hash",
        "general full",
        "url https",
        "frankfurt",
        "main",
        "germany",
        "asn20940",
        "akamaiasn1",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "europeberlin",
        "aes256gcm",
        "no data",
        "tag count",
        "threat report",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "count blacklist",
        "tag tag",
        "blacklist http",
        "cisco umbrella",
        "heur",
        "site",
        "site top",
        "html",
        "safe site",
        "site safe",
        "maltiverse",
        "alexa top",
        "million",
        "unsafe",
        "malware",
        "riskware",
        "dropper",
        "team",
        "union",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "cve201711882",
        "auslogics",
        "deepscan",
        "genpack",
        "phish",
        "phishing",
        "bank",
        "first",
        "trojanclicker",
        "bnr",
        "webtoolbar",
        "trojanspy",
        "tsara brashears",
        "contacted",
        "sides with",
        "amadey bot",
        "excel",
        "macros ursnif",
        "sneaky server",
        "replacement",
        "unauthorized",
        "black basta",
        "devoted high",
        "core",
        "emotet",
        "cowardly lion group",
        "sabey tooth group",
        "cp",
        "cyber",
        "diat",
        "infostealer",
        "password"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/393a851d6948e2a5d0d70ce884b3e0b4b9287b5d089671cac229ed63b42f0dba",
        "https://urlscan.io/result/9feaa404-2c53-480d-8571-542121740809/#indicators",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/      \u2022 Phishing",
        "http://45.159.189.105/bot/regex \u2022 Tracking Tsara Brashears Botnetwork",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 Password Cracker",
        "nr-data.net   \u2022  Apple Private Data Collection",
        "www.supernetforme.com \u2022 CNC",
        "103.224.212.219  \u2022 CNC",
        "45.159.189.105      \u2022 CNC",
        "Resource: WithU4ever.com"
      ],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanClicker",
          "display_name": "TrojanClicker",
          "target": null
        },
        {
          "id": "BNR",
          "display_name": "BNR",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Sabey Tooth",
          "display_name": "Sabey Tooth",
          "target": null
        },
        {
          "id": "IObit",
          "display_name": "IObit",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Swrort Stager",
          "display_name": "Swrort Stager",
          "target": null
        },
        {
          "id": "TrojanClicker.",
          "display_name": "TrojanClicker.",
          "target": null
        },
        {
          "id": "Sality",
          "display_name": "Sality",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        },
        {
          "id": "Crack",
          "display_name": "Crack",
          "target": null
        },
        {
          "id": "PWS:Win32/Raven",
          "display_name": "PWS:Win32/Raven",
          "target": "/malware/PWS:Win32/Raven"
        },
        {
          "id": "MediaMagnet",
          "display_name": "MediaMagnet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059.003",
          "name": "Windows Command Shell",
          "display_name": "T1059.003 - Windows Command Shell"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1243,
        "URL": 4176,
        "FileHash-MD5": 63,
        "FileHash-SHA1": 24,
        "FileHash-SHA256": 1386,
        "domain": 518,
        "CIDR": 1,
        "CVE": 11,
        "email": 1
      },
      "indicator_count": 7423,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655bd8cfe894eabbe8ef2bc5",
      "name": "Raven",
      "description": "Source: WITHU4EVER.com \nDeepScan , browser modifier, password cracker, C2",
      "modified": "2023-12-20T21:03:27.869000",
      "created": "2023-11-20T22:08:15.066000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "whois whois",
        "tsara brashears",
        "referrer",
        "kgs0",
        "kls0",
        "apple ios",
        "critical risk",
        "attack",
        "hacktool",
        "installer",
        "search live",
        "api blog",
        "docs pricing",
        "login",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "value",
        "variables",
        "userrecovery",
        "raven",
        "cookies",
        "reverse dns",
        "software",
        "resource hash",
        "general full",
        "url https",
        "frankfurt",
        "main",
        "germany",
        "asn20940",
        "akamaiasn1",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "europeberlin",
        "aes256gcm",
        "no data",
        "tag count",
        "threat report",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "count blacklist",
        "tag tag",
        "blacklist http",
        "cisco umbrella",
        "heur",
        "site",
        "site top",
        "html",
        "safe site",
        "site safe",
        "maltiverse",
        "alexa top",
        "million",
        "unsafe",
        "malware",
        "riskware",
        "dropper",
        "team",
        "union",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "cve201711882",
        "auslogics",
        "deepscan",
        "genpack",
        "phish",
        "phishing",
        "bank",
        "first",
        "trojanclicker",
        "bnr",
        "webtoolbar",
        "trojanspy",
        "tsara brashears",
        "contacted",
        "sides with",
        "amadey bot",
        "excel",
        "macros ursnif",
        "sneaky server",
        "replacement",
        "unauthorized",
        "black basta",
        "devoted high",
        "core",
        "emotet",
        "cowardly lion group",
        "sabey tooth group",
        "cp",
        "cyber",
        "diat",
        "infostealer",
        "password"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/393a851d6948e2a5d0d70ce884b3e0b4b9287b5d089671cac229ed63b42f0dba",
        "https://urlscan.io/result/9feaa404-2c53-480d-8571-542121740809/#indicators",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/      \u2022 Phishing",
        "http://45.159.189.105/bot/regex \u2022 Tracking Tsara Brashears Botnetwork",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 Password Cracker",
        "nr-data.net   \u2022  Apple Private Data Collection",
        "www.supernetforme.com \u2022 CNC",
        "103.224.212.219  \u2022 CNC",
        "45.159.189.105      \u2022 CNC",
        "Resource: WithU4ever.com"
      ],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanClicker",
          "display_name": "TrojanClicker",
          "target": null
        },
        {
          "id": "BNR",
          "display_name": "BNR",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "IceFog",
          "display_name": "IceFog",
          "target": null
        },
        {
          "id": "Sabey Tooth",
          "display_name": "Sabey Tooth",
          "target": null
        },
        {
          "id": "IObit",
          "display_name": "IObit",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Swrort Stager",
          "display_name": "Swrort Stager",
          "target": null
        },
        {
          "id": "TrojanClicker.",
          "display_name": "TrojanClicker.",
          "target": null
        },
        {
          "id": "Sality",
          "display_name": "Sality",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        },
        {
          "id": "Crack",
          "display_name": "Crack",
          "target": null
        },
        {
          "id": "PWS:Win32/Raven",
          "display_name": "PWS:Win32/Raven",
          "target": "/malware/PWS:Win32/Raven"
        },
        {
          "id": "MediaMagnet",
          "display_name": "MediaMagnet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1059.003",
          "name": "Windows Command Shell",
          "display_name": "T1059.003 - Windows Command Shell"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1114.002",
          "name": "Remote Email Collection",
          "display_name": "T1114.002 - Remote Email Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1243,
        "URL": 4176,
        "FileHash-MD5": 63,
        "FileHash-SHA1": 24,
        "FileHash-SHA256": 1386,
        "domain": 518,
        "CIDR": 1,
        "CVE": 11,
        "email": 1
      },
      "indicator_count": 7423,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://originatesoft.scriptlisting.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://originatesoft.scriptlisting.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776745487.6006098
}